IMA: don't propagate opened through the entire thing

just check ->f_mode in ima_appraise_measurement()

Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/namei.c b/fs/namei.c
index 4bd7cc0d752255947e53c71c31a3f8c405d5f970..d2aeb282ed05f855a0108d73d489796e8e30b23c 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3400,8 +3400,7 @@ static int do_last(struct nameidata *nd,
        if (error)
                goto out;
 opened:
-       error = ima_file_check(file, op->acc_mode,
-                               file->f_mode & FMODE_CREATED ? FILE_CREATED : 0);
+       error = ima_file_check(file, op->acc_mode);
        if (!error && will_truncate)
                error = handle_truncate(file);
 out:

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index b0555d7d8200f237bd2feafa58bd5303494bd3b2..55a099e47ba2773e94e126285efc937391dee5d4 100644 (file)
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -763,7 +763,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
                goto out_nfserr;
        }
 
-       host_err = ima_file_check(file, may_flags, 0);
+       host_err = ima_file_check(file, may_flags);
        if (host_err) {
                fput(file);
                goto out_nfserr;

diff --git a/include/linux/ima.h b/include/linux/ima.h
index 0e4647e0eb60caf9fc5f22ef5ecf1888771a4d9e..d9ba3fc363b7cef4e7347bdb88d0224615887c02 100644 (file)
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -16,7 +16,7 @@ struct linux_binprm;
 
 #ifdef CONFIG_IMA
 extern int ima_bprm_check(struct linux_binprm *bprm);
-extern int ima_file_check(struct file *file, int mask, int opened);
+extern int ima_file_check(struct file *file, int mask);
 extern void ima_file_free(struct file *file);
 extern int ima_file_mmap(struct file *file, unsigned long prot);
 extern int ima_read_file(struct file *file, enum kernel_read_file_id id);
@@ -34,7 +34,7 @@ static inline int ima_bprm_check(struct linux_binprm *bprm)
        return 0;
 }
 
-static inline int ima_file_check(struct file *file, int mask, int opened)
+static inline int ima_file_check(struct file *file, int mask)
 {
        return 0;
 }

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 354bb5716ce329a39e43413a9ed373008c901b1e..e4c1a236976cb4650413160d928dabb3b51b28ec 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -238,7 +238,7 @@ int ima_appraise_measurement(enum ima_hooks func,
                             struct integrity_iint_cache *iint,
                             struct file *file, const unsigned char *filename,
                             struct evm_ima_xattr_data *xattr_value,
-                            int xattr_len, int opened);
+                            int xattr_len);
 int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func);
 void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file);
 enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
@@ -254,7 +254,7 @@ static inline int ima_appraise_measurement(enum ima_hooks func,
                                           struct file *file,
                                           const unsigned char *filename,
                                           struct evm_ima_xattr_data *xattr_value,
-                                          int xattr_len, int opened)
+                                          int xattr_len)
 {
        return INTEGRITY_UNKNOWN;
 }

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 8bd7a0733e5179eca03febd8524a2c08b142cfde..deec1804a00aa488d02b307371cfc18475127bc3 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -212,7 +212,7 @@ int ima_appraise_measurement(enum ima_hooks func,
                             struct integrity_iint_cache *iint,
                             struct file *file, const unsigned char *filename,
                             struct evm_ima_xattr_data *xattr_value,
-                            int xattr_len, int opened)
+                            int xattr_len)
 {
        static const char op[] = "appraise_data";
        const char *cause = "unknown";
@@ -231,7 +231,7 @@ int ima_appraise_measurement(enum ima_hooks func,
                cause = iint->flags & IMA_DIGSIG_REQUIRED ?
                                "IMA-signature-required" : "missing-hash";
                status = INTEGRITY_NOLABEL;
-               if (opened & FILE_CREATED)
+               if (file->f_mode & FMODE_CREATED)
                        iint->flags |= IMA_NEW_FILE;
                if ((iint->flags & IMA_NEW_FILE) &&
                    (!(iint->flags & IMA_DIGSIG_REQUIRED) ||

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index dca44cf7838eaddf882212faedc9759a391f7723..b286f37712d506de48285467b55d739e423e881c 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -168,7 +168,7 @@ void ima_file_free(struct file *file)
 
 static int process_measurement(struct file *file, const struct cred *cred,
                               u32 secid, char *buf, loff_t size, int mask,
-                              enum ima_hooks func, int opened)
+                              enum ima_hooks func)
 {
        struct inode *inode = file_inode(file);
        struct integrity_iint_cache *iint = NULL;
@@ -294,7 +294,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
        if (rc == 0 && (action & IMA_APPRAISE_SUBMASK)) {
                inode_lock(inode);
                rc = ima_appraise_measurement(func, iint, file, pathname,
-                                             xattr_value, xattr_len, opened);
+                                             xattr_value, xattr_len);
                inode_unlock(inode);
        }
        if (action & IMA_AUDIT)
@@ -338,7 +338,7 @@ int ima_file_mmap(struct file *file, unsigned long prot)
        if (file && (prot & PROT_EXEC)) {
                security_task_getsecid(current, &secid);
                return process_measurement(file, current_cred(), secid, NULL,
-                                          0, MAY_EXEC, MMAP_CHECK, 0);
+                                          0, MAY_EXEC, MMAP_CHECK);
        }
 
        return 0;
@@ -364,13 +364,13 @@ int ima_bprm_check(struct linux_binprm *bprm)
 
        security_task_getsecid(current, &secid);
        ret = process_measurement(bprm->file, current_cred(), secid, NULL, 0,
-                                 MAY_EXEC, BPRM_CHECK, 0);
+                                 MAY_EXEC, BPRM_CHECK);
        if (ret)
                return ret;
 
        security_cred_getsecid(bprm->cred, &secid);
        return process_measurement(bprm->file, bprm->cred, secid, NULL, 0,
-                                  MAY_EXEC, CREDS_CHECK, 0);
+                                  MAY_EXEC, CREDS_CHECK);
 }
 
 /**
@@ -383,14 +383,14 @@ int ima_bprm_check(struct linux_binprm *bprm)
  * On success return 0.  On integrity appraisal error, assuming the file
  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
  */
-int ima_file_check(struct file *file, int mask, int opened)
+int ima_file_check(struct file *file, int mask)
 {
        u32 secid;
 
        security_task_getsecid(current, &secid);
        return process_measurement(file, current_cred(), secid, NULL, 0,
                                   mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
-                                          MAY_APPEND), FILE_CHECK, opened);
+                                          MAY_APPEND), FILE_CHECK);
 }
 EXPORT_SYMBOL_GPL(ima_file_check);
 
@@ -493,7 +493,7 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
        func = read_idmap[read_id] ?: FILE_CHECK;
        security_task_getsecid(current, &secid);
        return process_measurement(file, current_cred(), secid, buf, size,
-                                  MAY_READ, func, 0);
+                                  MAY_READ, func);
 }
 
 static int __init init_ima(void)