linux-toradex.git/security/integrity, branch v2.6.32.31

ima: fix add LSM rule bug

2011-01-07T22:43:17+00:00

commit 867c20265459d30a01b021a9c1e81fb4c5832aa9 upstream.

If security_filter_rule_init() doesn't return a rule, then not everything
is as fine as the return code implies.

This bug only occurs when the LSM (eg. SELinux) is disabled at runtime.

Adding an empty LSM rule causes ima_match_rules() to always succeed,
ignoring any remaining rules.

 default IMA TCB policy:
  # PROC_SUPER_MAGIC
  dont_measure fsmagic=0x9fa0
  # SYSFS_MAGIC
  dont_measure fsmagic=0x62656572
  # DEBUGFS_MAGIC
  dont_measure fsmagic=0x64626720
  # TMPFS_MAGIC
  dont_measure fsmagic=0x01021994
  # SECURITYFS_MAGIC
  dont_measure fsmagic=0x73636673

  < LSM specific rule >
  dont_measure obj_type=var_log_t

  measure func=BPRM_CHECK
  measure func=FILE_MMAP mask=MAY_EXEC
  measure func=FILE_CHECK mask=MAY_READ uid=0

Thus without the patch, with the boot parameters 'tcb selinux=0', adding
the above 'dont_measure obj_type=var_log_t' rule to the default IMA TCB
measurement policy, would result in nothing being measured.  The patch
prevents the default TCB policy from being replaced.

Signed-off-by: Mimi Zohar 
Cc: James Morris 
Acked-by: Serge Hallyn 
Cc: David Safford 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

ima: replace GFP_KERNEL with GFP_NOFS

2009-11-18T21:42:01+00:00

While running fsstress tests on the NFSv4 mounted ext3 and ext4
filesystem, the following call trace was generated on the nfs
server machine.

Replace GFP_KERNEL with GFP_NOFS in ima_iint_insert() to avoid a
potential deadlock.

     =================================
    [ INFO: inconsistent lock state ]
    2.6.31-31.el6.x86_64 #1
    ---------------------------------
    inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage.
    kswapd2/75 [HC0[0]:SC0[0]:HE1:SE1] takes:
     (jbd2_handle){+.+.?.}, at: [] jbd2_journal_start+0xfe/0x13f
    {RECLAIM_FS-ON-W} state was registered at:
      [] mark_held_locks+0x65/0x99
      [] lockdep_trace_alloc+0xbd/0xf5
      [] kmem_cache_alloc+0x40/0x185
      [] ima_iint_insert+0x3d/0xf1
      [] ima_inode_alloc+0x25/0x44
      [] inode_init_always+0xec/0x271
      [] alloc_inode+0x51/0xa1
      [] new_inode+0x2e/0x94
      [] ext4_new_inode+0xb8/0xdc9
      [] ext4_create+0xcf/0x175
      [] vfs_create+0x82/0xb8
      [] do_filp_open+0x32c/0x9ee
      [] do_sys_open+0x6c/0x12c
      [] sys_open+0x2e/0x44
      [] system_call_fastpath+0x16/0x1b
      [] 0xffffffffffffffff
    irq event stamp: 90371
    hardirqs last  enabled at (90371): []
    kmem_cache_alloc+0xf0/0x185
    hardirqs last disabled at (90370): []
    kmem_cache_alloc+0x89/0x185
    softirqs last  enabled at (89492): []
    __do_softirq+0x1bf/0x1eb
    softirqs last disabled at (89477): [] call_softirq+0x1c/0x30

    other info that might help us debug this:
    2 locks held by kswapd2/75:
     #0:  (shrinker_rwsem){++++..}, at: [] shrink_slab+0x44/0x177
     #1:  (&type->s_umount_key#25){++++..}, at: []

Reported-by: Muni P. Beerakam 
Reported-by: Amit K. Arora 
Cc: stable@kernel.org
Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris

const: constify remaining file_operations

2009-10-01T23:11:11+00:00

[akpm@linux-foundation.org: fix KVM]
Signed-off-by: Alexey Dobriyan 
Acked-by: Mike Frysinger 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

seq_file: constify seq_operations

2009-09-23T14:39:29+00:00

Make all seq_operations structs const, to help mitigate against
revectoring user-triggerable function pointers.

This is derived from the grsecurity patch, although generated from scratch
because it's simpler than extracting the changes from there.

Signed-off-by: James Morris 
Acked-by: Serge Hallyn 
Acked-by: Casey Schaufler 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

IMA: update ima_counts_put

2009-09-07T01:54:58+00:00

- As ima_counts_put() may be called after the inode has been freed,
verify that the inode is not NULL, before dereferencing it.

- Maintain the IMA file counters in may_open() properly, decrementing
any counter increments on subsequent errors.

Reported-by: Ciprian Docan 
Reported-by: J.R. Okajima 
Signed-off-by: Mimi Zohar 
Acked-by: Eric Paris

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

2009-08-27T03:17:07+00:00

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  IMA: iint put in ima_counts_get and put

IMA: iint put in ima_counts_get and put

2009-08-27T01:01:03+00:00

ima_counts_get() calls ima_iint_find_insert_get() which takes a reference
to the iint in question, but does not put that reference at the end of the
function.  This can lead to a nasty memory leak.  Easy enough to reproduce:

#include 
#include 

int main (void)
{
	int i;
	void *ptr;

	for (i=0; i < 100000; i++) {
		ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
			   MAP_SHARED|MAP_ANONYMOUS, -1, 0);
		if (ptr == MAP_FAILED)
			return 2;
		munmap(ptr, 4096);
	}

	return 0;
}

Signed-off-by: Eric Paris 
Signed-off-by: James Morris

ima: hashing large files bug fix

2009-08-24T04:58:29+00:00

Hashing files larger than INT_MAX causes process to loop.
Dependent on redefining kernel_read() offset type to loff_t.

(http://bugzilla.kernel.org/show_bug.cgi?id=13909)

Cc: stable@kernel.org
Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris

integrity: add ima_counts_put (updated)

2009-06-28T22:59:10+00:00

This patch fixes an imbalance message as reported by J.R. Okajima.
The IMA file counters are incremented in ima_path_check. If the
actual open fails, such as ETXTBSY, decrement the counters to
prevent unnecessary imbalance messages.

Reported-by: J.R. Okajima 
Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris

integrity: ima audit hash_exists fix

2009-06-28T22:57:49+00:00

Audit the file name, not the template name.

Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris