ima: differentiate appraise status only for hook specific rules

Different hooks can require different methods for appraising a
file's integrity.  As a result, an integrity appraisal status is
cached on a per hook basis.

Only a hook specific rule, requires the inode to be re-appraised.
This patch eliminates unnecessary appraisals.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 66b7f408eff275038bf587bb7a05cff2fbc9677d..3e751a9743a1896365b8ef730b77603074e2ee91 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -146,7 +146,7 @@ static int process_measurement(struct file *file, const char *filename,
        struct integrity_iint_cache *iint;
        char *pathbuf = NULL;
        const char *pathname = NULL;
-       int rc = -ENOMEM, action, must_appraise;
+       int rc = -ENOMEM, action, must_appraise, _func;
 
        if (!ima_initialized || !S_ISREG(inode->i_mode))
                return 0;
@@ -161,6 +161,9 @@ static int process_measurement(struct file *file, const char *filename,
 
        must_appraise = action & IMA_APPRAISE;
 
+       /*  Is the appraise rule hook specific?  */
+       _func = (action & IMA_FILE_APPRAISE) ? FILE_CHECK : function;
+
        mutex_lock(&inode->i_mutex);
 
        iint = integrity_inode_get(inode);
@@ -178,7 +181,7 @@ static int process_measurement(struct file *file, const char *filename,
        /* Nothing to do, just return existing appraised status */
        if (!action) {
                if (must_appraise)
-                       rc = ima_get_cache_status(iint, function);
+                       rc = ima_get_cache_status(iint, _func);
                goto out_digsig;
        }
 
@@ -195,7 +198,7 @@ static int process_measurement(struct file *file, const char *filename,
        if (action & IMA_MEASURE)
                ima_store_measurement(iint, file, pathname);
        if (action & IMA_APPRAISE_SUBMASK)
-               rc = ima_appraise_measurement(function, iint, file, pathname);
+               rc = ima_appraise_measurement(_func, iint, file, pathname);
        if (action & IMA_AUDIT)
                ima_audit_measurement(iint, pathname);
        kfree(pathbuf);

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 4d7c0ae656d3223c88f448b082b1b0db69831912..4adcd0f8c1dd5f6a264db30ee5c08e6c906d9198 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -220,10 +220,13 @@ retry:
 
 /*
  * In addition to knowing that we need to appraise the file in general,
- * we need to differentiate between calling hooks.
+ * we need to differentiate between calling hooks, for hook specific rules.
  */
-static int get_subaction(int func)
+static int get_subaction(struct ima_rule_entry *rule, int func)
 {
+       if (!(rule->flags & IMA_FUNC))
+               return IMA_FILE_APPRAISE;
+
        switch(func) {
        case MMAP_CHECK:
                return IMA_MMAP_APPRAISE;
@@ -268,7 +271,7 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
 
                action |= entry->action & IMA_DO_MASK;
                if (entry->action & IMA_APPRAISE)
-                       action |= get_subaction(func);
+                       action |= get_subaction(entry, func);
 
                if (entry->action & IMA_DO_MASK)
                        actmask &= ~(entry->action | entry->action << 1);