* [PATCH 1/3] IMA: use current_cred() instead of current->cred
@ 2009-05-11 17:59 Eric Paris
2009-05-11 17:59 ` [PATCH 2/3] IMA: Handle dentry_open failures Eric Paris
` (3 more replies)
0 siblings, 4 replies; 7+ messages in thread
From: Eric Paris @ 2009-05-11 17:59 UTC (permalink / raw)
To: zohar; +Cc: linux-kernel, jmorris
Proper invocation of the current credentials is to use current_cred() not
current->cred. This patches makes IMA use the new method.
Signed-off-by: Eric Paris <eparis@redhat.com>
---
security/integrity/ima/ima_audit.c | 2 +-
security/integrity/ima/ima_main.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/security/integrity/ima/ima_audit.c b/security/integrity/ima/ima_audit.c
index b628eea..ff513ff 100644
--- a/security/integrity/ima/ima_audit.c
+++ b/security/integrity/ima/ima_audit.c
@@ -41,7 +41,7 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);
audit_log_format(ab, "integrity: pid=%d uid=%u auid=%u ses=%u",
- current->pid, current->cred->uid,
+ current->pid, current_cred()->uid,
audit_get_loginuid(current),
audit_get_sessionid(current));
audit_log_task_context(ab);
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 122f17f..cdae13c 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -184,7 +184,7 @@ int ima_path_check(struct path *path, int mask)
struct dentry *dentry = dget(path->dentry);
struct vfsmount *mnt = mntget(path->mnt);
- file = dentry_open(dentry, mnt, O_RDONLY, current->cred);
+ file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
rc = get_path_measurement(iint, file, dentry->d_name.name);
}
out:
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH 2/3] IMA: Handle dentry_open failures
2009-05-11 17:59 [PATCH 1/3] IMA: use current_cred() instead of current->cred Eric Paris
@ 2009-05-11 17:59 ` Eric Paris
2009-05-11 23:18 ` Mimi Zohar
2009-05-11 17:59 ` [PATCH 3/3] IMA: open all files O_LARGEFILE Eric Paris
` (2 subsequent siblings)
3 siblings, 1 reply; 7+ messages in thread
From: Eric Paris @ 2009-05-11 17:59 UTC (permalink / raw)
To: zohar; +Cc: linux-kernel, jmorris
Currently IMA does not handle failures from dentry_open(). This means that we
leave a pointer set to ERR_PTR(errno) and then try to use it just a few lines
later in fput(). Oops.
Signed-off-by: Eric Paris <eparis@redhat.com>
---
security/integrity/ima/ima_main.c | 10 ++++++----
1 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index cdae13c..1987424 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -116,10 +116,6 @@ static int get_path_measurement(struct ima_iint_cache *iint, struct file *file,
{
int rc = 0;
- if (IS_ERR(file)) {
- pr_info("%s dentry_open failed\n", filename);
- return rc;
- }
iint->opencount++;
iint->readcount++;
@@ -185,6 +181,12 @@ int ima_path_check(struct path *path, int mask)
struct vfsmount *mnt = mntget(path->mnt);
file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
+ if (IS_ERR(file)) {
+ pr_info("%s dentry_open failed\n", dentry->d_name.name);
+ rc = PTR_ERR(file);
+ file = NULL;
+ goto out;
+ }
rc = get_path_measurement(iint, file, dentry->d_name.name);
}
out:
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 2/3] IMA: Handle dentry_open failures
2009-05-11 17:59 ` [PATCH 2/3] IMA: Handle dentry_open failures Eric Paris
@ 2009-05-11 23:18 ` Mimi Zohar
0 siblings, 0 replies; 7+ messages in thread
From: Mimi Zohar @ 2009-05-11 23:18 UTC (permalink / raw)
To: Eric Paris; +Cc: linux-kernel, jmorris
On Mon, 2009-05-11 at 13:59 -0400, Eric Paris wrote:
> Currently IMA does not handle failures from dentry_open(). This means that we
> leave a pointer set to ERR_PTR(errno) and then try to use it just a few lines
> later in fput(). Oops.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Mimi Zohar <zohar@us.ibm.com>
> ---
>
> security/integrity/ima/ima_main.c | 10 ++++++----
> 1 files changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index cdae13c..1987424 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -116,10 +116,6 @@ static int get_path_measurement(struct ima_iint_cache *iint, struct file *file,
> {
> int rc = 0;
>
> - if (IS_ERR(file)) {
> - pr_info("%s dentry_open failed\n", filename);
> - return rc;
> - }
> iint->opencount++;
> iint->readcount++;
>
> @@ -185,6 +181,12 @@ int ima_path_check(struct path *path, int mask)
> struct vfsmount *mnt = mntget(path->mnt);
>
> file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
> + if (IS_ERR(file)) {
> + pr_info("%s dentry_open failed\n", dentry->d_name.name);
> + rc = PTR_ERR(file);
> + file = NULL;
> + goto out;
> + }
> rc = get_path_measurement(iint, file, dentry->d_name.name);
> }
> out:
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 3/3] IMA: open all files O_LARGEFILE
2009-05-11 17:59 [PATCH 1/3] IMA: use current_cred() instead of current->cred Eric Paris
2009-05-11 17:59 ` [PATCH 2/3] IMA: Handle dentry_open failures Eric Paris
@ 2009-05-11 17:59 ` Eric Paris
2009-05-11 23:17 ` Mimi Zohar
2009-05-11 23:16 ` [PATCH 1/3] IMA: use current_cred() instead of current->cred Mimi Zohar
2009-05-12 1:35 ` James Morris
3 siblings, 1 reply; 7+ messages in thread
From: Eric Paris @ 2009-05-11 17:59 UTC (permalink / raw)
To: zohar; +Cc: linux-kernel, jmorris
If IMA tried to measure a file which was larger than 4G dentry_open would fail
with -EOVERFLOW since IMA wasn't passing O_LARGEFILE. This patch passes
O_LARGEFILE to all IMA opens to avoid this problem.
