leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ima: allow to check MAY_APPEND

Browse Source 
Otherwise some mask and inmask tokens with MAY_APPEND flag may not work
as expected.

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
This commit is contained in:
Lans Zhang 2017-01-06 12:38:11 +08:00 committed by Mimi Zohar
parent bc15ed663e
commit 20f482ab9e
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
security/integrity/ima/ima_api.c
View File

@ -157,7 +157,8 @@ err_out:
/** /**
* ima_get_action - appraise & measure decision based on policy. * ima_get_action - appraise & measure decision based on policy.
* @inode: pointer to inode to measure * @inode: pointer to inode to measure
* @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE) * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
* MAY_APPEND)
* @func: caller identifier * @func: caller identifier
* @pcr: pointer filled in if matched measure policy sets pcr= * @pcr: pointer filled in if matched measure policy sets pcr=
* *

6
security/integrity/ima/ima_main.c
View File

@ -309,7 +309,7 @@ int ima_bprm_check(struct linux_binprm *bprm)
/** /**
* ima_path_check - based on policy, collect/store measurement. * ima_path_check - based on policy, collect/store measurement.
* @file: pointer to the file to be measured * @file: pointer to the file to be measured
* @mask: contains MAY_READ, MAY_WRITE or MAY_EXECUTE * @mask: contains MAY_READ, MAY_WRITE, MAY_EXEC or MAY_APPEND
* *
* Measure files based on the ima_must_measure() policy decision. * Measure files based on the ima_must_measure() policy decision.
* *
@ -319,8 +319,8 @@ int ima_bprm_check(struct linux_binprm *bprm)
int ima_file_check(struct file *file, int mask, int opened) int ima_file_check(struct file *file, int mask, int opened)
{ {
return process_measurement(file, NULL, 0, return process_measurement(file, NULL, 0,
mask & (MAY_READ | MAY_WRITE | MAY_EXEC), mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
FILE_CHECK, opened); MAY_APPEND), FILE_CHECK, opened);
} }
EXPORT_SYMBOL_GPL(ima_file_check); EXPORT_SYMBOL_GPL(ima_file_check);