aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDmitry Kasatkin2012-09-20 14:38:53 -0500
committerMimi Zohar2013-01-16 14:47:07 -0600
commitdef3e8b9ee23cb69036910e48ec4e3eff40e04cb (patch)
tree0840ab9e618f15f4c3c5e8ee6fafe5a17c814af2 /security/integrity
parente90805656d4683f84d360276102ae63adc777a38 (diff)
downloadam43-linux-kernel-def3e8b9ee23cb69036910e48ec4e3eff40e04cb.tar.gz
am43-linux-kernel-def3e8b9ee23cb69036910e48ec4e3eff40e04cb.tar.xz
am43-linux-kernel-def3e8b9ee23cb69036910e48ec4e3eff40e04cb.zip
ima: set appraise status in fix mode only when xattr is fixed
When a file system is mounted read-only, setting the xattr value in fix mode fails with an error code -EROFS. The xattr should be fixed after the file system is remounted read-write. This patch verifies that the set xattr succeeds, before setting the appraise status value to INTEGRITY_PASS. Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Diffstat (limited to 'security/integrity')
-rw-r--r--security/integrity/ima/ima_appraise.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index bdc8ba1d1d2..b240c58403e 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -42,12 +42,13 @@ int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
42 return ima_match_policy(inode, func, mask, IMA_APPRAISE); 42 return ima_match_policy(inode, func, mask, IMA_APPRAISE);
43} 43}
44 44
45static void ima_fix_xattr(struct dentry *dentry, 45static int ima_fix_xattr(struct dentry *dentry,
46 struct integrity_iint_cache *iint) 46 struct integrity_iint_cache *iint)
47{ 47{
48 iint->ima_xattr.type = IMA_XATTR_DIGEST; 48 iint->ima_xattr.type = IMA_XATTR_DIGEST;
49 __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA, (u8 *)&iint->ima_xattr, 49 return __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA,
50 sizeof iint->ima_xattr, 0); 50 (u8 *)&iint->ima_xattr,
51 sizeof(iint->ima_xattr), 0);
51} 52}
52 53
53/* 54/*
@@ -141,8 +142,8 @@ out:
141 if ((ima_appraise & IMA_APPRAISE_FIX) && 142 if ((ima_appraise & IMA_APPRAISE_FIX) &&
142 (!xattr_value || 143 (!xattr_value ||
143 xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { 144 xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
144 ima_fix_xattr(dentry, iint); 145 if (!ima_fix_xattr(dentry, iint))
145 status = INTEGRITY_PASS; 146 status = INTEGRITY_PASS;
146 } 147 }
147 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, 148 integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
148 op, cause, rc, 0); 149 op, cause, rc, 0);