Files
Mimi Zohar 47873220e7 ima: audit log files opened with O_DIRECT flag
commit f9b2a735bd upstream.

Files are measured or appraised based on the IMA policy.  When a
file, in policy, is opened with the O_DIRECT flag, a deadlock
occurs.

The first attempt at resolving this lockdep temporarily removed the
O_DIRECT flag and restored it, after calculating the hash.  The
second attempt introduced the O_DIRECT_HAVELOCK flag. Based on this
flag, do_blockdev_direct_IO() would skip taking the i_mutex a second
time.  The third attempt, by Dmitry Kasatkin, resolves the i_mutex
locking issue, by re-introducing the IMA mutex, but uncovered
another problem.  Reading a file with O_DIRECT flag set, writes
directly to userspace pages.  A second patch allocates a user-space
like memory.  This works for all IMA hooks, except ima_file_free(),
which is called on __fput() to recalculate the file hash.

Until this last issue is addressed, do not 'collect' the
measurement for measuring, appraising, or auditing files opened
with the O_DIRECT flag set.  Based on policy, permit or deny file
access.  This patch defines a new IMA policy rule option named
'permit_directio'.  Policy rules could be defined, based on LSM
or other criteria, to permit specific applications to open files
with the O_DIRECT flag set.

Changelog v1:
- permit or deny file access based IMA policy rules

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-06-26 15:17:33 -04:00
..
2011-10-24 16:52:39 +02:00
2011-07-18 12:29:40 -04:00
2010-10-21 20:21:03 -04:00
2013-03-23 16:11:31 -07:00
2012-03-28 18:41:23 +01:00
2011-03-31 11:26:23 -03:00
2012-04-23 14:23:32 +03:00
2011-03-22 04:53:09 -03:00
2014-04-25 12:25:42 -06:00
2008-11-12 17:17:18 -08:00
2011-03-31 11:26:23 -03:00
2013-10-17 00:36:06 +02:00
2013-06-21 11:32:51 +02:00
2013-12-18 16:51:15 -08:00
2011-04-29 18:09:34 -07:00
2009-02-18 15:37:56 -08:00
2009-09-23 07:39:48 -07:00
2008-04-19 19:10:28 -07:00
2012-06-25 13:48:15 +02:00
2008-07-24 10:47:17 -07:00
2008-04-18 08:56:07 -07:00
2014-03-12 00:54:53 +01:00
2009-06-18 13:04:04 -07:00