diff --git a/include/linux/ima.h b/include/linux/ima.h index cfdd1280daff807646be2062aaf58a05622502fc..12738e37f714dc0e939708fbd8936f92f0071c64 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -234,7 +234,6 @@ struct ima_namespace { struct integrity_iint_tree *iint_tree; struct list_head ns_measurements; atomic_long_t ml_len; /* number of stored measurements in the list */ - atomic_long_t violations; } __randomize_layout; extern struct ima_namespace init_ima_ns; diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index fce3fc0650278a8e75b15779f375e0256777223f..59d1afb3934dfb0476d431375f4917d911f3e63b 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -191,6 +191,7 @@ extern spinlock_t ima_htable_lock; struct ima_h_table { atomic_long_t len; /* number of stored measurements in the list */ + atomic_long_t violations; struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE]; }; extern struct ima_h_table ima_htable; diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index 5921922d69303f024a56abfe2daecb2c5560b26f..6724ee072cd951a4b8d95b1b63cc389c55d84681 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -171,7 +171,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, event_data.ns_id = get_ns_id(ima_ns); /* can overflow, only indicator */ - atomic_long_inc(&ima_ns->violations); + atomic_long_inc(&ima_htable.violations); result = ima_alloc_init_template(&event_data, &entry, NULL); if (result < 0) { diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index bda35e2bb45c327491f27c82e0c7029dfa5a732f..b5d45a67a261bbeceb11505988e9d715b0e481d9 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -61,7 +61,7 @@ static ssize_t ima_show_htable_value(struct file *filp, char __user *buf, struct ima_namespace *ima_ns = get_current_ns(); if (filp->f_path.dentry == violations) - val = &ima_ns->violations; + val = &ima_htable.violations; else if (filp->f_path.dentry == runtime_measurements_count) val = (ima_ns == &init_ima_ns) ? &ima_ml_len : &ima_ns->ml_len; #ifdef CONFIG_IMA_DIGEST_LIST @@ -650,7 +650,7 @@ int __init ima_fs_init(void) goto out; violations = - securityfs_create_file("violations", S_IRUSR | S_IRGRP | S_IROTH, + securityfs_create_file("violations", S_IRUSR | S_IRGRP, ima_dir, NULL, &ima_htable_value_ops); if (IS_ERR(violations)) goto out; diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c index 923373a12f5c2d5fdb1f5af122f8b0bd97ab1e43..99b9643e6763d20f8227a748864d787ceeb149df 100644 --- a/security/integrity/ima/ima_init.c +++ b/security/integrity/ima/ima_init.c @@ -37,7 +37,6 @@ struct ima_namespace init_ima_ns = { .iint_tree = &init_iint_tree, .ns_measurements = LIST_HEAD_INIT(init_ima_ns.ns_measurements), .ml_len = ATOMIC_LONG_INIT(0), - .violations = ATOMIC_LONG_INIT(0), }; EXPORT_SYMBOL(init_ima_ns); diff --git a/security/integrity/ima/ima_ns.c b/security/integrity/ima/ima_ns.c index 26c9bcd5ff7404a602fd1aeb9994c54e66c8087d..2a4b7a23f9a7d40ae80430aba6cfaf77c60e610f 100644 --- a/security/integrity/ima/ima_ns.c +++ b/security/integrity/ima/ima_ns.c @@ -128,7 +128,6 @@ static struct ima_namespace *clone_ima_ns(struct user_namespace *user_ns, ns->ucounts = ucounts; ns->frozen = false; atomic_long_set(&ns->ml_len, 0); - atomic_long_set(&ns->violations, 0); rwlock_init(&ns->iint_tree->lock); ns->iint_tree->root = RB_ROOT; diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c index e9a88910d726abc8971d9814969eab48760ced1c..89b9c373489021f159a7e4bb690a40da74da3b6c 100644 --- a/security/integrity/ima/ima_queue.c +++ b/security/integrity/ima/ima_queue.c @@ -38,6 +38,7 @@ DEFINE_SPINLOCK(ima_htable_lock); /* key: inode (before secure-hashing a file) */ struct ima_h_table ima_htable = { .len = ATOMIC_LONG_INIT(0), + .violations = ATOMIC_LONG_INIT(0), .queue[0 ... IMA_MEASURE_HTABLE_SIZE - 1] = HLIST_HEAD_INIT };