• Dmitry Kasatkin's avatar
    ima: provide flag to identify new empty files · b151d6b0
    Dmitry Kasatkin authored
    On ima_file_free(), newly created empty files are not labeled with
    an initial security.ima value, because the iversion did not change.
    Commit dff6efc3 "fs: fix iversion handling" introduced a change in
    iversion behavior.  To verify this change use the shell command:
    
      $ (exec >foo)
      $ getfattr -h -e hex -d -m security foo
    
    This patch defines the IMA_NEW_FILE flag.  The flag is initially
    set, when IMA detects that a new file is created, and subsequently
    checked on the ima_file_free() hook to set the initial security.ima
    value.
    Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
    Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
    Cc: <stable@vger.kernel.org>  3.14+
    b151d6b0
ima_main.c 9.42 KB