Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorri...

Pull security subsystem integrity updates from James Morris:
 "There is a mixture of bug fixes, code cleanup, preparatory code for
  new functionality and new functionality.

  Commit 26ddabfe96bb ("evm: enable EVM when X509 certificate is
  loaded") enabled EVM without loading a symmetric key, but was limited
  to defining the x509 certificate pathname at build. Included in this
  set of patches is the ability of enabling EVM, without loading the EVM
  symmetric key, from userspace. New is the ability to prevent the
  loading of an EVM symmetric key."

* 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  ima: Remove redundant conditional operator
  ima: Fix bool initialization/comparison
  ima: check signature enforcement against cmdline param instead of CONFIG
  module: export module signature enforcement status
  ima: fix hash algorithm initialization
  EVM: Only complain about a missing HMAC key once
  EVM: Allow userspace to signal an RSA key has been loaded
  EVM: Include security.apparmor in EVM measurements
  ima: call ima_file_free() prior to calling fasync
  integrity: use kernel_read_file_from_path() to read x509 certs
  ima: always measure and audit files in policy
  ima: don't remove the securityfs policy file
  vfs: fix mounting a filesystem with i_version

diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
index ca622c9aa24c87aa0637782000d9e11a19e17086..9578247e17929bf4fcd6bd50b185f955031dc96d 100644 (file)
--- a/Documentation/ABI/testing/evm
+++ b/Documentation/ABI/testing/evm
@@ -7,17 +7,37 @@ Description:
                HMAC-sha1 value across the extended attributes, storing the
                value as the extended attribute 'security.evm'.
 
-               EVM depends on the Kernel Key Retention System to provide it
-               with a trusted/encrypted key for the HMAC-sha1 operation.
-               The key is loaded onto the root's keyring using keyctl.  Until
-               EVM receives notification that the key has been successfully
-               loaded onto the keyring (echo 1 > <securityfs>/evm), EVM
-               can not create or validate the 'security.evm' xattr, but
-               returns INTEGRITY_UNKNOWN.  Loading the key and signaling EVM
-               should be done as early as possible.  Normally this is done
-               in the initramfs, which has already been measured as part
-               of the trusted boot.  For more information on creating and
-               loading existing trusted/encrypted keys, refer to:
-               Documentation/security/keys/trusted-encrypted.rst.  (A sample
-               dracut patch, which loads the trusted/encrypted key and enables
-               EVM, is available from http://linux-ima.sourceforge.net/#EVM.)
+               EVM supports two classes of security.evm. The first is
+               an HMAC-sha1 generated locally with a
+               trusted/encrypted key stored in the Kernel Key
+               Retention System. The second is a digital signature
+               generated either locally or remotely using an
+               asymmetric key. These keys are loaded onto root's
+               keyring using keyctl, and EVM is then enabled by
+               echoing a value to <securityfs>/evm:
+
+               1: enable HMAC validation and creation
+               2: enable digital signature validation
+               3: enable HMAC and digital signature validation and HMAC
+                  creation
+
+               Further writes will be blocked if HMAC support is enabled or
+               if bit 32 is set:
+
+               echo 0x80000002 ><securityfs>/evm
+
+               will enable digital signature validation and block
+               further writes to <securityfs>/evm.
+
+               Until this is done, EVM can not create or validate the
+               'security.evm' xattr, but returns INTEGRITY_UNKNOWN.
+               Loading keys and signaling EVM should be done as early
+               as possible.  Normally this is done in the initramfs,
+               which has already been measured as part of the trusted
+               boot.  For more information on creating and loading
+               existing trusted/encrypted keys, refer to:
+
+               Documentation/security/keys/trusted-encrypted.rst. Both dracut
+               (via 97masterkey and 98integrity) and systemd (via
+               core/ima-setup) have support for loading keys at boot
+               time.

diff --git a/fs/file_table.c b/fs/file_table.c
index 61517f57f8ef744e9915c33659cfba96c0a1f767..49e1f2f1a4cbefe0906224433d03ee5c36e7a9c1 100644 (file)
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -201,11 +201,11 @@ static void __fput(struct file *file)
        eventpoll_release(file);
        locks_remove_file(file);
 
