| From b68c5f0ca276888c26a60dda5720aad8eafb6bfe Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 9 Jul 2020 01:19:00 -0500 |
| Subject: ima: Have the LSM free its audit rule |
| |
| From: Tyler Hicks <tyhicks@linux.microsoft.com> |
| |
| [ Upstream commit 9ff8a616dfab96a4fa0ddd36190907dc68886d9b ] |
| |
| Ask the LSM to free its audit rule rather than directly calling kfree(). |
| Both AppArmor and SELinux do additional work in their audit_rule_free() |
| hooks. Fix memory leaks by allowing the LSMs to perform necessary work. |
| |
| Fixes: b16942455193 ("ima: use the lsm policy update notifier") |
| Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com> |
| Cc: Janne Karhunen <janne.karhunen@gmail.com> |
| Cc: Casey Schaufler <casey@schaufler-ca.com> |
| Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> |
| Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| security/integrity/ima/ima.h | 5 +++++ |
| security/integrity/ima/ima_policy.c | 2 +- |
| 2 files changed, 6 insertions(+), 1 deletion(-) |
| |
| diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h |
| index 495e28bd488e6..04c246b2b767f 100644 |
| --- a/security/integrity/ima/ima.h |
| +++ b/security/integrity/ima/ima.h |
| @@ -400,6 +400,7 @@ static inline void ima_free_modsig(struct modsig *modsig) |
| #ifdef CONFIG_IMA_LSM_RULES |
| |
| #define security_filter_rule_init security_audit_rule_init |
| +#define security_filter_rule_free security_audit_rule_free |
| #define security_filter_rule_match security_audit_rule_match |
| |
| #else |
| @@ -410,6 +411,10 @@ static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr, |
| return -EINVAL; |
| } |
| |
| +static inline void security_filter_rule_free(void *lsmrule) |
| +{ |
| +} |
| + |
| static inline int security_filter_rule_match(u32 secid, u32 field, u32 op, |
| void *lsmrule) |
| { |
| diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c |
| index e493063a3c344..236a731492d1e 100644 |
| --- a/security/integrity/ima/ima_policy.c |
| +++ b/security/integrity/ima/ima_policy.c |
| @@ -258,7 +258,7 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry) |
| int i; |
| |
| for (i = 0; i < MAX_LSM_RULES; i++) { |
| - kfree(entry->lsm[i].rule); |
| + security_filter_rule_free(entry->lsm[i].rule); |
| kfree(entry->lsm[i].args_p); |
| } |
| kfree(entry); |
| -- |
| 2.25.1 |
| |