]> git.baikalelectronics.ru Git - kernel.git/commit
ima: added ima_policy_flag variable
authorRoberto Sassu <roberto.sassu@polito.it>
Fri, 12 Sep 2014 17:35:54 +0000 (19:35 +0200)
committerMimi Zohar <zohar@linux.vnet.ibm.com>
Wed, 17 Sep 2014 20:39:36 +0000 (16:39 -0400)
commitb2a57e5253c85ab8781bb7e16b537e00d954b646
treee0bae905c0afb1e7a547f7a686cb293e51a0fbbf
parent6bbd1ce87e507b048f69f85744501b9a1cca30d0
ima: added ima_policy_flag variable

This patch introduces the new variable 'ima_policy_flag', whose bits
are set depending on the action of the current policy rules. Only the
flags IMA_MEASURE, IMA_APPRAISE and IMA_AUDIT are set.

The new variable will be used to improve performance by skipping the
unnecessary execution of IMA code if the policy does not contain rules
with the above actions.

Changes in v6 (Roberto Sassu)
* do not check 'ima_initialized' before calling ima_update_policy_flag()
  in ima_update_policy() (suggested by Dmitry)
* calling ima_update_policy_flag() moved to init_ima to co-locate with
  ima_initialized (Dmitry)
* add/revise comments (Mimi)

Changes in v5 (Roberto Sassu)
* reset IMA_APPRAISE flag in 'ima_policy_flag' if 'ima_appraise' is set
  to zero (reported by Dmitry)
* update 'ima_policy_flag' only if IMA initialization is successful
  (suggested by Mimi and Dmitry)
* check 'ima_policy_flag' instead of 'ima_initialized'
  (suggested by Mimi and Dmitry)

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
security/integrity/ima/ima.h
security/integrity/ima/ima_appraise.c
security/integrity/ima/ima_main.c
security/integrity/ima/ima_policy.c