TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ima: Have the LSM free its audit rule

Browse Source 
commit 9ff8a616dfab96a4fa0ddd36190907dc68886d9b upstream.

Ask the LSM to free its audit rule rather than directly calling kfree().
Both AppArmor and SELinux do additional work in their audit_rule_free()
hooks. Fix memory leaks by allowing the LSMs to perform necessary work.

Fixes: b16942455193 ("ima: use the lsm policy update notifier")
Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: Janne Karhunen <janne.karhunen@gmail.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Cc: <stable@vger.kernel.org> # 4.19+
Signed-off-by: Gou Hao <gouhao@uniontech.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Tyler Hicks
2022-09-30 15:49:35 +08:00
committed by Greg Kroah-Hartman
parent acf4387e55
commit 7e29076462
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
security/integrity/ima/ima.h
View File

@@ -298,6 +298,7 @@ static inline int ima_read_xattr(struct dentry *dentry,
#ifdef CONFIG_IMA_LSM_RULES
#define security_filter_rule_init security_audit_rule_init
#define security_filter_rule_free security_audit_rule_free
#define security_filter_rule_match security_audit_rule_match
#else
@@ -308,6 +309,10 @@ static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,
return -EINVAL;
}
static inline void security_filter_rule_free(void *lsmrule)
{
}
static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,
void *lsmrule,
struct audit_context *actx)

4
security/integrity/ima/ima_policy.c
View File

@@ -1044,8 +1044,10 @@ void ima_delete_rules(void)
temp_ima_appraise = 0;
list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
for (i = 0; i < MAX_LSM_RULES; i++)
for (i = 0; i < MAX_LSM_RULES; i++) {
security_filter_rule_free(entry->lsm[i].rule);
kfree(entry->lsm[i].args_p);
}
list_del(&entry->list);
kfree(entry);