+       ima_file_free(file);
        if (unlikely(file->f_flags & FASYNC)) {
                if (file->f_op->fasync)
                        file->f_op->fasync(-1, file, 0);
        }
-       ima_file_free(file);
        if (file->f_op->release)
                file->f_op->release(inode, file);
        security_file_free(file);

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 885266aae2d7d57615db4125884abb813066590f..e1f75a3b4af5be684d694a3c10439ed12ff69c26 100644 (file)
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2793,6 +2793,7 @@ extern int do_pipe_flags(int *, int);
        id(KEXEC_IMAGE, kexec-image)            \
        id(KEXEC_INITRAMFS, kexec-initramfs)    \
        id(POLICY, security-policy)             \
+       id(X509_CERTIFICATE, x509-certificate)  \
        id(MAX_ID, )
 
 #define __fid_enumify(ENUM, dummy) READING_ ## ENUM,

diff --git a/include/linux/module.h b/include/linux/module.h
index fe5aa3736707294a5a4b6f20ea83be79d91dc9c0..c69b49abe8775417587387a8d7def5497e476fc8 100644 (file)
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -639,6 +639,8 @@ static inline bool is_livepatch_module(struct module *mod)
 }
 #endif /* CONFIG_LIVEPATCH */
 
+bool is_module_sig_enforced(void);
+
 #else /* !CONFIG_MODULES... */
 
 static inline struct module *__module_address(unsigned long addr)
@@ -753,6 +755,11 @@ static inline bool module_requested_async_probing(struct module *module)
        return false;
 }
 
+static inline bool is_module_sig_enforced(void)
+{
+       return false;
+}
+
 #endif /* CONFIG_MODULES */
 
 #ifdef CONFIG_SYSFS

diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
index a92be0f492a9bef04caf3bcc4108bb134c015474..c1395b5bd432a0e4fe9275b8d4eece00a52999c2 100644 (file)
--- a/include/uapi/linux/xattr.h
+++ b/include/uapi/linux/xattr.h
@@ -66,6 +66,9 @@
 #define XATTR_NAME_SMACKTRANSMUTE XATTR_SECURITY_PREFIX XATTR_SMACK_TRANSMUTE
 #define XATTR_NAME_SMACKMMAP XATTR_SECURITY_PREFIX XATTR_SMACK_MMAP
 
+#define XATTR_APPARMOR_SUFFIX "apparmor"
+#define XATTR_NAME_APPARMOR XATTR_SECURITY_PREFIX XATTR_APPARMOR_SUFFIX
+
 #define XATTR_CAPS_SUFFIX "capability"
 #define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX
 

diff --git a/kernel/module.c b/kernel/module.c
index 0122747ba150c43da8564a41730524867d0d26b4..32c2cdaccd93966cd0fda561511fe90674e45022 100644 (file)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -278,6 +278,16 @@ static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
 module_param(sig_enforce, bool_enable_only, 0644);
 #endif /* !CONFIG_MODULE_SIG_FORCE */
 
+/*
+ * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
+ * on that instead of directly to CONFIG_MODULE_SIG_FORCE config.
+ */
+bool is_module_sig_enforced(void)
+{
+       return sig_enforce;
+}
+EXPORT_SYMBOL(is_module_sig_enforced);
+
 /* Block module loading/unloading? */
 int modules_disabled = 0;
 core_param(nomodule, modules_disabled, bint, 0);

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 06554c448dce886d3bd7a01a745a78ab5fd734e8..6f9e4ce568cd87fd8b529a2e8c08c615c6f790a5 100644 (file)
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -112,21 +112,25 @@ int __init integrity_init_keyring(const unsigned int id)
 int __init integrity_load_x509(const unsigned int id, const char *path)
 {
        key_ref_t key;
-       char *data;
+       void *data;
+       loff_t size;
        int rc;
 
        if (!keyring[id])
                return -EINVAL;
 
