Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751146AbdIOE6z (ORCPT ); Fri, 15 Sep 2017 00:58:55 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:48598 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750787AbdIOE6y (ORCPT ); Fri, 15 Sep 2017 00:58:54 -0400 From: Mimi Zohar To: linux-security-module@vger.kernel.org Cc: Mimi Zohar , linux-ima-devel@lists.sourceforge.net, Christoph Hellwig , Linus Torvalds , James Morris , Linux Kernel Mailing List Subject: [PATCH 0/3] ima: only call integrity_kernel_read to calc file hash Date: Fri, 15 Sep 2017 00:58:11 -0400 X-Mailer: git-send-email 2.7.4 X-TM-AS-MML: disable x-cbid: 17091504-0016-0000-0000-0000026507F7 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17091504-0017-0000-0000-000006EA0E8D Message-Id: <1505451494-30228-1-git-send-email-zohar@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-09-15_02:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1709150073 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1824 Lines: 46 The integrity_kernel_read() function was originally introduced to read a file and calculate the file hash by-passing any security checks. Support subsequently was added allowing the kernel to read a file containing a signed x509 certificate and load it onto either the IMA or EVM keyring. This patch set replaces the call to integrity_kernel_read() with the common kernel_read_file_from_path() function, for reading and loading an x509 certificate onto either the IMA or EVM keyring. The remaining calls to integrity_kernel_read() calculate a file hash, by calling the new integrity_read file operation method. Mimi Christoph Hellwig (2): integrity: replace call to integrity_read_file with kernel version ima: use fs method to read integrity data Mimi Zohar (1): vfs: constify path argument to kernel_read_file_from_path fs/btrfs/file.c | 1 + fs/efivarfs/file.c | 1 + fs/exec.c | 2 +- fs/ext2/file.c | 17 ++++++++++ fs/ext4/file.c | 20 ++++++++++++ fs/f2fs/file.c | 1 + fs/jffs2/file.c | 1 + fs/jfs/file.c | 1 + fs/nilfs2/file.c | 1 + fs/ramfs/file-mmu.c | 1 + fs/ramfs/file-nommu.c | 1 + fs/ubifs/file.c | 1 + fs/xfs/xfs_file.c | 21 ++++++++++++ include/linux/fs.h | 4 ++- mm/shmem.c | 1 + security/integrity/digsig.c | 14 +++++--- security/integrity/iint.c | 69 ++++++++------------------------------- security/integrity/ima/ima_main.c | 4 +++ security/integrity/integrity.h | 2 -- sound/oss/sound_firmware.h | 2 +- 20 files changed, 100 insertions(+), 65 deletions(-) -- 2.7.4