ich777/linux_media
1
0
Fork 0
mirror of https://github.com/tbsdtv/linux_media.git synced 2025-07-23 12:43:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

IMA: Add support for file reads without contents

Browse Source 
When the kernel_read_file LSM hook is called with contents=false, IMA
can appraise the file directly, without requiring a filled buffer. When
such a buffer is available, though, IMA can continue to use it instead
of forcing a double read here.

Signed-off-by: Scott Branden <scott.branden@broadcom.com>
Link: https://lore.kernel.org/lkml/20200706232309.12010-10-scott.branden@broadcom.com/
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Link: https://lore.kernel.org/r/20201002173828.2099543-13-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Scott Branden
2020-10-02 10:38:24 -07:00
committed by Greg Kroah-Hartman
parent 2039bda1fa
commit 34736daeec
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
security/integrity/ima/ima_main.c
View File

@@ -613,11 +613,8 @@ void ima_post_path_mknod(struct dentry *dentry)
int ima_read_file(struct file *file, enum kernel_read_file_id read_id, int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
bool contents) bool contents)
{ {
/* Reject all partial reads during appraisal. */ enum ima_hooks func;
if (!contents) { u32 secid;
if (ima_appraise & IMA_APPRAISE_ENFORCE)
return -EACCES;
}
/* /*
* Do devices using pre-allocated memory run the risk of the * Do devices using pre-allocated memory run the risk of the
@@ -626,7 +623,20 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
* buffers? It may be desirable to include the buffer address * buffers? It may be desirable to include the buffer address
* in this API and walk all the dma_map_single() mappings to check. * in this API and walk all the dma_map_single() mappings to check.
*/ */
return 0;
/*
* There will be a call made to ima_post_read_file() with
* a filled buffer, so we don't need to perform an extra
* read early here.
*/
if (contents)
return 0;
/* Read entire file for all partial reads. */
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid(current, &secid);
return process_measurement(file, current_cred(), secid, NULL,
0, MAY_READ, func);
} }
const int read_idmap[READING_MAX_ID] = { const int read_idmap[READING_MAX_ID] = {