This patch changes the evm_inode_init_security() definition to align with
the LSM infrastructure, in preparation for moving IMA and EVM to that
infrastructure.
Signed-off-by: Roberto Sassu <roberto.sa...@huawei.com>
---
include/linux/evm.h | 21 ++++++++++++++-------
security/integrity/evm/evm_main.c | 24 +++++++++++++++---------
security/security.c | 7 +++++--
3 files changed, 34 insertions(+), 18 deletions(-)
diff --git a/include/linux/evm.h b/include/linux/evm.h
index 8cad46bcec9d..5d8b29d80296 100644
--- a/include/linux/evm.h
+++ b/include/linux/evm.h
@@ -34,9 +34,11 @@ extern int evm_inode_removexattr(struct user_namespace
*mnt_userns,
struct dentry *dentry, const char *xattr_name);
extern void evm_inode_post_removexattr(struct dentry *dentry,
const char *xattr_name);
-extern int evm_inode_init_security(struct inode *inode,
- const struct xattr *xattr_array,
- struct xattr *evm);
+extern int evm_inode_init_security(struct inode *inode, struct inode *dir,
+ const struct qstr *qstr,
+ const char **name,
+ void **value, size_t *len,
+ struct xattr *lsm_xattrs);
extern bool evm_status_revalidate(const char *xattr_name);
#ifdef CONFIG_FS_POSIX_ACL
extern int posix_xattr_acl(const char *xattrname);
@@ -102,11 +104,16 @@ static inline void evm_inode_post_removexattr(struct
dentry *dentry,
return;
}
-static inline int evm_inode_init_security(struct inode *inode,
- const struct xattr *xattr_array,
- struct xattr *evm)
+static inline int evm_inode_init_security(struct inode *inode, struct inode
*dir,
+ const struct qstr *qstr,
+ const char **name,
+ void **value, size_t *len,
+ struct xattr *lsm_xattrs)
{
- return 0;
+ if (!name || !value || !len || !lsm_xattrs)
+ return 0;
+
+ return -EOPNOTSUPP;
}
static inline bool evm_status_revalidate(const char *xattr_name)
diff --git a/security/integrity/evm/evm_main.c
b/security/integrity/evm/evm_main.c
index 84a9b7a69b1f..a5069d69a893 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -706,29 +706,35 @@ void evm_inode_post_setattr(struct dentry *dentry, int
ia_valid)
/*
* evm_inode_init_security - initializes security.evm HMAC value
*/
-int evm_inode_init_security(struct inode *inode,
- const struct xattr *lsm_xattr,
- struct xattr *evm_xattr)
+int evm_inode_init_security(struct inode *inode, struct inode *dir,
+ const struct qstr *qstr,
+ const char **name,
+ void **value, size_t *len,
+ struct xattr *lsm_xattrs)
{
struct evm_xattr *xattr_data;
int rc;
- if (!(evm_initialized & EVM_INIT_HMAC) ||
- !evm_protected_xattr(lsm_xattr->name))
+ if (!name || !value || !len || !lsm_xattrs)
return 0;
+ if (!(evm_initialized & EVM_INIT_HMAC) ||
+ !evm_protected_xattr(lsm_xattrs->name))
+ return -EOPNOTSUPP;
+
xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
if (!xattr_data)
return -ENOMEM;
xattr_data->data.type = EVM_XATTR_HMAC;
- rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);
+ rc = evm_init_hmac(inode, lsm_xattrs, xattr_data->digest);
if (rc < 0)
goto out;
- evm_xattr->value = xattr_data;
- evm_xattr->value_len = hash_digest_size[evm_hash_algo] + 1;
- evm_xattr->name = XATTR_EVM_SUFFIX;
+ *name = XATTR_EVM_SUFFIX;
+ *value = xattr_data;
+ *len = hash_digest_size[evm_hash_algo] + 1;
+
return 0;
out:
kfree(xattr_data);
diff --git a/security/security.c b/security/security.c
index 8aabbc0f0dfc..e16ce150b111 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1080,8 +1080,11 @@ int security_inode_init_security(struct inode *inode,
struct inode *dir,
goto out;
}
- ret = evm_inode_init_security(inode, new_xattrs, lsm_xattr);
- if (ret)
+ ret = evm_inode_init_security(inode, dir, qstr,
+ &lsm_xattr->name,
+ &lsm_xattr->value,
+ &lsm_xattr->value_len, new_xattrs);
+ if (ret && ret != -EOPNOTSUPP)
goto out;
ret = initxattrs(inode, new_xattrs, fs_data);
out:
--
2.26.2
