diff options
| author | Seth Forshee <seth.forshee@canonical.com> | 2017-01-10 08:12:10 -0600 |
|---|---|---|
| committer | Seth Forshee <seth.forshee@canonical.com> | 2017-03-24 09:23:30 -0500 |
| commit | 6565435f1c8fcd13a6faef093ca4091473897a23 (patch) | |
| tree | 7707006f7ff7e392669ef460a83c34e848bd32c5 | |
| parent | c4ed4dd94af0f1ffa04146fc3afd0812e8d0dd84 (diff) | |
| download | linux-integrity.tar.gz | |
ima: Don't appraise or measure files in fuse mounts by defaultintegrity
Simalarly to NFS, ima cannot detect "remote" file changes is fuse
filesystems. Thus it should have DONT_APPRAISE/DONT_MEASURE in
the built-in policy just like NFS does.
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
| -rw-r--r-- | security/integrity/ima/ima_policy.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index aed47b777a57fb..a0b470f579e724 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -94,7 +94,8 @@ static struct ima_rule_entry dont_measure_rules[] = { {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC}, - {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC} + {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_MEASURE, .fsmagic = FUSE_SUPER_MAGIC, .flags = IMA_FSMAGIC} }; static struct ima_rule_entry original_measurement_rules[] = { @@ -134,6 +135,7 @@ static struct ima_rule_entry default_appraise_rules[] = { {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC}, {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}, {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC}, + {.action = DONT_APPRAISE, .fsmagic = FUSE_SUPER_MAGIC, .flags = IMA_FSMAGIC}, #ifdef CONFIG_IMA_WRITE_POLICY {.action = APPRAISE, .func = POLICY_CHECK, .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED}, |