Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ima: Improvements in ima_appraise_measurement()

Browse source 
Replace nested ifs in the EVM xattr verification logic with a switch
statement, making the code easier to understand.

Also, add comments to the if statements in the out section and constify the
cause variable.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
This commit is contained in:
Thiago Jung Bauermann 2018-03-15 17:33:42 -03:00 • committed by Mimi Zohar
parent 1775cb87b0
commit f5e51fa368
1 changed files with 22 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
security/integrity/ima/ima_appraise.c
View file

@ -215,7 +215,7 @@ int ima_appraise_measurement(enum ima_hooks func,
int xattr_len, int opened) int xattr_len, int opened)
{ {
static const char op[] = "appraise_data"; static const char op[] = "appraise_data";
char *cause = "unknown"; const char *cause = "unknown";
struct dentry *dentry = file_dentry(file); struct dentry *dentry = file_dentry(file);
struct inode *inode = d_backing_inode(dentry); struct inode *inode = d_backing_inode(dentry);
enum integrity_status status = INTEGRITY_UNKNOWN; enum integrity_status status = INTEGRITY_UNKNOWN;
@ -241,16 +241,22 @@ int ima_appraise_measurement(enum ima_hooks func,
} }
status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint); status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value, rc, iint);
if ((status != INTEGRITY_PASS) && switch (status) {
(status != INTEGRITY_PASS_IMMUTABLE) && case INTEGRITY_PASS:
(status != INTEGRITY_UNKNOWN)) { case INTEGRITY_PASS_IMMUTABLE:
if ((status == INTEGRITY_NOLABEL) case INTEGRITY_UNKNOWN:
|| (status == INTEGRITY_NOXATTRS)) break;
cause = "missing-HMAC"; case INTEGRITY_NOXATTRS: /* No EVM protected xattrs. */
else if (status == INTEGRITY_FAIL) case INTEGRITY_NOLABEL: /* No security.evm xattr. */
cause = "invalid-HMAC"; cause = "missing-HMAC";
goto out; goto out;
case INTEGRITY_FAIL: /* Invalid HMAC/signature. */
cause = "invalid-HMAC";
goto out;
default:
WARN_ONCE(true, "Unexpected integrity status %d\n", status);
} }
switch (xattr_value->type) { switch (xattr_value->type) {
case IMA_XATTR_DIGEST_NG: case IMA_XATTR_DIGEST_NG:
/* first byte contains algorithm id */ /* first byte contains algorithm id */
@ -316,17 +322,20 @@ int ima_appraise_measurement(enum ima_hooks func,
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
op, cause, rc, 0); op, cause, rc, 0);
} else if (status != INTEGRITY_PASS) { } else if (status != INTEGRITY_PASS) {
/* Fix mode, but don't replace file signatures. */
if ((ima_appraise & IMA_APPRAISE_FIX) && if ((ima_appraise & IMA_APPRAISE_FIX) &&
(!xattr_value || (!xattr_value ||
xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
if (!ima_fix_xattr(dentry, iint)) if (!ima_fix_xattr(dentry, iint))
status = INTEGRITY_PASS; status = INTEGRITY_PASS;
} else if ((inode->i_size == 0) && }
(iint->flags & IMA_NEW_FILE) &&
(xattr_value && /* Permit new files with file signatures, but without data. */
xattr_value->type == EVM_IMA_XATTR_DIGSIG)) { if (inode->i_size == 0 && iint->flags & IMA_NEW_FILE &&
xattr_value && xattr_value->type == EVM_IMA_XATTR_DIGSIG) {
status = INTEGRITY_PASS; status = INTEGRITY_PASS;
} }
integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename, integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
op, cause, rc, 0); op, cause, rc, 0);
} else { } else {