summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.vnet.ibm.com>2016-01-15 01:57:47 +0300
committerMimi Zohar <zohar@linux.vnet.ibm.com>2016-02-21 06:35:08 +0300
commitcf2222178645e545e96717b2825601321ce4745c (patch)
treec13092b85aaf3207e2626c7da1102da0b5dfab36 /include
parent98304bcf71845e97c0b5c800ae619311156b66c1 (diff)
downloadlinux-cf2222178645e545e96717b2825601321ce4745c.tar.xz
ima: define a new hook to measure and appraise a file already in memory
This patch defines a new IMA hook ima_post_read_file() for measuring and appraising files read by the kernel. The caller loads the file into memory before calling this function, which calculates the hash followed by the normal IMA policy based processing. Changelog v5: - fail ima_post_read_file() if either file or buf is NULL v3: - rename ima_hash_and_process_file() to ima_post_read_file() v1: - split patch Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Acked-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
Diffstat (limited to 'include')
-rw-r--r--include/linux/ima.h8
-rw-r--r--include/linux/security.h1
2 files changed, 9 insertions, 0 deletions
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 120ccc53fcb7..d29a6a23fc19 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -20,6 +20,8 @@ extern void ima_file_free(struct file *file);
extern int ima_file_mmap(struct file *file, unsigned long prot);
extern int ima_module_check(struct file *file);
extern int ima_fw_from_file(struct file *file, char *buf, size_t size);
+extern int ima_post_read_file(struct file *file, void *buf, loff_t size,
+ enum kernel_read_file_id id);
#else
static inline int ima_bprm_check(struct linux_binprm *bprm)
@@ -52,6 +54,12 @@ static inline int ima_fw_from_file(struct file *file, char *buf, size_t size)
return 0;
}
+static inline int ima_post_read_file(struct file *file, void *buf, loff_t size,
+ enum kernel_read_file_id id)
+{
+ return 0;
+}
+
#endif /* CONFIG_IMA */
#ifdef CONFIG_IMA_APPRAISE
diff --git a/include/linux/security.h b/include/linux/security.h
index b68ce94e4e00..d920718dc845 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -24,6 +24,7 @@
#include <linux/key.h>
#include <linux/capability.h>
+#include <linux/fs.h>
#include <linux/slab.h>
#include <linux/err.h>
#include <linux/string.h>