kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/security/integrity
History
Daniel Glöckner 91034255e4 ima: accept previously set IMA_NEW_FILE 
commit 1ac202e978 upstream.

Modifying the attributes of a file makes ima_inode_post_setattr reset
the IMA cache flags. So if the file, which has just been created,
is opened a second time before the first file descriptor is closed,
verification fails since the security.ima xattr has not been written
yet. We therefore have to look at the IMA_NEW_FILE even if the file
already existed.

With this patch there should no longer be an error when cat tries to
open testfile:

$ rm -f testfile
$ ( echo test >&3 ; touch testfile ; cat testfile ) 3>testfile

A file being new is no reason to accept that it is missing a digital
signature demanded by the policy.

Signed-off-by: Daniel Glöckner <dg@emlix.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-05-25 15:44:34 +02:00
..
evm xattr: Add __vfs_{get,set,remove}xattr helpers 2016-10-07 20:10:44 -04:00
ima ima: accept previously set IMA_NEW_FILE 2017-05-25 15:44:34 +02:00
digsig.c IMA: Use the the system trusted keyrings instead of .ima_mok 2016-04-11 22:49:15 +01:00
digsig_asymmetric.c X.509: Make algo identifiers text instead of enum 2016-03-03 21:49:27 +00:00
iint.c integrity: add measured_pcrs field to integrity cache 2016-06-30 01:14:19 -04:00
integrity.h integrity: add measured_pcrs field to integrity cache 2016-06-30 01:14:19 -04:00
integrity_audit.c Merge git://git.infradead.org/users/eparis/audit 2014-04-12 12:38:53 -07:00
Kconfig security: integrity: Remove select to deleted option PUBLIC_KEY_ALGO_RSA 2016-04-12 19:54:58 +01:00
Makefile integrity: make integrity files as 'integrity' module 2014-09-09 10:28:58 -04:00