ima: provide flag to identify new empty files

commit b151d6b00bbb798c58f2f21305e7d43fa763f34f upstream.

On ima_file_free(), newly created empty files are not labeled with
an initial security.ima value, because the iversion did not change.
Commit dff6efc "fs: fix iversion handling" introduced a change in
iversion behavior.  To verify this change use the shell command:

  $ (exec >foo)
  $ getfattr -h -e hex -d -m security foo

This patch defines the IMA_NEW_FILE flag.  The flag is initially
set, when IMA detects that a new file is created, and subsequently
checked on the ima_file_free() hook to set the initial security.ima
value.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 734e946..6df1b25 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -194,8 +194,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
                        goto out;
 
                cause = "missing-hash";
-               status =
-                   (inode->i_size == 0) ? INTEGRITY_PASS : INTEGRITY_NOLABEL;
+               status = INTEGRITY_NOLABEL;
+               if (inode->i_size == 0) {
+                       iint->flags |= IMA_NEW_FILE;
+                       status = INTEGRITY_PASS;
+               }
                goto out;
        }
 

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 76d8aad..9f70efd 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -131,11 +131,13 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
                return;
 
        mutex_lock(&inode->i_mutex);
-       if (atomic_read(&inode->i_writecount) == 1 &&
-           iint->version != inode->i_version) {
-               iint->flags &= ~IMA_DONE_MASK;
-               if (iint->flags & IMA_APPRAISE)
-                       ima_update_xattr(iint, file);
+       if (atomic_read(&inode->i_writecount) == 1) {
+               if ((iint->version != inode->i_version) ||
+                   (iint->flags & IMA_NEW_FILE)) {
+                       iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
+                       if (iint->flags & IMA_APPRAISE)
+                               ima_update_xattr(iint, file);
+               }
        }
        mutex_unlock(&inode->i_mutex);
 }

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 33c0a70..2f8715d 100644 (file)
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -31,6 +31,7 @@
 #define IMA_DIGSIG             0x01000000
 #define IMA_DIGSIG_REQUIRED    0x02000000
 #define IMA_PERMIT_DIRECTIO    0x04000000
+#define IMA_NEW_FILE           0x08000000
 
 #define IMA_DO_MASK            (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
                                 IMA_APPRAISE_SUBMASK)