mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
ima: set appraise status in fix mode only when xattr is fixed
When a file system is mounted read-only, setting the xattr value in fix mode fails with an error code -EROFS. The xattr should be fixed after the file system is remounted read-write. This patch verifies that the set xattr succeeds, before setting the appraise status value to INTEGRITY_PASS. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
This commit is contained in:
parent
e90805656d
commit
def3e8b9ee
1 changed files with 6 additions and 5 deletions
|
@ -42,12 +42,13 @@ int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
|
||||||
return ima_match_policy(inode, func, mask, IMA_APPRAISE);
|
return ima_match_policy(inode, func, mask, IMA_APPRAISE);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void ima_fix_xattr(struct dentry *dentry,
|
static int ima_fix_xattr(struct dentry *dentry,
|
||||||
struct integrity_iint_cache *iint)
|
struct integrity_iint_cache *iint)
|
||||||
{
|
{
|
||||||
iint->ima_xattr.type = IMA_XATTR_DIGEST;
|
iint->ima_xattr.type = IMA_XATTR_DIGEST;
|
||||||
__vfs_setxattr_noperm(dentry, XATTR_NAME_IMA, (u8 *)&iint->ima_xattr,
|
return __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA,
|
||||||
sizeof iint->ima_xattr, 0);
|
(u8 *)&iint->ima_xattr,
|
||||||
|
sizeof(iint->ima_xattr), 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -141,7 +142,7 @@ int ima_appraise_measurement(struct integrity_iint_cache *iint,
|
||||||
if ((ima_appraise & IMA_APPRAISE_FIX) &&
|
if ((ima_appraise & IMA_APPRAISE_FIX) &&
|
||||||
(!xattr_value ||
|
(!xattr_value ||
|
||||||
xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
|
xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
|
||||||
ima_fix_xattr(dentry, iint);
|
if (!ima_fix_xattr(dentry, iint))
|
||||||
status = INTEGRITY_PASS;
|
status = INTEGRITY_PASS;
|
||||||
}
|
}
|
||||||
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
|
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
|
||||||
|
|
Loading…
Reference in a new issue