-       rc = integrity_read_file(path, &data);
-       if (rc < 0)
+       rc = kernel_read_file_from_path(path, &data, &size, 0,
+                                       READING_X509_CERTIFICATE);
+       if (rc < 0) {
+               pr_err("Unable to open file: %s (%d)", path, rc);
                return rc;
+       }
 
        key = key_create_or_update(make_key_ref(keyring[id], 1),
                                   "asymmetric",
                                   NULL,
                                   data,
-                                  rc,
+                                  size,
                                   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
                                    KEY_USR_VIEW | KEY_USR_READ),
                                   KEY_ALLOC_NOT_IN_QUOTA);
@@ -139,6 +143,6 @@ int __init integrity_load_x509(const unsigned int id, const char *path)
                          key_ref_to_ptr(key)->description, path);
                key_ref_put(key);
        }
-       kfree(data);
+       vfree(data);
        return 0;
 }

diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h
index f5f12727771a0aba01442d7c242f95464658abce..241aca315b0c351d6897e4e6d9ee2261cbbb3bcb 100644 (file)
--- a/security/integrity/evm/evm.h
+++ b/security/integrity/evm/evm.h
@@ -23,6 +23,9 @@
 
 #define EVM_INIT_HMAC  0x0001
 #define EVM_INIT_X509  0x0002
+#define EVM_SETUP       0x80000000 /* userland has signaled key load */
+
+#define EVM_INIT_MASK (EVM_INIT_HMAC | EVM_INIT_X509 | EVM_SETUP)
 
 extern int evm_initialized;
 extern char *evm_hmac;

diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 1d32cd20009a3bd35cf77bc11027354c00eb8812..bcd64baf87881b4194cf9852c0167900d96ddddc 100644 (file)
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -80,7 +80,7 @@ static struct shash_desc *init_desc(char type)
 
        if (type == EVM_XATTR_HMAC) {
                if (!(evm_initialized & EVM_INIT_HMAC)) {
-                       pr_err("HMAC key is not set\n");
+                       pr_err_once("HMAC key is not set\n");
                        return ERR_PTR(-ENOKEY);
                }
                tfm = &hmac_tfm;

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 063d38aef64e71a00763997752f93983fa9702d6..9826c02e2db8f789eea2dc9d209db7e605839de0 100644 (file)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -49,6 +49,9 @@ char *evm_config_xattrnames[] = {
        XATTR_NAME_SMACKMMAP,
 #endif
 #endif
+#ifdef CONFIG_SECURITY_APPARMOR
+       XATTR_NAME_APPARMOR,
+#endif
 #ifdef CONFIG_IMA_APPRAISE
        XATTR_NAME_IMA,
 #endif

diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index c8dccd54d5017da0de7a4f03708b5fabb49fe85e..319cf16d6603050f4ac6fef1f3e2aa31c7a941ce 100644 (file)
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -40,7 +40,7 @@ static ssize_t evm_read_key(struct file *filp, char __user *buf,
        if (*ppos != 0)
                return 0;
 
-       sprintf(temp, "%d", evm_initialized);
+       sprintf(temp, "%d", (evm_initialized & ~EVM_SETUP));
        rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
 
        return rc;
@@ -61,24 +61,29 @@ static ssize_t evm_read_key(struct file *filp, char __user *buf,
 static ssize_t evm_write_key(struct file *file, const char __user *buf,
                             size_t count, loff_t *ppos)
 {
-       char temp[80];
-       int i;
+       int i, ret;
 
-       if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_INIT_HMAC))
+       if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_SETUP))
                return -EPERM;
 
-       if (count >= sizeof(temp) || count == 0)
-               return -EINVAL;
-
-       if (copy_from_user(temp, buf, count) != 0)
-               return -EFAULT;
+       ret = kstrtoint_from_user(buf, count, 0, &i);
 
-       temp[count] = '\0';
+       if (ret)
+               return ret;
 
-       if ((sscanf(temp, "%d", &i) != 1) || (i != 1))
+       /* Reject invalid values */
+       if (!i || (i & ~EVM_INIT_MASK) != 0)
                return -EINVAL;
 
