Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1639893

[RFC 09/11] ima: delete namespace policy securityfs file in write-once mode

Show all headers | View raw

When policy file is written and write-once is enabled, the policy file
must be deleted. Select the namespace policy structure to get the correct
policy file descriptor.

Signed-off-by: Guilherme Magalhaes <guilherme.magalhaes@hpe.com>
---
 security/integrity/ima/ima_fs.c | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 65c43e7..94e89fe 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -575,6 +575,7 @@ static int ima_open_policy(struct inode *inode, struct file *filp)
 static int ima_release_policy(struct inode *inode, struct file *file)
 {
 	const char *cause = valid_policy ? "completed" : "failed";
+	struct ima_ns_policy *ins;
 
 	if ((file->f_flags & O_ACCMODE) == O_RDONLY)
 		return seq_release(inode, file);
@@ -595,15 +596,37 @@ static int ima_release_policy(struct inode *inode, struct file *file)
 		return 0;
 	}
 
+	/* get the namespace id from file->inode (policy file inode).
+	 * We also need to synchronize this operation with concurrent namespace
+	 * releasing. */
+	ima_namespace_lock();
+	ins = ima_get_namespace_policy_from_inode(inode);
+	if (!ins) {
+		/* the namespace is not valid anymore, discard new policy
+		 * rules and exit */
+		ima_delete_rules();
+		valid_policy = 1;
+		clear_bit(IMA_FS_BUSY, &ima_fs_flags);
+		ima_namespace_unlock();
+		return 0;
+	}
+
 	ima_update_policy();
 #ifndef	CONFIG_IMA_WRITE_POLICY
-	securityfs_remove(ima_policy_initial_ns);
-	ima_policy = NULL;
+	if (ins == &ima_initial_namespace_policy) {
+		securityfs_remove(ima_policy_initial_ns);
+		ima_policy_initial_ns = NULL;
+	} else {
+		securityfs_remove(ins->policy_dentry);
+		ins->policy_dentry = NULL;
+	}
 #endif
 
 	/* always clear the busy flag so other namespaces can use it */
 	clear_bit(IMA_FS_BUSY, &ima_fs_flags);
 
+	ima_namespace_unlock();
+
 	return 0;
 }
 
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[RFC 00/11] ima: namespace support for IMA policy Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 01/11] ima: qualify pathname in audit info record Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 04/11] ima: add support to namespace securityfs file Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
    Re: [RFC 04/11] ima: add support to namespace securityfs file Tycho Andersen <tycho@docker.com> - 2017-05-18 23:40 +0200
    Re: [RFC 04/11] ima: add support to namespace securityfs file Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-05-24 22:20 +0200
  [RFC 02/11] ima: qualify pathname in audit measurement record Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 10/11] ima: handling all policy flags per namespace using ima_ns_policy structure Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 07/11] ima: new namespace policy structure to track initial namespace policy data Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 08/11] ima: block initial namespace id on the namespace policy interface Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 05/11] ima: store new namespace policy structure in a radix tree Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 06/11] ima, fs: release namespace policy resources Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 09/11] ima: delete namespace policy securityfs file in write-once mode Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200

csiph-web