From: Krzysztof Struczynski krzysztof.struczynski@huawei.com
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA
--------------------------------
Add an iint tree to the ima namespace. Each namespace should track operations on its objects separately. Per namespace iint tree is not yet used, it will be done in the following patches.
Signed-off-by: Krzysztof Struczynski krzysztof.struczynski@huawei.com Reviewed-by: Zhang Tianxing zhangtianxing3@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- include/linux/ima.h | 1 + security/integrity/ima/ima_init.c | 1 + security/integrity/ima/ima_ns.c | 17 +++++++++++++++-- 3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/include/linux/ima.h b/include/linux/ima.h index 7f847cf0297c..f5683756f2b5 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -220,6 +220,7 @@ struct ima_namespace { atomic_t inactive; /* set only when ns is added to the cleanup list */ bool frozen; struct ima_policy_data *policy_data; + struct integrity_iint_tree *iint_tree; } __randomize_layout;
extern struct ima_namespace init_ima_ns; diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c index 9f0e9dc3b77f..3b8839b97a98 100644 --- a/security/integrity/ima/ima_init.c +++ b/security/integrity/ima/ima_init.c @@ -34,6 +34,7 @@ struct ima_namespace init_ima_ns = { #endif .frozen = true, .policy_data = &init_policy_data, + .iint_tree = &init_iint_tree, }; EXPORT_SYMBOL(init_ima_ns);
diff --git a/security/integrity/ima/ima_ns.c b/security/integrity/ima/ima_ns.c index 1aeb9cfeb3a2..226a53279f71 100644 --- a/security/integrity/ima/ima_ns.c +++ b/security/integrity/ima/ima_ns.c @@ -56,11 +56,18 @@ static struct ima_namespace *ima_ns_alloc(void) ima_ns->policy_data = kzalloc(sizeof(struct ima_policy_data), GFP_KERNEL); if (!ima_ns->policy_data) - goto out_free; + goto ns_free; + + ima_ns->iint_tree = kzalloc(sizeof(struct integrity_iint_tree), + GFP_KERNEL); + if (!ima_ns->iint_tree) + goto policy_free;
return ima_ns;
-out_free: +policy_free: + kfree(ima_ns->policy_data); +ns_free: kfree(ima_ns); out: return NULL; @@ -120,6 +127,9 @@ static struct ima_namespace *clone_ima_ns(struct user_namespace *user_ns, ns->ucounts = ucounts; ns->frozen = false;
+ rwlock_init(&ns->iint_tree->lock); + ns->iint_tree->root = RB_ROOT; + INIT_LIST_HEAD(&ns->policy_data->ima_default_rules); INIT_LIST_HEAD(&ns->policy_data->ima_policy_rules); INIT_LIST_HEAD(&ns->policy_data->ima_temp_rules); @@ -127,6 +137,7 @@ static struct ima_namespace *clone_ima_ns(struct user_namespace *user_ns, return ns;
fail_free: + kfree(ns->iint_tree); kfree(ns->policy_data); kfree(ns); fail_dec: @@ -173,6 +184,8 @@ static void destroy_ima_ns(struct ima_namespace *ns) dec_ima_namespaces(ns->ucounts); put_user_ns(ns->user_ns); ns_free_inum(&ns->ns); + integrity_iint_tree_free(ns->iint_tree); + kfree(ns->iint_tree); kfree(ns->policy_data); kfree(ns); }