-       evm_init_key();
+       if (i & EVM_INIT_HMAC) {
+               ret = evm_init_key();
+               if (ret != 0)
+                       return ret;
+               /* Forbid further writes after the symmetric key is loaded */
+               i |= EVM_SETUP;
+       }
+
+       evm_initialized |= i;
 
        return count;
 }

diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index 6fc888ca468e4f9cdd8938e535ebd4e2dbbe2044..c84e05866052a068e99b4f30236764e531c38896 100644 (file)
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -199,55 +199,6 @@ int integrity_kernel_read(struct file *file, loff_t offset,
        return ret;
 }
 
-/*
- * integrity_read_file - read entire file content into the buffer
- *
- * This is function opens a file, allocates the buffer of required
- * size, read entire file content to the buffer and closes the file
- *
- * It is used only by init code.
- *
- */
-int __init integrity_read_file(const char *path, char **data)
-{
-       struct file *file;
-       loff_t size;
-       char *buf;
-       int rc = -EINVAL;
-
-       if (!path || !*path)
-               return -EINVAL;
-
-       file = filp_open(path, O_RDONLY, 0);
-       if (IS_ERR(file)) {
-               rc = PTR_ERR(file);
-               pr_err("Unable to open file: %s (%d)", path, rc);
-               return rc;
-       }
-
-       size = i_size_read(file_inode(file));
-       if (size <= 0)
-               goto out;
-
-       buf = kmalloc(size, GFP_KERNEL);
-       if (!buf) {
-               rc = -ENOMEM;
-               goto out;
-       }
-
-       rc = integrity_kernel_read(file, 0, buf, size);
-       if (rc == size) {
-               *data = buf;
-       } else {
-               kfree(buf);
-               if (rc >= 0)
-                       rc = -EIO;
-       }
-out:
-       fput(file);
-       return rc;
-}
-
 /*
  * integrity_load_keys - load integrity keys hook
  *

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index c2edba8de35e4932a13e73ec55907f9987037dce..c7e8db0ea4c0e4bad275892f8c7b83c012ba8214 100644 (file)
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -199,42 +199,59 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
        struct inode *inode = file_inode(file);
        const char *filename = file->f_path.dentry->d_name.name;
        int result = 0;
+       int length;
+       void *tmpbuf;
+       u64 i_version;
        struct {
                struct ima_digest_data hdr;
                char digest[IMA_MAX_DIGEST_SIZE];
        } hash;
 
-       if (!(iint->flags & IMA_COLLECTED)) {
-               u64 i_version = file_inode(file)->i_version;
+       if (iint->flags & IMA_COLLECTED)
+               goto out;
 
-               if (file->f_flags & O_DIRECT) {
-                       audit_cause = "failed(directio)";
-                       result = -EACCES;
-                       goto out;
-               }
+       /*
+        * Dectecting file change is based on i_version. On filesystems
+        * which do not support i_version, support is limited to an initial
+        * measurement/appraisal/audit.
+        */
+       i_version = file_inode(file)->i_version;
+       hash.hdr.algo = algo;
 
-               hash.hdr.algo = algo;
-
-               result = (!buf) ?  ima_calc_file_hash(file, &hash.hdr) :
-                       ima_calc_buffer_hash(buf, size, &hash.hdr);
-               if (!result) {
-                       int length = sizeof(hash.hdr) + hash.hdr.length;
-                       void *tmpbuf = krealloc(iint->ima_hash, length,
-                                               GFP_NOFS);
-                       if (tmpbuf) {
-                               iint->ima_hash = tmpbuf;
-                               memcpy(iint->ima_hash, &hash, length);
-                               iint->version = i_version;
-                               iint->flags |= IMA_COLLECTED;
-                       } else
-                               result = -ENOMEM;
-               }
+       /* Initialize hash digest to 0's in case of failure */
+       memset(&hash.digest, 0, sizeof(hash.digest));
+
+       if (buf)
+               result = ima_calc_buffer_hash(buf, size, &hash.hdr);
+       else
+               result = ima_calc_file_hash(file, &hash.hdr);
+
+       if (result && result != -EBADF && result != -EINVAL)
+               goto out;
+
+       length = sizeof(hash.hdr) + hash.hdr.length;
+       tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS);
+       if (!tmpbuf) {
+               result = -ENOMEM;
+               goto out;
        }
+
+       iint->ima_hash = tmpbuf;
+       memcpy(iint->ima_hash, &hash, length);
+       iint->version = i_version;
+
+       /* Possibly temporary failure due to type of read (eg. O_DIRECT) */
+       if (!result)
+               iint->flags |= IMA_COLLECTED;
 out:
-       if (result)
+       if (result) {
+               if (file->f_flags & O_DIRECT)
+                       audit_cause = "failed(directio)";
+
                integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
                                    filename, "collect_data", audit_cause,
                                    result, 0);
+       }
        return result;
 }
 
