kernel-ark/security/integrity/ima
Eric Paris bade72d607 IMA: fix the ToMToU logic
Current logic looks like this:

        rc = ima_must_measure(NULL, inode, MAY_READ, FILE_CHECK);
        if (rc < 0)
                goto out;

        if (mode & FMODE_WRITE) {
                if (inode->i_readcount)
                        send_tomtou = true;
                goto out;
        }

        if (atomic_read(&inode->i_writecount) > 0)
                send_writers = true;

Lets assume we have a policy which states that all files opened for read
by root must be measured.

Lets assume the file has permissions 777.

Lets assume that root has the given file open for read.

Lets assume that a non-root process opens the file write.

The non-root process will get to ima_counts_get() and will check the
ima_must_measure().  Since it is not supposed to measure it will goto
out.

We should check the i_readcount no matter what since we might be causing
a ToMToU voilation!

This is close to correct, but still not quite perfect.  The situation
could have been that root, which was interested in the mesurement opened
and closed the file and another process which is not interested in the
measurement is the one holding the i_readcount ATM.  This is just overly
strict on ToMToU violations, which is better than not strict enough...

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-10-26 11:37:19 -07:00
..
ima_api.c IMA: move read counter into struct inode 2010-10-26 11:37:18 -07:00
ima_audit.c Merge branch 'master' into next 2010-05-06 10:56:07 +10:00
ima_crypto.c Merge branch 'master' into next 2010-05-06 10:56:07 +10:00
ima_fs.c ima: use generic_file_llseek for securityfs 2010-08-02 15:34:58 +10:00
ima_iint.c IMA: explicit IMA i_flag to remove global lock on inode_delete 2010-10-26 11:37:19 -07:00
ima_init.c Merge branch 'master' into next 2010-05-06 10:56:07 +10:00
ima_main.c IMA: fix the ToMToU logic 2010-10-26 11:37:19 -07:00
ima_policy.c Merge branch 'master' into next 2010-05-06 10:56:07 +10:00
ima_queue.c Merge branch 'master' into next 2010-05-06 10:56:07 +10:00
ima.h IMA: drop refcnt from ima_iint_cache since it isn't needed 2010-10-26 11:37:19 -07:00
Kconfig ima: remove ACPI dependency 2010-05-17 09:21:58 +10:00
Makefile