summaryrefslogtreecommitdiff
path: root/security/security.c
diff options
context:
space:
mode:
authorRoberto Sassu <roberto.sassu@huawei.com>2024-02-15 11:31:00 +0100
committerPaul Moore <paul@paul-moore.com>2024-02-15 23:43:42 -0500
commit8f46ff5767b0b18329140d80d6bcabd818f42c4c (patch)
tree0023bde4f2e5cacda47f6bb5edb32dd552dfeed8 /security/security.c
parentdae52cbf5887ac51c3574648124cfe475a9b3246 (diff)
security: Introduce file_post_open hook
In preparation to move IMA and EVM to the LSM infrastructure, introduce the file_post_open hook. Also, export security_file_post_open() for NFS. Based on policy, IMA calculates the digest of the file content and extends the TPM with the digest, verifies the file's integrity based on the digest, and/or includes the file digest in the audit log. LSMs could similarly take action depending on the file content and the access mask requested with open(). The new hook returns a value and can cause the open to be aborted. Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/security.c')
-rw-r--r--security/security.c17
1 files changed, 17 insertions, 0 deletions
diff --git a/security/security.c b/security/security.c
index d77fdd3ca1bc..207405a84902 100644
--- a/security/security.c
+++ b/security/security.c
@@ -2967,6 +2967,23 @@ int security_file_open(struct file *file)
}
/**
+ * security_file_post_open() - Evaluate a file after it has been opened
+ * @file: the file
+ * @mask: access mask
+ *
+ * Evaluate an opened file and the access mask requested with open(). The hook
+ * is useful for LSMs that require the file content to be available in order to
+ * make decisions.
+ *
+ * Return: Returns 0 if permission is granted.
+ */
+int security_file_post_open(struct file *file, int mask)
+{
+ return call_int_hook(file_post_open, 0, file, mask);
+}
+EXPORT_SYMBOL_GPL(security_file_post_open);
+
+/**
* security_file_truncate() - Check if truncating a file is allowed
* @file: file
*