@@ -278,7 +295,7 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
        }
 
        result = ima_store_template(entry, violation, inode, filename, pcr);
-       if (!result || result == -EEXIST) {
+       if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {
                iint->flags |= IMA_MEASURED;
                iint->measured_pcrs |= (0x1 << pcr);
        }

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 809ba70fbbbfb3137339895db07301b39662d5a1..ec7dfa02c0519483818c40cce40ba0993fbd4712 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -40,7 +40,7 @@ __setup("ima_appraise=", default_appraise_setup);
  */
 bool is_ima_appraise_enabled(void)
 {
-       return (ima_appraise & IMA_APPRAISE_ENFORCE) ? 1 : 0;
+       return ima_appraise & IMA_APPRAISE_ENFORCE;
 }
 
 /*
@@ -405,7 +405,7 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
                if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
                        return -EINVAL;
                ima_reset_appraise_flags(d_backing_inode(dentry),
-                        (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
+                       xvalue->type == EVM_IMA_XATTR_DIGSIG);
                result = 0;
        }
        return result;

diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 802d5d20f36fe46ecb787163f4dafd532741c78b..a856d8c9c9f3af6601d211e5de36dde36b65b3b3 100644 (file)
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -441,6 +441,16 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
        loff_t i_size;
        int rc;
 
+       /*
+        * For consistency, fail file's opened with the O_DIRECT flag on
+        * filesystems mounted with/without DAX option.
+        */
+       if (file->f_flags & O_DIRECT) {
+               hash->length = hash_digest_size[ima_hash_algo];
+               hash->algo = ima_hash_algo;
+               return -EINVAL;
+       }
+
        i_size = i_size_read(file_inode(file));
 
        if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index ad491c51e8339c8f497b218c7b007b7c12a98ce4..fa540c0469dac649ca7583834caacf7cc955b594 100644 (file)
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -32,7 +32,7 @@ bool ima_canonical_fmt;
 static int __init default_canonical_fmt_setup(char *str)
 {
 #ifdef __BIG_ENDIAN
-       ima_canonical_fmt = 1;
+       ima_canonical_fmt = true;
 #endif
        return 1;
 }
@@ -429,10 +429,10 @@ static int ima_release_policy(struct inode *inode, struct file *file)
        }
 
        ima_update_policy();
-#ifndef        CONFIG_IMA_WRITE_POLICY
+#if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY)
        securityfs_remove(ima_policy);
        ima_policy = NULL;
-#else
+#elif defined(CONFIG_IMA_WRITE_POLICY)
        clear_bit(IMA_FS_BUSY, &ima_fs_flags);
 #endif
        return 0;

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 2aebb7984437f10afe6e9aaa964a42be88f9295a..770654694efcb4d728dd6a0f23b2f8f21d6e90be 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -51,6 +51,8 @@ static int __init hash_setup(char *str)
                        ima_hash_algo = HASH_ALGO_SHA1;
                else if (strncmp(str, "md5", 3) == 0)
                        ima_hash_algo = HASH_ALGO_MD5;
+               else
+                       return 1;
                goto out;
        }
 
