From: Krzysztof Struczynski krzysztof.struczynski@huawei.com
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I49KW1 CVE: NA
--------------------------------
Compare the namespace id during the digest entry lookup. Remove digests from hash table when the namespace is destroyed, but keep the global measurement list entry.
Signed-off-by: Krzysztof Struczynski krzysztof.struczynski@huawei.com Reviewed-by: Zhang Tianxing zhangtianxing3@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_ns.c | 19 +++++++++++++++++++ security/integrity/ima/ima_queue.c | 12 +++++++++--- 3 files changed, 29 insertions(+), 3 deletions(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 6e7a5cf253cc..f757aedea66f 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -187,6 +187,7 @@ int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event, * used to protect h_table and sha_table */ extern spinlock_t ima_queue_lock; +extern spinlock_t ima_htable_lock;
struct ima_h_table { atomic_long_t len; /* number of stored measurements in the list */ diff --git a/security/integrity/ima/ima_ns.c b/security/integrity/ima/ima_ns.c index a6197c708f3a..885f12043cb3 100644 --- a/security/integrity/ima/ima_ns.c +++ b/security/integrity/ima/ima_ns.c @@ -26,6 +26,7 @@ #include <linux/rwsem.h> #include <linux/workqueue.h> #include <linux/mutex.h> +#include <linux/spinlock.h>
#include "ima.h"
@@ -180,10 +181,28 @@ int __init ima_init_namespace(void) return 0; }
+static void imans_remove_hash_entries(struct ima_namespace *ima_ns) +{ + struct list_head *ele; + struct ima_queue_entry *qe; + + /* The namespace is inactive, no lock is needed */ + list_for_each(ele, &ima_ns->ns_measurements) { + qe = list_entry(ele, struct ima_queue_entry, ns_later); + /* Don't free the queue entry, it should stay on the global + * measurement list, remove only the hash table entry */ + spin_lock(&ima_htable_lock); + hlist_del_rcu(&qe->hnext); + spin_unlock(&ima_htable_lock); + atomic_long_dec(&ima_htable.len); + } +} + static void destroy_ima_ns(struct ima_namespace *ns) { bool is_init_ns = (ns == &init_ima_ns);
+ imans_remove_hash_entries(ns); dec_ima_namespaces(ns->ucounts); put_user_ns(ns->user_ns); ns_free_inum(&ns->ns); diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c index 673fd95c8d33..3aeff7b5e036 100644 --- a/security/integrity/ima/ima_queue.c +++ b/security/integrity/ima/ima_queue.c @@ -17,6 +17,7 @@
#include <linux/rculist.h> #include <linux/slab.h> +#include <linux/spinlock.h> #include "ima.h"
#define AUDIT_CAUSE_LEN_MAX 32 @@ -31,6 +32,8 @@ static unsigned long binary_runtime_size; static unsigned long binary_runtime_size = ULONG_MAX; #endif
+DEFINE_SPINLOCK(ima_htable_lock); + /* key: inode (before secure-hashing a file) */ struct ima_h_table ima_htable = { .len = ATOMIC_LONG_INIT(0), @@ -46,7 +49,7 @@ static DEFINE_MUTEX(ima_extend_list_mutex);
/* lookup up the digest value in the hash table, and return the entry */ static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value, - int pcr) + int pcr, int ns_id) { struct ima_queue_entry *qe, *ret = NULL; unsigned int key; @@ -57,7 +60,8 @@ static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value, hlist_for_each_entry_rcu(qe, &ima_htable.queue[key], hnext) { rc = memcmp(qe->entry->digests[ima_hash_algo_idx].digest, digest_value, hash_digest_size[ima_hash_algo]); - if ((rc == 0) && (qe->entry->pcr == pcr)) { + if ((rc == 0) && (qe->entry->pcr == pcr) && + (qe->entry->ns_id == ns_id)) { ret = qe; break; } @@ -111,7 +115,9 @@ static int ima_add_digest_entry(struct ima_template_entry *entry, atomic_long_inc(&ima_htable.len); if (update_htable) { key = ima_hash_key(entry->digests[ima_hash_algo_idx].digest); + spin_lock(&ima_htable_lock); hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]); + spin_unlock(&ima_htable_lock); }
if (binary_runtime_size != ULONG_MAX) { @@ -172,7 +178,7 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
mutex_lock(&ima_extend_list_mutex); if (!violation) { - if (ima_lookup_digest_entry(digest, entry->pcr)) { + if (ima_lookup_digest_entry(digest, entry->pcr, entry->ns_id)) { audit_cause = "hash_exists"; result = -EEXIST; goto out;