Commit a2d4f473 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'integrity-v6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity 

Pull ima updates from Mimi Zohar:
 "Two performance improvements, which minimize the number of integrity
  violations"

* tag 'integrity-v6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: limit the number of ToMToU integrity violations
  ima: limit the number of open-writers integrity violations
parents f174ac5b a4140162

security/integrity/ima/ima.h

+2 −1
Original line number Diff line number Diff line
@@ -181,7 +181,8 @@ struct ima_kexec_hdr { 
#define IMA_UPDATE_XATTR	1

#define IMA_CHANGE_ATTR		2

#define IMA_DIGSIG		3

#define IMA_MUST_MEASURE	4

#define IMA_MAY_EMIT_TOMTOU	4

#define IMA_EMITTED_OPENWRITERS	5



/* IMA integrity metadata associated with an inode */

struct ima_iint_cache {

security/integrity/ima/ima_main.c

+13 −5
Original line number Diff line number Diff line
@@ -129,17 +129,23 @@ static void ima_rdwr_violation_check(struct file *file, 
		if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) {

			if (!iint)

				iint = ima_iint_find(inode);



			/* IMA_MEASURE is set from reader side */

			if (iint && test_bit(IMA_MUST_MEASURE,

			if (iint && test_and_clear_bit(IMA_MAY_EMIT_TOMTOU,

						       &iint->atomic_flags))

				send_tomtou = true;

		}

	} else {

		if (must_measure)

			set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);

		if (inode_is_open_for_write(inode) && must_measure)

			set_bit(IMA_MAY_EMIT_TOMTOU, &iint->atomic_flags);



		/* Limit number of open_writers violations */

		if (inode_is_open_for_write(inode) && must_measure) {

			if (!test_and_set_bit(IMA_EMITTED_OPENWRITERS,

					      &iint->atomic_flags))

				send_writers = true;

		}

	}



	if (!send_tomtou && !send_writers)

		return;
@@ -167,6 +173,8 @@ static void ima_check_last_writer(struct ima_iint_cache *iint, 
	if (atomic_read(&inode->i_writecount) == 1) {

		struct kstat stat;



		clear_bit(IMA_EMITTED_OPENWRITERS, &iint->atomic_flags);



		update = test_and_clear_bit(IMA_UPDATE_XATTR,

					    &iint->atomic_flags);

		if ((iint->flags & IMA_NEW_FILE) ||