@@ -60,6 +62,8 @@ static int __init hash_setup(char *str)
                        break;
                }
        }
+       if (i == HASH_ALGO__LAST)
+               return 1;
 out:
        hash_setup_done = 1;
        return 1;
@@ -235,11 +239,8 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
        hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
 
        rc = ima_collect_measurement(iint, file, buf, size, hash_algo);
-       if (rc != 0) {
-               if (file->f_flags & O_DIRECT)
-                       rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES;
+       if (rc != 0 && rc != -EBADF && rc != -EINVAL)
                goto out_digsig;
-       }
 
        if (!pathbuf)   /* ima_rdwr_violation possibly pre-fetched */
                pathname = ima_d_path(&file->f_path, &pathbuf, filename);
@@ -247,12 +248,14 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
        if (action & IMA_MEASURE)
                ima_store_measurement(iint, file, pathname,
                                      xattr_value, xattr_len, pcr);
-       if (action & IMA_APPRAISE_SUBMASK)
+       if (rc == 0 && (action & IMA_APPRAISE_SUBMASK))
                rc = ima_appraise_measurement(func, iint, file, pathname,
                                              xattr_value, xattr_len, opened);
        if (action & IMA_AUDIT)
                ima_audit_measurement(iint, pathname);
 
+       if ((file->f_flags & O_DIRECT) && (iint->flags & IMA_PERMIT_DIRECTIO))
+               rc = 0;
 out_digsig:
        if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG) &&
             !(iint->flags & IMA_NEW_FILE))
@@ -359,12 +362,12 @@ void ima_post_path_mknod(struct dentry *dentry)
  */
 int ima_read_file(struct file *file, enum kernel_read_file_id read_id)
 {
+       bool sig_enforce = is_module_sig_enforced();
+
        if (!file && read_id == READING_MODULE) {
-#ifndef CONFIG_MODULE_SIG_FORCE
-               if ((ima_appraise & IMA_APPRAISE_MODULES) &&
+               if (!sig_enforce && (ima_appraise & IMA_APPRAISE_MODULES) &&
                    (ima_appraise & IMA_APPRAISE_ENFORCE))
                        return -EACCES; /* INTEGRITY_UNKNOWN */
-#endif
                return 0;       /* We rely on module signature checking */
        }
        return 0;
@@ -406,6 +409,10 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
        if (!file && read_id == READING_MODULE) /* MODULE_SIG_FORCE enabled */
                return 0;
 
+       /* permit signed certs */
+       if (!file && read_id == READING_X509_CERTIFICATE)
+               return 0;
+
        if (!file || !buf || size == 0) { /* should never happen */
                if (ima_appraise & IMA_APPRAISE_ENFORCE)
                        return -EACCES;

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 95209a5f8595aff48c253d509eb4c93c6f674ce7..ee4613fa58403dd8842fa60399845293e24253df 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -196,9 +196,9 @@ static int __init policy_setup(char *str)
                if ((strcmp(p, "tcb") == 0) && !ima_policy)
                        ima_policy = DEFAULT_TCB;
                else if (strcmp(p, "appraise_tcb") == 0)
-                       ima_use_appraise_tcb = 1;
+                       ima_use_appraise_tcb = true;
                else if (strcmp(p, "secure_boot") == 0)
-                       ima_use_secure_boot = 1;
+                       ima_use_secure_boot = true;
        }
 
        return 1;
@@ -207,7 +207,7 @@ __setup("ima_policy=", policy_setup);
 
 static int __init default_appraise_policy_setup(char *str)
 {
-       ima_use_appraise_tcb = 1;
+       ima_use_appraise_tcb = true;
        return 1;
 }
 __setup("ima_appraise_tcb", default_appraise_policy_setup);

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index a53e7e4ab06c74d4ca4c85836f1e0d2e809433a6..e1bf040fb110959bcc53a2be840ffd32a31d8c3d 100644 (file)
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -120,8 +120,6 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
 int integrity_kernel_read(struct file *file, loff_t offset,
                          void *addr, unsigned long count);
 
-int __init integrity_read_file(const char *path, char **data);
-
 #define INTEGRITY_KEYRING_EVM          0
 #define INTEGRITY_KEYRING_IMA          1
 #define INTEGRITY_KEYRING_MODULE       2