summaryrefslogtreecommitdiff
path: root/security/integrity/integrity.h
diff options
context:
space:
mode:
authorDmitry Kasatkin <d.kasatkin@samsung.com>2014-06-27 19:04:27 +0400
committerMimi Zohar <zohar@linux.vnet.ibm.com>2014-09-09 01:38:57 +0400
commitb151d6b00bbb798c58f2f21305e7d43fa763f34f (patch)
tree3a10265d73d01f900860aa9e7e1faa5c4eab4f4d /security/integrity/integrity.h
parent1f1009791b2e81f106d4809007720495ba3ed90c (diff)
downloadlinux-b151d6b00bbb798c58f2f21305e7d43fa763f34f.tar.xz
ima: provide flag to identify new empty files
On ima_file_free(), newly created empty files are not labeled with an initial security.ima value, because the iversion did not change. Commit dff6efc "fs: fix iversion handling" introduced a change in iversion behavior. To verify this change use the shell command: $ (exec >foo) $ getfattr -h -e hex -d -m security foo This patch defines the IMA_NEW_FILE flag. The flag is initially set, when IMA detects that a new file is created, and subsequently checked on the ima_file_free() hook to set the initial security.ima value. Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: <stable@vger.kernel.org> 3.14+
Diffstat (limited to 'security/integrity/integrity.h')
-rw-r--r--security/integrity/integrity.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 19b8e314ca96..904e68abd49e 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -31,6 +31,7 @@
#define IMA_DIGSIG 0x01000000
#define IMA_DIGSIG_REQUIRED 0x02000000
#define IMA_PERMIT_DIRECTIO 0x04000000
+#define IMA_NEW_FILE 0x08000000
#define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
IMA_APPRAISE_SUBMASK)