diff mbox series

ima: Don't modify file descriptor mode on the fly

Message ID 20201126103456.15167-1-roberto.sassu@huawei.com (mailing list archive)
State New
Headers show
Series ima: Don't modify file descriptor mode on the fly | expand

Commit Message

Roberto Sassu Nov. 26, 2020, 10:34 a.m. UTC
Commit a408e4a86b36b ("ima: open a new file instance if no read
permissions") already introduced a second open to measure a file when the
original file descriptor does not allow it. However, it didn't remove the
existing method of changing the mode of the original file descriptor, which
is still necessary if the current process does not have enough privileges
to open a new one.

Changing the mode isn't really an option, as the filesystem might need to
do preliminary steps to make the read possible. Thus, this patch removes
the code and keeps the second open as the only option to measure a file
when it is unreadable with the original file descriptor.

Cc: <stable@vger.kernel.org> # 4.20.x: 0014cc04e8ec0 ima: Set file->f_mode
Cc: <stable@vger.kernel.org> # 4.20.x
Fixes: 2fe5d6def1672 ("ima: integrity appraisal extension")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 security/integrity/ima/ima_crypto.c | 20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

Comments

Christoph Hellwig Nov. 26, 2020, 12:25 p.m. UTC | #1
Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>
Mimi Zohar Nov. 30, 2020, 5:10 p.m. UTC | #2
On Thu, 2020-11-26 at 11:34 +0100, Roberto Sassu wrote:
> Commit a408e4a86b36b ("ima: open a new file instance if no read
> permissions") already introduced a second open to measure a file when the
> original file descriptor does not allow it. However, it didn't remove the
> existing method of changing the mode of the original file descriptor, which
> is still necessary if the current process does not have enough privileges
> to open a new one.
> 
> Changing the mode isn't really an option, as the filesystem might need to
> do preliminary steps to make the read possible. Thus, this patch removes
> the code and keeps the second open as the only option to measure a file
> when it is unreadable with the original file descriptor.
> 
> Cc: <stable@vger.kernel.org> # 4.20.x: 0014cc04e8ec0 ima: Set file->f_mode
> Fixes: 2fe5d6def1672 ("ima: integrity appraisal extension")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>

Thanks, Roberto, Christoph.  The patch is now queued in next-integrity.

Mimi
diff mbox series

Patch

diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 21989fa0c107..f6a7e9643b54 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -537,7 +537,7 @@  int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
 	loff_t i_size;
 	int rc;
 	struct file *f = file;
-	bool new_file_instance = false, modified_mode = false;
+	bool new_file_instance = false;
 
 	/*
 	 * For consistency, fail file's opened with the O_DIRECT flag on
@@ -555,18 +555,10 @@  int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
 				O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL);
 		flags |= O_RDONLY;
 		f = dentry_open(&file->f_path, flags, file->f_cred);
-		if (IS_ERR(f)) {
-			/*
-			 * Cannot open the file again, lets modify f_mode
-			 * of original and continue
-			 */
-			pr_info_ratelimited("Unable to reopen file for reading.\n");
-			f = file;
-			f->f_mode |= FMODE_READ;
-			modified_mode = true;
-		} else {
-			new_file_instance = true;
-		}
+		if (IS_ERR(f))
+			return PTR_ERR(f);
+
+		new_file_instance = true;
 	}
 
 	i_size = i_size_read(file_inode(f));
@@ -581,8 +573,6 @@  int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
 out:
 	if (new_file_instance)
 		fput(f);
-	else if (modified_mode)
-		f->f_mode &= ~FMODE_READ;
 	return rc;
 }