lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ima: remove unnecessary call to ima_must_measure

Browse Source 
The original ima_must_measure() function based its results on cached
iint information, which required an iint be allocated for all files.
Currently, an iint is allocated only for files in policy.  As a result,
for those files in policy, ima_must_measure() is now called twice: once
to determine if the inode is in the measurement policy and, the second
time, to determine if it needs to be measured/re-measured.

The second call to ima_must_measure() unnecessarily checks to see if
the file is in policy. As we already know the file is in policy, this
patch removes the second unnecessary call to ima_must_measure(), removes
the vestige iint parameter, and just checks the iint directly to determine
if the inode has been measured or needs to be measured/re-measured.

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Eric Paris <eparis@redhat.com>
This commit is contained in:
Mimi Zohar
2011-02-22 10:19:43 -05:00
parent 854fdd55bf
commit 1adace9bb0
3 changed files with 7 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
security/integrity/ima/ima_main.c
View File

@ -65,7 +65,7 @@ static void ima_rdwr_violation_check(struct file *file)
goto out;
}
rc = ima_must_measure(NULL, inode, MAY_READ, FILE_CHECK);
rc = ima_must_measure(inode, MAY_READ, FILE_CHECK);
if (rc < 0)
goto out;
@ -127,7 +127,7 @@ static int process_measurement(struct file *file, const unsigned char *filename,
if (!ima_initialized || !S_ISREG(inode->i_mode))
return 0;
rc = ima_must_measure(NULL, inode, mask, function);
rc = ima_must_measure(inode, mask, function);
if (rc != 0)
return rc;
retry:
@ -141,7 +141,7 @@ retry:
mutex_lock(&iint->mutex);
rc = ima_must_measure(iint, inode, mask, function);
rc = iint->flags & IMA_MEASURED ? 1 : 0;
if (rc != 0)
goto out;