[RFC,17/30] ima: Add the violation counter to the namespace

Commit Message

Krzysztof Struczynski Aug. 18, 2020, 3:42 p.m. UTC

From: Krzysztof Struczynski <[e-mail]>

The violations are now tracked per namespace.

Signed-off-by: Krzysztof Struczynski <[e-mail]>
---
 include/linux/ima.h                |  1 +
 security/integrity/ima/ima.h       |  1 -
 security/integrity/ima/ima_api.c   |  2 +-
 security/integrity/ima/ima_fs.c    | 18 +++++++++++++++---
 security/integrity/ima/ima_init.c  |  1 +
 security/integrity/ima/ima_ns.c    |  1 +
 security/integrity/ima/ima_queue.c |  1 -
 7 files changed, 19 insertions(+), 6 deletions(-)

Patch

diff --git a/include/linux/ima.h b/include/linux/ima.h
index d59ed38a4305..7eb7a008c5fe 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -204,6 +204,7 @@  struct ima_namespace {
 	struct integrity_iint_tree *iint_tree;
 	struct list_head *measurements;
 	atomic_long_t ml_len; /* number of stored measurements in the list */
+	atomic_long_t violations;
 } __randomize_layout;
 
 extern struct ima_namespace init_ima_ns;
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 7318fff3ccaa..ef95522cc710 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -193,7 +193,6 @@  extern spinlock_t ima_queue_lock;
 
 struct ima_h_table {
 	atomic_long_t len;	/* number of stored measurements in the list */
-	atomic_long_t violations;
 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
 };
 extern struct ima_h_table ima_htable;
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index b01451b34a98..f91516885033 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -151,7 +151,7 @@  void ima_add_violation(struct file *file, const unsigned char *filename,
 	event_data.ns_id = get_ns_id(ima_ns);
 
 	/* can overflow, only indicator */
-	atomic_long_inc(&ima_htable.violations);
+	atomic_long_inc(&ima_ns->violations);
 
 	result = ima_alloc_init_template(&event_data, &entry, NULL);
 	if (result < 0) {
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 6d370874d80f..b71c2552ac15 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -51,10 +51,23 @@  static ssize_t ima_show_htable_violations(struct file *filp,
 					  char __user *buf,
 					  size_t count, loff_t *ppos)
 {
-	return ima_show_htable_value(buf, count, ppos, &ima_htable.violations);
+	struct ima_namespace *ima_ns = get_current_ns();
+
+	return ima_show_htable_value(buf, count, ppos, &ima_ns->violations);
+}
+
+static int ima_open_htable_violations(struct inode *inode, struct file *file)
+{
+	struct ima_namespace *ima_ns = get_current_ns();
+
+	if (!ns_capable(ima_ns->user_ns, CAP_SYS_ADMIN))
+		return -EPERM;
+
+	return 0;
 }
 
 static const struct file_operations ima_htable_violations_ops = {
+	.open = ima_open_htable_violations,
 	.read = ima_show_htable_violations,
 	.llseek = generic_file_llseek,
 };
@@ -76,7 +89,6 @@  static ssize_t ima_show_measurements_count(struct file *filp,
 	struct ima_namespace *ima_ns = get_current_ns();
 
 	return ima_show_htable_value(buf, count, ppos, &ima_ns->ml_len);
-
 }
 
 static const struct file_operations ima_measurements_count_ops = {
@@ -552,7 +564,7 @@  int __init ima_fs_init(void)
 		goto out;
 
 	violations =
-	    securityfs_create_file("violations", S_IRUSR | S_IRGRP,
+	    securityfs_create_file("violations", S_IRUSR | S_IRGRP | S_IROTH,
 				   ima_dir, NULL, &ima_htable_violations_ops);
 	if (IS_ERR(violations))
 		goto out;
diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
index ac9509d8c0f0..f7b25b3f95de 100644
--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c
@@ -37,6 +37,7 @@  struct ima_namespace init_ima_ns = {
 	.iint_tree = &init_iint_tree,
 	.measurements = &ima_measurements,
 	.ml_len = ATOMIC_LONG_INIT(0),
+	.violations = ATOMIC_LONG_INIT(0),
 };
 EXPORT_SYMBOL(init_ima_ns);
 
diff --git a/security/integrity/ima/ima_ns.c b/security/integrity/ima/ima_ns.c
index 81de492baa99..3012287b22d2 100644
--- a/security/integrity/ima/ima_ns.c
+++ b/security/integrity/ima/ima_ns.c
@@ -127,6 +127,7 @@  static struct ima_namespace *clone_ima_ns(struct user_namespace *user_ns,
 	ns->ucounts = ucounts;
 	ns->frozen = false;
 	atomic_long_set(&ns->ml_len, 0);
+	atomic_long_set(&ns->violations, 0);
 
 	rwlock_init(&ns->iint_tree->lock);
 	ns->iint_tree->root = RB_ROOT;
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index ec5b3ca3ef92..912e6097af5b 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -34,7 +34,6 @@  static unsigned long binary_runtime_size = ULONG_MAX;
 /* key: inode (before secure-hashing a file) */
 struct ima_h_table ima_htable = {
 	.len = ATOMIC_LONG_INIT(0),
-	.violations = ATOMIC_LONG_INIT(0),
 	.queue[0 ... IMA_MEASURE_HTABLE_SIZE - 1] = HLIST_HEAD_INIT
 };