Signed-off-by: Eric Paris <eparis@redhat.com>
---
security/integrity/ima/ima_main.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 1987424..c4228c0 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -180,7 +180,8 @@ int ima_path_check(struct path *path, int mask)
struct dentry *dentry = dget(path->dentry);
struct vfsmount *mnt = mntget(path->mnt);
- file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
+ file = dentry_open(dentry, mnt, O_RDONLY | O_LARGEFILE,
+ current_cred());
if (IS_ERR(file)) {
pr_info("%s dentry_open failed\n", dentry->d_name.name);
rc = PTR_ERR(file);
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 3/3] IMA: open all files O_LARGEFILE
2009-05-11 17:59 ` [PATCH 3/3] IMA: open all files O_LARGEFILE Eric Paris
@ 2009-05-11 23:17 ` Mimi Zohar
0 siblings, 0 replies; 7+ messages in thread
From: Mimi Zohar @ 2009-05-11 23:17 UTC (permalink / raw)
To: Eric Paris; +Cc: linux-kernel, jmorris
On Mon, 2009-05-11 at 13:59 -0400, Eric Paris wrote:
> If IMA tried to measure a file which was larger than 4G dentry_open would fail
> with -EOVERFLOW since IMA wasn't passing O_LARGEFILE. This patch passes
> O_LARGEFILE to all IMA opens to avoid this problem.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Mimi Zohar <zohar@us.ibm.com>
> ---
>
> security/integrity/ima/ima_main.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 1987424..c4228c0 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -180,7 +180,8 @@ int ima_path_check(struct path *path, int mask)
> struct dentry *dentry = dget(path->dentry);
> struct vfsmount *mnt = mntget(path->mnt);
>
> - file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
> + file = dentry_open(dentry, mnt, O_RDONLY | O_LARGEFILE,
> + current_cred());
> if (IS_ERR(file)) {
> pr_info("%s dentry_open failed\n", dentry->d_name.name);
> rc = PTR_ERR(file);
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/3] IMA: use current_cred() instead of current->cred
2009-05-11 17:59 [PATCH 1/3] IMA: use current_cred() instead of current->cred Eric Paris
2009-05-11 17:59 ` [PATCH 2/3] IMA: Handle dentry_open failures Eric Paris
2009-05-11 17:59 ` [PATCH 3/3] IMA: open all files O_LARGEFILE Eric Paris
@ 2009-05-11 23:16 ` Mimi Zohar
2009-05-12 1:35 ` James Morris
3 siblings, 0 replies; 7+ messages in thread
From: Mimi Zohar @ 2009-05-11 23:16 UTC (permalink / raw)
To: Eric Paris; +Cc: linux-kernel, jmorris
On Mon, 2009-05-11 at 13:59 -0400, Eric Paris wrote:
> Proper invocation of the current credentials is to use current_cred() not
> current->cred. This patches makes IMA use the new method.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>
acked-by: Mimi Zohar <zohar@us.ibm.com>
> ---
>
> security/integrity/ima/ima_audit.c | 2 +-
> security/integrity/ima/ima_main.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/security/integrity/ima/ima_audit.c b/security/integrity/ima/ima_audit.c
> index b628eea..ff513ff 100644
> --- a/security/integrity/ima/ima_audit.c
> +++ b/security/integrity/ima/ima_audit.c
> @@ -41,7 +41,7 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
>
> ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);
> audit_log_format(ab, "integrity: pid=%d uid=%u auid=%u ses=%u",
> - current->pid, current->cred->uid,
> + current->pid, current_cred()->uid,
> audit_get_loginuid(current),
> audit_get_sessionid(current));
> audit_log_task_context(ab);
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 122f17f..cdae13c 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -184,7 +184,7 @@ int ima_path_check(struct path *path, int mask)
> struct dentry *dentry = dget(path->dentry);
> struct vfsmount *mnt = mntget(path->mnt);
>
> - file = dentry_open(dentry, mnt, O_RDONLY, current->cred);
> + file = dentry_open(dentry, mnt, O_RDONLY, current_cred());
> rc = get_path_measurement(iint, file, dentry->d_name.name);
> }
> out:
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/3] IMA: use current_cred() instead of current->cred
2009-05-11 17:59 [PATCH 1/3] IMA: use current_cred() instead of current->cred Eric Paris
` (2 preceding siblings ...)
2009-05-11 23:16 ` [PATCH 1/3] IMA: use current_cred() instead of current->cred Mimi Zohar
@ 2009-05-12 1:35 ` James Morris
3 siblings, 0 replies; 7+ messages in thread
From: James Morris @ 2009-05-12 1:35 UTC (permalink / raw)
To: Eric Paris; +Cc: zohar, linux-kernel
On Mon, 11 May 2009, Eric Paris wrote:
> Proper invocation of the current credentials is to use current_cred() not
> current->cred. This patches makes IMA use the new method.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>
All three applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2009-05-12 1:35 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-05-11 17:59 [PATCH 1/3] IMA: use current_cred() instead of current->cred Eric Paris
2009-05-11 17:59 ` [PATCH 2/3] IMA: Handle dentry_open failures Eric Paris
2009-05-11 23:18 ` Mimi Zohar
2009-05-11 17:59 ` [PATCH 3/3] IMA: open all files O_LARGEFILE Eric Paris
2009-05-11 23:17 ` Mimi Zohar
2009-05-11 23:16 ` [PATCH 1/3] IMA: use current_cred() instead of current->cred Mimi Zohar
2009-05-12 1:35 ` James Morris
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®