linux-stable.git/security/integrity/ima/ima.h, branch linux-3.2.y

integrity: sparse fix: move iint_initialized to integrity.h

2011-09-09T23:56:24+00:00

Sparse fix: move iint_initialized to integrity.h

Signed-off-by: James Morris

integrity: move ima inode integrity data management

2011-07-18T16:29:38+00:00

Move the inode integrity data(iint) management up to the integrity directory
in order to share the iint among the different integrity models.

Changelog:
- don't define MAX_DIGEST_SIZE
- rename several globally visible 'ima_' prefixed functions, structs,
  locks, etc to 'integrity_'
- replace '20' with SHA1_DIGEST_SIZE
- reflect location change in appropriate Kconfig and Makefiles
- remove unnecessary initialization of iint_initialized to 0
- rebased on current ima_iint.c
- define integrity_iint_store/lock as static

There should be no other functional changes.

Signed-off-by: Mimi Zohar 
Acked-by: Serge Hallyn

ima: remove unnecessary call to ima_must_measure

2011-02-23T21:38:52+00:00

The original ima_must_measure() function based its results on cached
iint information, which required an iint be allocated for all files.
Currently, an iint is allocated only for files in policy.  As a result,
for those files in policy, ima_must_measure() is now called twice: once
to determine if the inode is in the measurement policy and, the second
time, to determine if it needs to be measured/re-measured.

The second call to ima_must_measure() unnecessarily checks to see if
the file is in policy. As we already know the file is in policy, this
patch removes the second unnecessary call to ima_must_measure(), removes
the vestige iint parameter, and just checks the iint directly to determine
if the inode has been measured or needs to be measured/re-measured.

Signed-off-by: Mimi Zohar 
Acked-by: Eric Paris

IMA: drop refcnt from ima_iint_cache since it isn't needed

2010-10-26T18:37:19+00:00

Since finding a struct ima_iint_cache requires a valid struct inode, and
the struct ima_iint_cache is supposed to have the same lifetime as a
struct inode (technically they die together but don't need to be created
at the same time) we don't have to worry about the ima_iint_cache
outliving or dieing before the inode.  So the refcnt isn't useful.  Just
get rid of it and free the structure when the inode is freed.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Linus Torvalds

IMA: move read counter into struct inode

2010-10-26T18:37:18+00:00

IMA currently allocated an inode integrity structure for every inode in
core.  This stucture is about 120 bytes long.  Most files however
(especially on a system which doesn't make use of IMA) will never need
any of this space.  The problem is that if IMA is enabled we need to
know information about the number of readers and the number of writers
for every inode on the box.  At the moment we collect that information
in the per inode iint structure and waste the rest of the space.  This
patch moves those counters into the struct inode so we can eventually
stop allocating an IMA integrity structure except when absolutely
needed.

This patch does the minimum needed to move the location of the data.
Further cleanups, especially the location of counter updates, may still
be possible.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Linus Torvalds

IMA: use i_writecount rather than a private counter

2010-10-26T18:37:18+00:00

IMA tracks the number of struct files which are holding a given inode
readonly and the number which are holding the inode write or r/w.  It
needs this information so when a new reader or writer comes in it can
tell if this new file will be able to invalidate results it already made
about existing files.

aka if a task is holding a struct file open RO, IMA measured the file
and recorded those measurements and then a task opens the file RW IMA
needs to note in the logs that the old measurement may not be correct.
It's called a "Time of Measure Time of Use" (ToMToU) issue.  The same is
true is a RO file is opened to an inode which has an open writer.  We
cannot, with any validity, measure the file in question since it could
be changing.

This patch attempts to use the i_writecount field to track writers.  The
i_writecount field actually embeds more information in it's value than
IMA needs but it should work for our purposes and allow us to shrink the
struct inode even more.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Linus Torvalds

IMA: use inode->i_lock to protect read and write counters

2010-10-26T18:37:18+00:00

Currently IMA used the iint->mutex to protect the i_readcount and
i_writecount.  This patch uses the inode->i_lock since we are going to
start using in inode objects and that is the most appropriate lock.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Linus Torvalds

IMA: convert internal flags from long to char

2010-10-26T18:37:18+00:00

The IMA flags is an unsigned long but there is only 1 flag defined.
Lets save a little space and make it a char.  This packs nicely next to
the array of u8's.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Linus Torvalds

IMA: use unsigned int instead of long for counters

2010-10-26T18:37:18+00:00

Currently IMA uses 2 longs in struct inode.  To save space (and as it
seems impossible to overflow 32 bits) we switch these to unsigned int.
The switch to unsigned does require slightly different checks for
underflow, but it isn't complex.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Linus Torvalds

IMA: drop the inode opencount since it isn't needed for operation

2010-10-26T18:37:17+00:00

The opencount was used to help debugging to make sure that everything
which created a struct file also correctly made the IMA calls.  Since we
moved all of that into the VFS this isn't as necessary.  We should be
able to get the same amount of debugging out of just the reader and
write count.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: Linus Torvalds