Commit 94e5d714 authored by Mimi Zohar's avatar Mimi Zohar Committed by James Morris
Browse files

integrity: add ima_counts_put (updated) 



This patch fixes an imbalance message as reported by J.R. Okajima.
The IMA file counters are incremented in ima_path_check. If the
actual open fails, such as ETXTBSY, decrement the counters to
prevent unnecessary imbalance messages.

Reported-by: default avatarJ.R. Okajima <hooanon05@yahoo.co.jp>
Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 79b854c5

fs/namei.c

+7 −0
Original line number Diff line number Diff line
@@ -1761,6 +1761,10 @@ do_last: 
			goto exit;

		}

		filp = nameidata_to_filp(&nd, open_flag);

		if (IS_ERR(filp))

			ima_counts_put(&nd.path,

				       acc_mode & (MAY_READ | MAY_WRITE |

						   MAY_EXEC));

		mnt_drop_write(nd.path.mnt);

		if (nd.root.mnt)

			path_put(&nd.root);
@@ -1817,6 +1821,9 @@ ok: 
		goto exit;

	}

	filp = nameidata_to_filp(&nd, open_flag);

	if (IS_ERR(filp))

		ima_counts_put(&nd.path,

			       acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC));

	/*

	 * It is now safe to drop the mnt write

	 * because the filp has had a write taken

include/linux/ima.h

+6 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ extern int ima_path_check(struct path *path, int mask, int update_counts); 
extern void ima_file_free(struct file *file);

extern int ima_file_mmap(struct file *file, unsigned long prot);

extern void ima_counts_get(struct file *file);

extern void ima_counts_put(struct path *path, int mask);



#else

static inline int ima_bprm_check(struct linux_binprm *bprm)
@@ -60,5 +61,10 @@ static inline void ima_counts_get(struct file *file) 
{

	return;

}



static inline void ima_counts_put(struct path *path, int mask)

{

	return;

}

#endif /* CONFIG_IMA_H */

#endif /* _LINUX_IMA_H */

security/integrity/ima/ima_main.c

+28 −1
Original line number Diff line number Diff line
@@ -238,7 +238,34 @@ out: 
}



/*

 * ima_opens_get - increment file counts

 * ima_counts_put - decrement file counts

 *

 * File counts are incremented in ima_path_check. On file open

 * error, such as ETXTBSY, decrement the counts to prevent

 * unnecessary imbalance messages.

 */

void ima_counts_put(struct path *path, int mask)

{

	struct inode *inode = path->dentry->d_inode;

	struct ima_iint_cache *iint;



	if (!ima_initialized || !S_ISREG(inode->i_mode))

		return;

	iint = ima_iint_find_insert_get(inode);

	if (!iint)

		return;



	mutex_lock(&iint->mutex);

	iint->opencount--;

	if ((mask & MAY_WRITE) || (mask == 0))

		iint->writecount--;

	else if (mask & (MAY_READ | MAY_EXEC))

		iint->readcount--;

	mutex_unlock(&iint->mutex);

}



/*

 * ima_counts_get - increment file counts

 *

 * - for IPC shm and shmat file.

 * - for nfsd exported files.

CRA Git | Maintained and supported by SUSTech CRA and CCSE