path: root/security/integrity/integrity.h
diff options
authorMimi Zohar <zohar@linux.vnet.ibm.com>2011-03-10 18:54:15 -0500
committerMimi Zohar <zohar@linux.vnet.ibm.com>2012-09-07 14:57:47 -0400
commit42c63330f2b05aa6077c1bfc2798c04afe54f6b2 (patch)
treebbd7d212ba9c686b2b649718b8b919bdd2eecea4 /security/integrity/integrity.h
parent9957a5043e7b0b7361cdf48eea22b2900293e63a (diff)
ima: add ima_inode_setxattr/removexattr function and calls
Based on xattr_permission comments, the restriction to modify 'security' xattr is left up to the underlying fs or lsm. Ensure that not just anyone can modify or remove 'security.ima'. Changelog v1: - Unless IMA-APPRAISE is configured, use stub ima_inode_removexattr()/setxattr() functions. (Moved ima_inode_removexattr()/setxattr() to ima_appraise.c) Changelog: - take i_mutex to fix locking (Dmitry Kasatkin) - ima_reset_appraise_flags should only be called when modifying or removing the 'security.ima' xattr. Requires CAP_SYS_ADMIN privilege. (Incorporated fix from Roberto Sassu) - Even if allowed to update security.ima, reset the appraisal flags, forcing re-appraisal. - Replace CAP_MAC_ADMIN with CAP_SYS_ADMIN - static inline ima_inode_setxattr()/ima_inode_removexattr() stubs - ima_protect_xattr should be static Signed-off-by: Mimi Zohar <zohar@us.ibm.com> Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Diffstat (limited to 'security/integrity/integrity.h')
0 files changed, 0 insertions, 0 deletions