Commit a408e4a86b36 ("ima: open a new file instance if no read permissions") tries to create a new file descriptor to calculate a file digest if the file has not been opened with O_RDONLY flag. However, if a new file descriptor cannot be obtained, it sets the FMODE_READ flag to file->f_flags instead of file->f_mode. This patch fixes this issue by replacing f_flags with f_mode as it was before that commit.
Showing the changes to security (1 of 1 file). Show all
Unified · Split
| @@ -411,7 +411,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) · 410 unmodified lines | |||
| 411 | loff_t i_size; | 411 | loff_t i_size; |
| 412 | int rc; | 412 | int rc; |
| 413 | struct file *f = file; | 413 | struct file *f = file; |
| 414 | bool new_file_instance = false, modified_flags = false; | 414 | bool new_file_instance = false, modified_mode = false; |
| 415 | 415 | ||
| 416 | /* | 416 | /* |
| 417 | * For consistency, fail file's opened with the O_DIRECT flag on | 417 | * For consistency, fail file's opened with the O_DIRECT flag on |
| @@ -431,13 +431,13 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) · 13 unmodified lines | |||
| 431 | f = dentry_open(&file->f_path, flags, file->f_cred); | 431 | f = dentry_open(&file->f_path, flags, file->f_cred); |
| 432 | if (IS_ERR(f)) { | 432 | if (IS_ERR(f)) { |
| 433 | /* | 433 | /* |
| 434 | * Cannot open the file again, lets modify f_flags | 434 | * Cannot open the file again, lets modify f_mode |
| 435 | * of original and continue | 435 | * of original and continue |
| 436 | */ | 436 | */ |
| 437 | pr_info_ratelimited("Unable to reopen file for reading.\n"); | 437 | pr_info_ratelimited("Unable to reopen file for reading.\n"); |
| 438 | f = file; | 438 | f = file; |
| 439 | f->f_flags |= FMODE_READ; | 439 | f->f_mode |= FMODE_READ; |
| 440 | modified_flags = true; | 440 | modified_mode = true; |
| 441 | } else { | 441 | } else { |
| 442 | new_file_instance = true; | 442 | new_file_instance = true; |
| 443 | } | 443 | } |
| @@ -455,8 +455,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) · 11 unmodified lines | |||
| 455 | out: | 455 | out: |
| 456 | if (new_file_instance) | 456 | if (new_file_instance) |
| 457 | fput(f); | 457 | fput(f); |
| 458 | else if (modified_flags) | 458 | else if (modified_mode) |
| 459 | f->f_flags &= ~FMODE_READ; | 459 | f->f_mode &= ~FMODE_READ; |
| 460 | return rc; | 460 | return rc; |
| 461 | } | 461 | } |
| 462 | 462 | ||