From patchwork Thu Nov 30 10:56:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roberto Sassu X-Patchwork-Id: 10084587 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E944960586 for ; Thu, 30 Nov 2017 10:59:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C7BCB29F37 for ; Thu, 30 Nov 2017 10:59:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BC5AF29F39; Thu, 30 Nov 2017 10:59:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6BCDF29F3A for ; Thu, 30 Nov 2017 10:59:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751846AbdK3K7e (ORCPT ); Thu, 30 Nov 2017 05:59:34 -0500 Received: from lhrrgout.huawei.com ([194.213.3.17]:61896 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751177AbdK3K7d (ORCPT ); Thu, 30 Nov 2017 05:59:33 -0500 Received: from LHREML713-CAH.china.huawei.com (unknown [172.18.7.107]) by Forcepoint Email with ESMTP id 90E5A51E5C3F7; Thu, 30 Nov 2017 10:59:30 +0000 (GMT) Received: from localhost.localdomain (10.204.65.254) by smtpsuk.huawei.com (10.201.108.36) with Microsoft SMTP Server (TLS) id 14.3.361.1; Thu, 30 Nov 2017 10:59:23 +0000 From: Roberto Sassu To: CC: , , Roberto Sassu Subject: [RFC][PATCH v2 4/9] ima: introduce ima_mk_null_file() Date: Thu, 30 Nov 2017 11:56:05 +0100 Message-ID: <20171130105610.15761-5-roberto.sassu@huawei.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20171130105610.15761-1-roberto.sassu@huawei.com> References: <20171130105610.15761-1-roberto.sassu@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.204.65.254] X-CFilter-Loop: Reflected Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This patch introduces ima_mk_null_file(), which creates a file descriptor connected to the null device. File descriptors inherited by child processes will be replaced with the new file descriptor if the appraisal status is not valid and appraisal is in enforcing mode. Signed-off-by: Roberto Sassu --- security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_fs.c | 57 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 2bdf10417125..f2cdd528f8ff 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -57,6 +57,7 @@ extern int ima_initialized; extern int ima_used_chip; extern int ima_hash_algo; extern int ima_appraise; +extern struct path ima_null; /* IMA event related data */ struct ima_event_data { diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index fa540c0469da..15bde1042afd 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -23,6 +23,10 @@ #include #include #include +#include +#include +#include +#include #include "ima.h" @@ -438,6 +442,52 @@ static int ima_release_policy(struct inode *inode, struct file *file) return 0; } +/* taken from security/apparmor/apparmorfs.c */ +#define NULL_FILE_NAME ".null" +struct path ima_null; + +static int ima_mk_null_file(struct dentry *parent) +{ + struct vfsmount *mount = NULL; + struct dentry *dentry; + struct inode *inode; + int count = 0; + int error = simple_pin_fs(parent->d_sb->s_type, &mount, &count); + + if (error) + return error; + + inode_lock(d_inode(parent)); + dentry = lookup_one_len(NULL_FILE_NAME, parent, strlen(NULL_FILE_NAME)); + if (IS_ERR(dentry)) { + error = PTR_ERR(dentry); + goto out; + } + inode = new_inode(parent->d_inode->i_sb); + if (!inode) { + error = -ENOMEM; + goto out1; + } + + inode->i_ino = get_next_ino(); + inode->i_mode = S_IFCHR | S_IRUGO | S_IWUGO; + inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode); + init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, + MKDEV(MEM_MAJOR, 3)); + d_instantiate(dentry, inode); + ima_null.dentry = dget(dentry); + ima_null.mnt = mntget(mount); + + error = 0; + +out1: + dput(dentry); +out: + inode_unlock(d_inode(parent)); + simple_release_fs(&mount, &count); + return error; +} + static const struct file_operations ima_measure_policy_ops = { .open = ima_open_policy, .write = ima_write_policy, @@ -448,6 +498,8 @@ static const struct file_operations ima_measure_policy_ops = { int __init ima_fs_init(void) { + int error; + ima_dir = securityfs_create_dir("ima", NULL); if (IS_ERR(ima_dir)) return -1; @@ -485,8 +537,13 @@ int __init ima_fs_init(void) if (IS_ERR(ima_policy)) goto out; + error = ima_mk_null_file(ima_dir); + if (error) + goto out; + return 0; out: + securityfs_remove(ima_null.dentry); securityfs_remove(violations); securityfs_remove(runtime_measurements_count); securityfs_remove(ascii_runtime_measurements);