From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932574Ab3DXMLO (ORCPT ); Wed, 24 Apr 2013 08:11:14 -0400 Received: from e33.co.us.ibm.com ([32.97.110.151]:52317 "EHLO e33.co.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754741Ab3DXMLM (ORCPT ); Wed, 24 Apr 2013 08:11:12 -0400 From: Mimi Zohar To: linux-security-module@vger.kernel.org Cc: Mimi Zohar , Hugh Dickins , Eric Paris , Casey Schaufler , linux-kernel@vger.kernel.org, Mimi Zohar Subject: [PATCH 1/3] evm: calculate HMAC after initializing posix acl Date: Wed, 24 Apr 2013 08:10:39 -0400 Message-Id: <1366805441-12187-1-git-send-email-zohar@linux.vnet.ibm.com> X-Mailer: git-send-email 1.8.1.rc3 X-TM-AS-MML: No X-Content-Scanned: Fidelis XPS MAILER x-cbid: 13042412-2398-0000-0000-000013AF2964 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org (Reposting with expanded 'cc' list.) Included in the EVM hmac calculation is the i_mode. Any changes to the i_mode need to be reflected in the hmac. shmem_mknod() currently calls posix_acl_init(), which modifies the i_mode, after calling security_inode_init_security(). This patch reverses the order in which they are called. Reported-by: Sven Vermeulen Signed-off-by: Mimi Zohar --- mm/shmem.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/mm/shmem.c b/mm/shmem.c index 1c44af7..398c195 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1937,6 +1937,13 @@ shmem_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) inode = shmem_get_inode(dir->i_sb, dir, mode, dev, VM_NORESERVE); if (inode) { +#ifdef CONFIG_TMPFS_POSIX_ACL + error = generic_acl_init(inode, dir); + if (error) { + iput(inode); + return error; + } +#endif error = security_inode_init_security(inode, dir, &dentry->d_name, shmem_initxattrs, NULL); @@ -1946,15 +1953,8 @@ shmem_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) return error; } } -#ifdef CONFIG_TMPFS_POSIX_ACL - error = generic_acl_init(inode, dir); - if (error) { - iput(inode); - return error; - } -#else + error = 0; -#endif dir->i_size += BOGO_DIRENT_SIZE; dir->i_ctime = dir->i_mtime = CURRENT_TIME; d_instantiate(dentry, inode); -- 1.8.1.rc3