ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash() (0014cc04) · Commits · 戴 / test

Commit ("ima: open a new file instance if no read permissions") tries to create a new file descriptor to calculate a file digest if the file has not been opened with O_RDONLY flag. However, if a new file descriptor cannot be obtained, it sets the FMODE_READ flag to file->f_flags instead of file->f_mode. This patch fixes this issue by replacing f_flags with f_mode as it was before that commit. Cc: stable@vger.kernel.org # 4.20.x Fixes: ("ima: open a new file instance if no read permissions") Signed-off-by:

Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by:

Goldwyn Rodrigues <rgoldwyn@suse.com> Signed-off-by:

Mimi Zohar <zohar@linux.ibm.com>

security/integrity/ima/ima_crypto.c

+6 −6

Original line number	Diff line number	Diff line
		@@ -411,7 +411,7 @@ int ima_calc_file_hash(struct file file, struct ima_digest_data hash)
		loff_t i_size;
		int rc;
		struct file *f = file;
		bool new_file_instance = false, modified_flags = false;
		bool new_file_instance = false, modified_mode = false;

		/*
		* For consistency, fail file's opened with the O_DIRECT flag on
		@@ -431,13 +431,13 @@ int ima_calc_file_hash(struct file file, struct ima_digest_data hash)
		f = dentry_open(&file->f_path, flags, file->f_cred);
		if (IS_ERR(f)) {
		/*
		* Cannot open the file again, lets modify f_flags
		* Cannot open the file again, lets modify f_mode
		* of original and continue
		*/
		pr_info_ratelimited("Unable to reopen file for reading.\n");
		f = file;
		f->f_flags \|= FMODE_READ;
		modified_flags = true;
		f->f_mode \|= FMODE_READ;
		modified_mode = true;
		} else {
		new_file_instance = true;
		}
		@@ -455,8 +455,8 @@ int ima_calc_file_hash(struct file file, struct ima_digest_data hash)
		out:
		if (new_file_instance)
		fput(f);
		else if (modified_flags)
		f->f_flags &= ~FMODE_READ;
		else if (modified_mode)
		f->f_mode &= ~FMODE_READ;
		return rc;
		}

Admin message