1. 07 Feb, 2010 2 commits
  2. 16 Dec, 2009 1 commit
    • Al Viro's avatar
      Untangling ima mess, part 3: kill dead code in ima · 1429b3ec
      Al Viro authored
      
      
      Kill the 'update' argument of ima_path_check(), kill
      dead code in ima.
      
      Current rules: ima counters are bumped at the same time
      when the file switches from put_filp() fodder to fput()
      one.  Which happens exactly in two places - alloc_file()
      and __dentry_open().  Nothing else needs to do that at
      all.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      1429b3ec
  3. 28 Jun, 2009 1 commit
  4. 21 May, 2009 1 commit
  5. 10 Feb, 2009 1 commit
    • Mimi Zohar's avatar
      integrity: shmem zero fix · ed850a52
      Mimi Zohar authored
      Based on comments from Mike Frysinger and Randy Dunlap:
      (http://lkml.org/lkml/2009/2/9/262
      
      )
      - moved ima.h include before CONFIG_SHMEM test to fix compiler error
        on Blackfin:
      mm/shmem.c: In function 'shmem_zero_setup':
      mm/shmem.c:2670: error: implicit declaration of function 'ima_shm_check'
      
      - added 'struct linux_binprm' in ima.h to fix compiler warning on Blackfin:
      In file included from mm/shmem.c:32:
      include/linux/ima.h:25: warning: 'struct linux_binprm' declared inside
      parameter list
      include/linux/ima.h:25: warning: its scope is only this definition or
      declaration, which is probably not what you want
      
      - moved fs.h include within _LINUX_IMA_H definition
      Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
      Signed-off-by: default avatarMike Frysinger <vapier@gentoo.org>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      ed850a52
  6. 05 Feb, 2009 3 commits
    • Mimi Zohar's avatar
      Integrity: IMA file free imbalance · 1df9f0a7
      Mimi Zohar authored
      
      
      The number of calls to ima_path_check()/ima_file_free()
      should be balanced.  An extra call to fput(), indicates
      the file could have been accessed without first being
      measured.
      
      Although f_count is incremented/decremented in places other
      than fget/fput, like fget_light/fput_light and get_file, the
      current task must already hold a file refcnt.  The call to
      __fput() is delayed until the refcnt becomes 0, resulting
      in ima_file_free() flagging any changes.
      
      - add hook to increment opencount for IPC shared memory(SYSV),
        shmat files, and /dev/zero
      - moved NULL iint test in opencount_get()
      Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
      Acked-by: default avatarSerge Hallyn <serue@us.ibm.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      1df9f0a7
    • Mimi Zohar's avatar
      integrity: IMA as an integrity service provider · 3323eec9
      Mimi Zohar authored
      
      
      IMA provides hardware (TPM) based measurement and attestation for
      file measurements. As the Trusted Computing (TPM) model requires,
      IMA measures all files before they are accessed in any way (on the
      integrity_bprm_check, integrity_path_check and integrity_file_mmap
      hooks), and commits the measurements to the TPM. Once added to the
      TPM, measurements can not be removed.
      
      In addition, IMA maintains a list of these file measurements, which
      can be used to validate the aggregate value stored in the TPM.  The
      TPM can sign these measurements, and thus the system can prove, to
      itself and to a third party, the system's integrity in a way that
      cannot be circumvented by malicious or compromised software.
      
      - alloc ima_template_entry before calling ima_store_template()
      - log ima_add_boot_aggregate() failure
      - removed unused IMA_TEMPLATE_NAME_LEN
      - replaced hard coded string length with #define name
      Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      3323eec9
    • Mimi Zohar's avatar
      integrity: IMA hooks · 6146f0d5
      Mimi Zohar authored
      
      
      This patch replaces the generic integrity hooks, for which IMA registered
      itself, with IMA integrity hooks in the appropriate places directly
      in the fs directory.
      Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
      Acked-by: default avatarSerge Hallyn <serue@us.ibm.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      6146f0d5