user/sven/linux.git/include/linux/evm.h, branch v3.2

evm: posix acls modify i_mode

2011-09-14T19:24:51Z

The posix xattr acls are 'system' prefixed, which normally would not affect security.evm. An interesting side affect of writing posix xattr acls is their modifying of the i_mode, which is included in security.evm. This patch updates security.evm when posix xattr acls are written. Signed-off-by: Mimi Zohar

evm: fix evm_inode_init_security return code

2011-08-11T07:42:41Z

evm_inode_init_security() should return 0, when EVM is not enabled. (Returning an error is a remnant of evm_inode_post_init_security.) Signed-off-by: Mimi Zohar Signed-off-by: James Morris

evm: building without EVM enabled fixes

2011-08-11T07:42:07Z

- Missing 'inline' on evm_inode_setattr() definition. Introduced by commit 817b54aa45db ("evm: add evm_inode_setattr to prevent updating an invalid security.evm"). - Missing security_old_inode_init_security() stub function definition. Caused by commit 9d8f13ba3f48 ("security: new security_inode_init_security API adds function callback"). Reported-by: Stephen Rothwell Signed-off-by: Mimi Zohar Signed-off-by: James Morris

evm: add evm_inode_setattr to prevent updating an invalid security.evm

2011-07-18T16:29:50Z

Permit changing of security.evm only when valid, unless in fixmode. Reported-by: Roberto Sassu Signed-off-by: Mimi Zohar

evm: additional parameter to pass integrity cache entry 'iint'

2011-07-18T16:29:47Z

Additional iint parameter allows to skip lookup in the cache. Signed-off-by: Dmitry Kasatkin Signed-off-by: Mimi Zohar

evm: add evm_inode_init_security to initialize new files

2011-07-18T16:29:45Z

Initialize 'security.evm' for new files. Changelog v7: - renamed evm_inode_post_init_security to evm_inode_init_security - moved struct xattr definition to earlier patch - allocate xattr name Changelog v6: - Use 'struct evm_ima_xattr_data' Signed-off-by: Mimi Zohar

evm: imbed evm_inode_post_setattr

2011-07-18T16:29:44Z

Changing the inode's metadata may require the 'security.evm' extended attribute to be re-calculated and updated. Signed-off-by: Mimi Zohar Acked-by: Serge Hallyn

evm: evm_inode_post_removexattr

2011-07-18T16:29:43Z

When an EVM protected extended attribute is removed, update 'security.evm'. Signed-off-by: Mimi Zohar Acked-by: Serge Hallyn

security: imbed evm calls in security hooks

2011-07-18T16:29:42Z

Imbed the evm calls evm_inode_setxattr(), evm_inode_post_setxattr(), evm_inode_removexattr() in the security hooks. evm_inode_setxattr() protects security.evm xattr. evm_inode_post_setxattr() and evm_inode_removexattr() updates the hmac associated with an inode. (Assumes an LSM module protects the setting/removing of xattr.) Changelog: - Don't define evm_verifyxattr(), unless CONFIG_INTEGRITY is enabled. - xattr_name is a 'const', value is 'void *' Signed-off-by: Mimi Zohar Acked-by: Serge Hallyn