diff options
author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2009-02-04 09:07:01 -0500 |
---|---|---|
committer | James Morris <jmorris@namei.org> | 2009-02-06 09:05:32 +1100 |
commit | f4bd857bc8ed997c25ec06b56ef8064aafa6d4f3 (patch) | |
tree | 5326caddadc6144a1e7dee17a6714344ccefbb11 | |
parent | 4af4662fa4a9dc62289c580337ae2506339c4729 (diff) | |
download | linux-f4bd857bc8ed997c25ec06b56ef8064aafa6d4f3.tar.gz linux-f4bd857bc8ed997c25ec06b56ef8064aafa6d4f3.tar.bz2 linux-f4bd857bc8ed997c25ec06b56ef8064aafa6d4f3.zip |
integrity: IMA policy open
Sequentialize access to the policy file
- permit multiple attempts to replace default policy with a valid policy
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
-rw-r--r-- | security/integrity/ima/ima_fs.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index 95ef1caa64b5..573780c76f1f 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -277,16 +277,30 @@ static struct dentry *runtime_measurements_count; static struct dentry *violations; static struct dentry *ima_policy; +static atomic_t policy_opencount = ATOMIC_INIT(1); +/* + * ima_open_policy: sequentialize access to the policy file + */ +int ima_open_policy(struct inode * inode, struct file * filp) +{ + if (atomic_dec_and_test(&policy_opencount)) + return 0; + return -EBUSY; +} + /* * ima_release_policy - start using the new measure policy rules. * * Initially, ima_measure points to the default policy rules, now - * point to the new policy rules, and remove the securityfs policy file. + * point to the new policy rules, and remove the securityfs policy file, + * assuming a valid policy. */ static int ima_release_policy(struct inode *inode, struct file *file) { if (!valid_policy) { ima_delete_rules(); + valid_policy = 1; + atomic_set(&policy_opencount, 1); return 0; } ima_update_policy(); @@ -296,6 +310,7 @@ static int ima_release_policy(struct inode *inode, struct file *file) } static struct file_operations ima_measure_policy_ops = { + .open = ima_open_policy, .write = ima_write_policy, .release = ima_release_policy }; |