Commit 5b3cd801 authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: limit the number of open-writers integrity violations 



Each time a file in policy, that is already opened for write, is opened
for read, an open-writers integrity violation audit message is emitted
and a violation record is added to the IMA measurement list. This
occurs even if an open-writers violation has already been recorded.

Limit the number of open-writers integrity violations for an existing
file open for write to one.  After the existing file open for write
closes (__fput), subsequent open-writers integrity violations may be
emitted.

Cc: stable@vger.kernel.org # applies cleanly up to linux-6.6
Tested-by: default avatarStefan Berger <stefanb@linux.ibm.com>
Reviewed-by: default avatarPetr Vorel <pvorel@suse.cz>
Tested-by: default avatarPetr Vorel <pvorel@suse.cz>
Reviewed-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 7eb17214

security/integrity/ima/ima.h

+1 −0
Original line number Diff line number Diff line
@@ -182,6 +182,7 @@ struct ima_kexec_hdr { 
#define IMA_CHANGE_ATTR		2

#define IMA_DIGSIG		3

#define IMA_MUST_MEASURE	4

#define IMA_EMITTED_OPENWRITERS	5



/* IMA integrity metadata associated with an inode */

struct ima_iint_cache {

security/integrity/ima/ima_main.c

+9 −2
Original line number Diff line number Diff line
@@ -137,9 +137,14 @@ static void ima_rdwr_violation_check(struct file *file, 
	} else {

		if (must_measure)

			set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);

		if (inode_is_open_for_write(inode) && must_measure)



		/* Limit number of open_writers violations */

		if (inode_is_open_for_write(inode) && must_measure) {

			if (!test_and_set_bit(IMA_EMITTED_OPENWRITERS,

					      &iint->atomic_flags))

				send_writers = true;

		}

	}



	if (!send_tomtou && !send_writers)

		return;
@@ -167,6 +172,8 @@ static void ima_check_last_writer(struct ima_iint_cache *iint, 
	if (atomic_read(&inode->i_writecount) == 1) {

		struct kstat stat;



		clear_bit(IMA_EMITTED_OPENWRITERS, &iint->atomic_flags);



		update = test_and_clear_bit(IMA_UPDATE_XATTR,

					    &iint->atomic_flags);

		if ((iint->flags & IMA_NEW_FILE) ||