| Message ID | 20180420132857.31332-1-pvorel@suse.cz (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Fri, 2018-04-20 at 15:28 +0200, Petr Vorel wrote: > Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n > keeps 0600 mode after loading policy. Remove write permission to state > that policy file no longer be written. > > Signed-off-by: Petr Vorel <pvorel@suse.cz> Queued in the next-integrity branch. thanks, Mimi > --- > security/integrity/ima/ima_fs.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c > index fa540c0469da..c1265127d1b6 100644 > --- a/security/integrity/ima/ima_fs.c > +++ b/security/integrity/ima/ima_fs.c > @@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file) > ima_policy = NULL; > #elif defined(CONFIG_IMA_WRITE_POLICY) > clear_bit(IMA_FS_BUSY, &ima_fs_flags); > +#elif defined(CONFIG_IMA_READ_POLICY) > + inode->i_mode &= ~S_IWUSR; > #endif > return 0; > }
Hi Peter, On Fri, 2018-04-20 at 15:28 +0200, Petr Vorel wrote: > Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n > keeps 0600 mode after loading policy. Remove write permission to state > that policy file no longer be written. > > Signed-off-by: Petr Vorel <pvorel@suse.cz> > --- > security/integrity/ima/ima_fs.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c > index fa540c0469da..c1265127d1b6 100644 > --- a/security/integrity/ima/ima_fs.c > +++ b/security/integrity/ima/ima_fs.c > @@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file) > ima_policy = NULL; > #elif defined(CONFIG_IMA_WRITE_POLICY) > clear_bit(IMA_FS_BUSY, &ima_fs_flags); > +#elif defined(CONFIG_IMA_READ_POLICY) > + inode->i_mode &= ~S_IWUSR; > #endif > return 0; > } Thinking about this again, do we need to take the i_rwsem lock and call simple_setattr() as Matthew did in "EVM: Allow runtime modification of the set of verified xattrs"? thanks, Mimi
Hi Mimi, Matthew, > Hi Peter, > On Fri, 2018-04-20 at 15:28 +0200, Petr Vorel wrote: > > Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n > > keeps 0600 mode after loading policy. Remove write permission to state > > that policy file no longer be written. > > Signed-off-by: Petr Vorel <pvorel@suse.cz> > > --- > > security/integrity/ima/ima_fs.c | 2 ++ > > 1 file changed, 2 insertions(+) > > diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c > > index fa540c0469da..c1265127d1b6 100644 > > --- a/security/integrity/ima/ima_fs.c > > +++ b/security/integrity/ima/ima_fs.c > > @@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file) > > ima_policy = NULL; > > #elif defined(CONFIG_IMA_WRITE_POLICY) > > clear_bit(IMA_FS_BUSY, &ima_fs_flags); > > +#elif defined(CONFIG_IMA_READ_POLICY) > > + inode->i_mode &= ~S_IWUSR; > > #endif > > return 0; > > } > Thinking about this again, do we need to take the i_rwsem lock and > call simple_setattr() as Matthew did in "EVM: Allow runtime > modification of the set of verified xattrs"? Not really sure, I didn't know that EVM is supposed to be used also for sysfs. Matthew, does it make sense to you? > thanks, > Mimi Kind regards, Petr
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index fa540c0469da..c1265127d1b6 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -434,6 +434,8 @@ static int ima_release_policy(struct inode *inode, struct file *file) ima_policy = NULL; #elif defined(CONFIG_IMA_WRITE_POLICY) clear_bit(IMA_FS_BUSY, &ima_fs_flags); +#elif defined(CONFIG_IMA_READ_POLICY) + inode->i_mode &= ~S_IWUSR; #endif return 0; }
Kernel configured as CONFIG_IMA_READ_POLICY=y && CONFIG_IMA_WRITE_POLICY=n keeps 0600 mode after loading policy. Remove write permission to state that policy file no longer be written. Signed-off-by: Petr Vorel <pvorel@suse.cz> --- security/integrity/ima/ima_fs.c | 2 ++ 1 file changed, 2 insertions(+)