Merge tag 'idmapped-mounts-v5.12' of git://git.kernel.org/pub/scm/linux/kernel/git...

[platform/kernel/linux-rpi.git] / security / integrity / ima / ima_main.c

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 6a42984..9ef748e 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -218,8 +218,8 @@ static int process_measurement(struct file *file, const struct cred *cred,
         * bitmask based on the appraise/audit/measurement policy.
         * Included is the appraise submask.
         */
-       action = ima_get_action(inode, cred, secid, mask, func, &pcr,
-                               &template_desc, NULL);
+       action = ima_get_action(file_mnt_user_ns(file), inode, cred, secid,
+                               mask, func, &pcr, &template_desc, NULL);
        violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) &&
                           (ima_policy_flag & IMA_MEASURE));
        if (!action && !violation_check)
@@ -431,8 +431,9 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
 
        security_task_getsecid(current, &secid);
        inode = file_inode(vma->vm_file);
-       action = ima_get_action(inode, current_cred(), secid, MAY_EXEC,
-                               MMAP_CHECK, &pcr, &template, 0);
+       action = ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
+                               current_cred(), secid, MAY_EXEC, MMAP_CHECK,
+                               &pcr, &template, 0);
 
        /* Is the mmap'ed file in policy? */
        if (!(action & (IMA_MEASURE | IMA_APPRAISE_SUBMASK)))
@@ -592,18 +593,21 @@ EXPORT_SYMBOL_GPL(ima_inode_hash);
 
 /**
  * ima_post_create_tmpfile - mark newly created tmpfile as new
+ * @mnt_userns:        user namespace of the mount the inode was found from
  * @file : newly created tmpfile
  *
  * No measuring, appraising or auditing of newly created tmpfiles is needed.
  * Skip calling process_measurement(), but indicate which newly, created
  * tmpfiles are in policy.
  */
-void ima_post_create_tmpfile(struct inode *inode)
+void ima_post_create_tmpfile(struct user_namespace *mnt_userns,
+                            struct inode *inode)
 {
        struct integrity_iint_cache *iint;
        int must_appraise;
 
-       must_appraise = ima_must_appraise(inode, MAY_ACCESS, FILE_CHECK);
+       must_appraise = ima_must_appraise(mnt_userns, inode, MAY_ACCESS,
+                                         FILE_CHECK);
        if (!must_appraise)
                return;
 
@@ -619,18 +623,21 @@ void ima_post_create_tmpfile(struct inode *inode)
 
 /**
  * ima_post_path_mknod - mark as a new inode
+ * @mnt_userns:        user namespace of the mount the inode was found from
  * @dentry: newly created dentry
  *
  * Mark files created via the mknodat syscall as new, so that the
  * file data can be written later.
  */
-void ima_post_path_mknod(struct dentry *dentry)
+void ima_post_path_mknod(struct user_namespace *mnt_userns,
+                        struct dentry *dentry)
 {
        struct integrity_iint_cache *iint;
        struct inode *inode = dentry->d_inode;
        int must_appraise;
 
-       must_appraise = ima_must_appraise(inode, MAY_ACCESS, FILE_CHECK);
+       must_appraise = ima_must_appraise(mnt_userns, inode, MAY_ACCESS,
+                                         FILE_CHECK);
        if (!must_appraise)
                return;
 
@@ -810,6 +817,7 @@ int ima_post_load_data(char *buf, loff_t size,
 
 /*
  * process_buffer_measurement - Measure the buffer or the buffer data hash
+ * @mnt_userns:        user namespace of the mount the inode was found from
  * @inode: inode associated with the object being measured (NULL for KEY_CHECK)
  * @buf: pointer to the buffer that needs to be added to the log.
  * @size: size of buffer(in bytes).
@@ -821,7 +829,8 @@ int ima_post_load_data(char *buf, loff_t size,
  *
  * Based on policy, either the buffer data or buffer data hash is measured
  */
-void process_buffer_measurement(struct inode *inode, const void *buf, int size,
+void process_buffer_measurement(struct user_namespace *mnt_userns,
+                               struct inode *inode, const void *buf, int size,
                                const char *eventname, enum ima_hooks func,
                                int pcr, const char *func_data,
                                bool buf_hash)
@@ -864,8 +873,9 @@ void process_buffer_measurement(struct inode *inode, const void *buf, int size,
         */
        if (func) {
                security_task_getsecid(current, &secid);
-               action = ima_get_action(inode, current_cred(), secid, 0, func,
-                                       &pcr, &template, func_data);
+               action = ima_get_action(mnt_userns, inode, current_cred(),
+                                       secid, 0, func, &pcr, &template,
+                                       func_data);
                if (!(action & IMA_MEASURE))
                        return;
        }
@@ -937,9 +947,9 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
        if (!f.file)
                return;
 
-       process_buffer_measurement(file_inode(f.file), buf, size,
-                                  "kexec-cmdline", KEXEC_CMDLINE, 0, NULL,
-                                  false);
+       process_buffer_measurement(file_mnt_user_ns(f.file), file_inode(f.file),
+                                  buf, size, "kexec-cmdline", KEXEC_CMDLINE, 0,
+                                  NULL, false);
        fdput(f);
 }
 
@@ -964,7 +974,7 @@ void ima_measure_critical_data(const char *event_label,
        if (!event_name || !event_label || !buf || !buf_len)
                return;
 
-       process_buffer_measurement(NULL, buf, buf_len, event_name,
+       process_buffer_measurement(&init_user_ns, NULL, buf, buf_len, event_name,
                                   CRITICAL_DATA, 0, event_label,
                                   hash);
 }