]> git.openfabrics.org - ~shefty/rdma-dev.git/commitdiff
Merge branch 'for-Linus' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux...
authorJames Morris <james.l.morris@oracle.com>
Mon, 7 Jan 2013 01:11:37 +0000 (12:11 +1100)
committerJames Morris <james.l.morris@oracle.com>
Mon, 7 Jan 2013 01:11:37 +0000 (12:11 +1100)
Pulled from Mimi's tree.

security/integrity/ima/ima.h
security/integrity/ima/ima_main.c
security/integrity/ima/ima_policy.c

index 3b2adb794f15506311a52b2ec5442297907ee8e2..079a85dc37b2ba9fd7d649a1a0da0e2843a9252c 100644 (file)
@@ -139,6 +139,7 @@ void ima_delete_rules(void);
 /* Appraise integrity measurements */
 #define IMA_APPRAISE_ENFORCE   0x01
 #define IMA_APPRAISE_FIX       0x02
+#define IMA_APPRAISE_MODULES   0x04
 
 #ifdef CONFIG_IMA_APPRAISE
 int ima_appraise_measurement(struct integrity_iint_cache *iint,
index 45de18e9a6f224aac3b90512fb1e4b6453b795be..dba965de90d3f838c82e1a93202bf585fa1e5cd6 100644 (file)
@@ -291,11 +291,15 @@ EXPORT_SYMBOL_GPL(ima_file_check);
  */
 int ima_module_check(struct file *file)
 {
-       int rc;
+       int rc = 0;
 
-       if (!file)
-               rc = INTEGRITY_UNKNOWN;
-       else
+       if (!file) {
+               if (ima_appraise & IMA_APPRAISE_MODULES) {
+#ifndef CONFIG_MODULE_SIG_FORCE
+                       rc = -EACCES;   /* INTEGRITY_UNKNOWN */
+#endif
+               }
+       } else
                rc = process_measurement(file, file->f_dentry->d_name.name,
                                         MAY_EXEC, MODULE_CHECK);
        return (ima_appraise & IMA_APPRAISE_ENFORCE) ? rc : 0;
index af7d182d5a46123ca9308cf2e231f006aa71215d..479fca940bb5552df6591723f09408c3325054f0 100644 (file)
@@ -523,7 +523,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
        }
        if (!result && (entry->action == UNKNOWN))
                result = -EINVAL;
-
+       else if (entry->func == MODULE_CHECK)
+               ima_appraise |= IMA_APPRAISE_MODULES;
        audit_log_format(ab, "res=%d", !result);
        audit_log_end(ab);
        return result;