Commit c510d7f8 authored by Mimi Zohar's avatar Mimi Zohar Committed by Luis Henriques

ima: extend "mask" policy matching support

commit 4351c294 upstream.

The current "mask" policy option matches files opened as MAY_READ,
MAY_WRITE, MAY_APPEND or MAY_EXEC.  This patch extends the "mask"
option to match files opened containing one of these modes.  For
example, "mask=^MAY_READ" would match files opened read-write.
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: default avatarDr. Greg Wettstein <gw@idfusion.org>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent aced8cce
...@@ -26,7 +26,8 @@ Description: ...@@ -26,7 +26,8 @@ Description:
option: [[appraise_type=]] [permit_directio] option: [[appraise_type=]] [permit_directio]
base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
[[^]MAY_EXEC]
fsmagic:= hex value fsmagic:= hex value
fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6) fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
uid:= decimal value uid:= decimal value
......
...@@ -27,6 +27,7 @@ ...@@ -27,6 +27,7 @@
#define IMA_UID 0x0008 #define IMA_UID 0x0008
#define IMA_FOWNER 0x0010 #define IMA_FOWNER 0x0010
#define IMA_FSUUID 0x0020 #define IMA_FSUUID 0x0020
#define IMA_INMASK 0x0040
#define IMA_EUID 0x0080 #define IMA_EUID 0x0080
#define UNKNOWN 0 #define UNKNOWN 0
...@@ -174,6 +175,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule, ...@@ -174,6 +175,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
if ((rule->flags & IMA_MASK) && if ((rule->flags & IMA_MASK) &&
(rule->mask != mask && func != POST_SETATTR)) (rule->mask != mask && func != POST_SETATTR))
return false; return false;
if ((rule->flags & IMA_INMASK) &&
(!(rule->mask & mask) && func != POST_SETATTR))
return false;
if ((rule->flags & IMA_FSMAGIC) if ((rule->flags & IMA_FSMAGIC)
&& rule->fsmagic != inode->i_sb->s_magic) && rule->fsmagic != inode->i_sb->s_magic)
return false; return false;
...@@ -427,6 +431,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value) ...@@ -427,6 +431,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
{ {
struct audit_buffer *ab; struct audit_buffer *ab;
char *from;
char *p; char *p;
int result = 0; int result = 0;
...@@ -515,18 +520,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) ...@@ -515,18 +520,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
if (entry->mask) if (entry->mask)
result = -EINVAL; result = -EINVAL;
if ((strcmp(args[0].from, "MAY_EXEC")) == 0) from = args[0].from;
if (*from == '^')
from++;
if ((strcmp(from, "MAY_EXEC")) == 0)
entry->mask = MAY_EXEC; entry->mask = MAY_EXEC;
else if (strcmp(args[0].from, "MAY_WRITE") == 0) else if (strcmp(from, "MAY_WRITE") == 0)
entry->mask = MAY_WRITE; entry->mask = MAY_WRITE;
else if (strcmp(args[0].from, "MAY_READ") == 0) else if (strcmp(from, "MAY_READ") == 0)
entry->mask = MAY_READ; entry->mask = MAY_READ;
else if (strcmp(args[0].from, "MAY_APPEND") == 0) else if (strcmp(from, "MAY_APPEND") == 0)
entry->mask = MAY_APPEND; entry->mask = MAY_APPEND;
else else
result = -EINVAL; result = -EINVAL;
if (!result) if (!result)
entry->flags |= IMA_MASK; entry->flags |= (*args[0].from == '^')
? IMA_INMASK : IMA_MASK;
break; break;
case Opt_fsmagic: case Opt_fsmagic:
ima_log_string(ab, "fsmagic", args[0].from); ima_log_string(ab, "fsmagic", args[0].from);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment