From: Mimi Z. <zo...@li...> - 2010-03-24 20:45:49
|
Changing an inode's metadata may result in our not needing to appraise the file. In such cases, we must remove 'security.ima'. Signed-off-by: Mimi Zohar <zo...@us...> Acked-by: Serge Hallyn <se...@us...> diff --git a/fs/attr.c b/fs/attr.c index 2391242..0683d25 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -15,6 +15,7 @@ #include <linux/quotaops.h> #include <linux/security.h> #include <linux/evm.h> +#include <linux/ima.h> /* Taken over from the old code... */ @@ -228,6 +229,7 @@ int notify_change(struct dentry * dentry, struct iattr * attr) if (!error) { fsnotify_change(dentry, ia_valid); + ima_inode_post_setattr(dentry); evm_inode_post_setattr(dentry, ia_valid); } diff --git a/include/linux/ima.h b/include/linux/ima.h index 4dce900..ce82e29 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -19,6 +19,7 @@ extern int ima_file_check(struct file *file, int mask); extern void ima_file_free(struct file *file); extern int ima_file_mmap(struct file *file, unsigned long prot); extern void ima_counts_get(struct file *file); +extern void ima_inode_post_setattr(struct dentry *dentry); #else static inline int ima_bprm_check(struct linux_binprm *bprm) @@ -46,5 +47,10 @@ static inline void ima_counts_get(struct file *file) return; } +static inline void ima_inode_post_setattr(struct dentry *dentry) +{ + return; +} + #endif /* CONFIG_IMA_H */ #endif /* _LINUX_IMA_H */ -- 1.6.6 |