ima: limit file hash setting by user to fix and log modes
authorDmitry Kasatkin <d.kasatkin@samsung.com>
Thu, 23 Oct 2014 12:53:21 +0000 (15:53 +0300)
committerMimi Zohar <zohar@linux.vnet.ibm.com>
Thu, 21 May 2015 17:28:46 +0000 (13:28 -0400)
File hashes are automatically set and updated and should not be
manually set. This patch limits file hash setting to fix and log
modes.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
security/integrity/ima/ima_appraise.c

index 4df493e4b3c9108e1c37e00397a4c4c56809c4da..1873b5536f804c28cbb9452b5b1a8cc2f180828a 100644 (file)
@@ -378,10 +378,14 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
        result = ima_protect_xattr(dentry, xattr_name, xattr_value,
                                   xattr_value_len);
        if (result == 1) {
+               bool digsig;
+
                if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
                        return -EINVAL;
-               ima_reset_appraise_flags(d_backing_inode(dentry),
-                        (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
+               digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
+               if (!digsig && (ima_appraise & IMA_APPRAISE_ENFORCE))
+                       return -EPERM;
+               ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
                result = 0;
        }
        return result;