linux-stable.git/security/integrity, branch linux-2.6.35.y

ima: fix add LSM rule bug

2011-02-06T19:03:51+00:00

commit 867c20265459d30a01b021a9c1e81fb4c5832aa9 upstream.

If security_filter_rule_init() doesn't return a rule, then not everything
is as fine as the return code implies.

This bug only occurs when the LSM (eg. SELinux) is disabled at runtime.

Adding an empty LSM rule causes ima_match_rules() to always succeed,
ignoring any remaining rules.

 default IMA TCB policy:
  # PROC_SUPER_MAGIC
  dont_measure fsmagic=0x9fa0
  # SYSFS_MAGIC
  dont_measure fsmagic=0x62656572
  # DEBUGFS_MAGIC
  dont_measure fsmagic=0x64626720
  # TMPFS_MAGIC
  dont_measure fsmagic=0x01021994
  # SECURITYFS_MAGIC
  dont_measure fsmagic=0x73636673

  < LSM specific rule >
  dont_measure obj_type=var_log_t

  measure func=BPRM_CHECK
  measure func=FILE_MMAP mask=MAY_EXEC
  measure func=FILE_CHECK mask=MAY_READ uid=0

Thus without the patch, with the boot parameters 'tcb selinux=0', adding
the above 'dont_measure obj_type=var_log_t' rule to the default IMA TCB
measurement policy, would result in nothing being measured.  The patch
prevents the default TCB policy from being replaced.

Signed-off-by: Mimi Zohar 
Signed-off-by: Andi Kleen 
Cc: James Morris 
Acked-by: Serge Hallyn 
Cc: David Safford 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

ima: always maintain counters

2010-09-20T20:36:22+00:00

commit e950598d43dce8d97e7d5270808393425d1e5cbd upstream.

commit 8262bb85da allocated the inode integrity struct (iint) before any
inodes were created. Only after IMA was initialized in late_initcall were
the counters updated. This patch updates the counters, whether or not IMA
has been initialized, to resolve 'imbalance' messages.

This patch fixes the bug as reported in bugzilla: 15673.  When the i915
is builtin, the ring_buffer is initialized before IMA, causing the
imbalance message on suspend.

Reported-by: Thomas Meyer 
Signed-off-by: Mimi Zohar 
Tested-by: Thomas Meyer 
Tested-by: David Safford
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

kref: remove kref_set

2010-05-21T16:37:29+00:00

Of the three uses of kref_set in the kernel:

 One really should be kref_put as the code is letting go of a
    reference,
 Two really should be kref_init because the kref is being
    initialised.

This suggests that making kref_set available encourages bad code.
So fix the three uses and remove kref_set completely.

Signed-off-by: NeilBrown 
Acked-by: Mimi Zohar 
Acked-by: Serge Hallyn 
Signed-off-by: Greg Kroah-Hartman

ima: remove ACPI dependency

2010-05-16T23:21:58+00:00

The ACPI dependency moved to the TPM, where it belongs.  Although
IMA per-se does not require access to the bios measurement log,
verifying the IMA boot aggregate does, which requires ACPI.

This patch prereq's 'TPM: ACPI/PNP dependency removal'
http://lkml.org/lkml/2010/5/4/378.

Signed-off-by: Mimi Zohar 
Reported-by: Jean-Christophe Dubois 
Acked-by: Serge Hallyn 
Tested-by: Serge Hallyn 
Signed-off-by: James Morris

Revert "ima: remove ACPI dependency"

2010-05-06T23:20:03+00:00

This reverts commit a674fa46c79ffa37995bd1c8e4daa2b3be5a95ae.

Previous revert was a prereq.

Signed-off-by: James Morris

Merge branch 'master' into next

2010-05-06T00:56:07+00:00

ima: remove ACPI dependency

2010-05-05T00:00:06+00:00

The ACPI dependency moved to the TPM, where it belongs.  Although
IMA per-se does not require access to the bios measurement log,
verifying the IMA boot aggregate does, which requires ACPI.

This patch prereq's 'TPM: ACPI/PNP dependency removal'
http://lkml.org/lkml/2010/5/4/378.

Signed-off-by: Mimi Zohar 
Reported-by: Jean-Christophe Dubois 
Acked-by: Serge Hallyn 
Tested-by: Serge Hallyn 
Signed-off-by: James Morris

IMA: include the word IMA in printk messages

2010-04-22T22:47:53+00:00

As an example IMA emits a warning when it can't find a TPM chip:

"No TPM chip found, activating TPM-bypass!"

This patch prefaces that message with IMA so we know what subsystem is
bypassing the TPM.  Do this for all pr_info and pr_err messages.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: James Morris

IMA: drop the word integrity in the audit message

2010-04-20T23:58:18+00:00

integrity_audit_msg() uses "integrity:" in the audit message.  This
violates the (loosely defined) audit system requirements that everything be
a key=value pair and it doesn't provide additional information.  This can
be obviously gleaned from the message type.  Just drop it.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: James Morris

IMA: use audit_log_untrusted_string rather than %s

2010-04-20T23:58:17+00:00

Convert all of the places IMA calls audit_log_format with %s into
audit_log_untrusted_string().  This is going to cause them all to get
quoted, but it should make audit log injection harder.

Signed-off-by: Eric Paris 
Acked-by: Mimi Zohar 
Signed-off-by: James Morris