[PATCH v4 07/10] IMA: Added a boolean flag to track IMA initialization status
flat view
STALE2528d
From: Lakshmi Ramasubramanian <hidden>
Date: 2019-11-06 19:01:52
Also in:
keyrings, linux-integrity, lkml
Subsystem:
extended verification module (evm), integrity measurement architecture (ima), security subsystem, the rest · Maintainers:
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Revision v4 of 3 in this series.
Revisions (3)
- v3 [diff vs current]
- v4 current
- v5 [diff vs current]
IMA initialization status need to be checked before attempting to determine the action (measure, appraise, etc.) and any related options specified in the IMA policy. This patch defines a flag namely ima_initialized to track IMA initialization status. ima_policy_flag cannot be relied upon for knowing IMA initialization status because ima_policy_flag will be set to 0 when either IMA is not initialized or the IMA policy itself is empty. Signed-off-by: Lakshmi Ramasubramanian <redacted> --- security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_init.c | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index f15199f7ff2a..6a86daa62c5b 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h@@ -52,6 +52,7 @@ extern int ima_policy_flag; extern int ima_hash_algo; extern int ima_appraise; extern struct tpm_chip *ima_tpm_chip; +extern bool ima_initialized; /* IMA event related data */ struct ima_event_data {
diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
index 5d55ade5f3b9..a810af6df587 100644
--- a/security/integrity/ima/ima_init.c
+++ b/security/integrity/ima/ima_init.c@@ -23,6 +23,7 @@ /* name for boot aggregate entry */ static const char boot_aggregate_name[] = "boot_aggregate"; struct tpm_chip *ima_tpm_chip; +bool ima_initialized; /* Add the boot aggregate to the IMA measurement list and extend * the PCR register.
@@ -131,5 +132,11 @@ int __init ima_init(void) ima_init_policy(); - return ima_fs_init(); + rc = ima_fs_init(); + if (rc != 0) + return rc; + + ima_initialized = true; + + return 0; }
--
2.17.1