diff options
| author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2017-04-25 05:43:52 +0300 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2017-06-21 21:37:12 +0300 |
| commit | 6f6723e21589f4594bb72b27ddbb2f75defb33bb (patch) | |
| tree | 195ca6479f58a4519e092710b49848173f615aa3 | |
| parent | e1f5e01f4b035ced1c71b40866e4e5c0508fbb0b (diff) | |
| download | linux-6f6723e21589f4594bb72b27ddbb2f75defb33bb.tar.xz | |
ima: define is_ima_appraise_enabled()
Only return enabled if in enforcing mode, not fix or log modes.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Changes:
- Define is_ima_appraise_enabled() as a bool (Thiago Bauermann)
| -rw-r--r-- | include/linux/ima.h | 6 | ||||
| -rw-r--r-- | security/integrity/ima/ima_appraise.c | 10 |
2 files changed, 16 insertions, 0 deletions
diff --git a/include/linux/ima.h b/include/linux/ima.h index 7f6952f8d6aa..0e4647e0eb60 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -75,11 +75,17 @@ static inline void ima_add_kexec_buffer(struct kimage *image) #endif #ifdef CONFIG_IMA_APPRAISE +extern bool is_ima_appraise_enabled(void); extern void ima_inode_post_setattr(struct dentry *dentry); extern int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, const void *xattr_value, size_t xattr_value_len); extern int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name); #else +static inline bool is_ima_appraise_enabled(void) +{ + return 0; +} + static inline void ima_inode_post_setattr(struct dentry *dentry) { return; diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index ac546df73afc..7fe0566142d8 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -34,6 +34,16 @@ static int __init default_appraise_setup(char *str) __setup("ima_appraise=", default_appraise_setup); /* + * is_ima_appraise_enabled - return appraise status + * + * Only return enabled, if not in ima_appraise="fix" or "log" modes. + */ +bool is_ima_appraise_enabled(void) +{ + return (ima_appraise & IMA_APPRAISE_ENFORCE) ? 1 : 0; +} + +/* * ima_must_appraise - set appraise flag * * Return 1 to appraise |