Merge tag 'integrity-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar...

[linux-block.git] / security / integrity / ima / ima_main.c

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 31ab86f7e4d3001be442a9e796ad25bc54fd889e..d66a0a36415e8cb495162e39521abdd559c05141 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -225,7 +225,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
         * bitmask based on the appraise/audit/measurement policy.
         * Included is the appraise submask.
         */
-       action = ima_get_action(file_mnt_user_ns(file), inode, cred, secid,
+       action = ima_get_action(file_mnt_idmap(file), inode, cred, secid,
                                mask, func, &pcr, &template_desc, NULL,
                                &allowed_algos);
        violation_check = ((func == FILE_CHECK || func == MMAP_CHECK ||
@@ -467,10 +467,10 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
 
        security_current_getsecid_subj(&secid);
        inode = file_inode(vma->vm_file);
-       action = ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
+       action = ima_get_action(file_mnt_idmap(vma->vm_file), inode,
                                current_cred(), secid, MAY_EXEC, MMAP_CHECK,
                                &pcr, &template, NULL, NULL);
-       action |= ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
+       action |= ima_get_action(file_mnt_idmap(vma->vm_file), inode,
                                 current_cred(), secid, MAY_EXEC,
                                 MMAP_CHECK_REQPROT, &pcr, &template, NULL,
                                 NULL);
@@ -658,14 +658,14 @@ EXPORT_SYMBOL_GPL(ima_inode_hash);
 
 /**
  * ima_post_create_tmpfile - mark newly created tmpfile as new
- * @mnt_userns: user namespace of the mount the inode was found from
+ * @idmap: idmap of the mount the inode was found from
  * @inode: inode of the newly created tmpfile
  *
  * No measuring, appraising or auditing of newly created tmpfiles is needed.
  * Skip calling process_measurement(), but indicate which newly, created
  * tmpfiles are in policy.
  */
-void ima_post_create_tmpfile(struct user_namespace *mnt_userns,
+void ima_post_create_tmpfile(struct mnt_idmap *idmap,
                             struct inode *inode)
 {
        struct integrity_iint_cache *iint;
@@ -674,7 +674,7 @@ void ima_post_create_tmpfile(struct user_namespace *mnt_userns,
        if (!ima_policy_flag || !S_ISREG(inode->i_mode))
                return;
 
-       must_appraise = ima_must_appraise(mnt_userns, inode, MAY_ACCESS,
+       must_appraise = ima_must_appraise(idmap, inode, MAY_ACCESS,
                                          FILE_CHECK);
        if (!must_appraise)
                return;
@@ -691,13 +691,13 @@ void ima_post_create_tmpfile(struct user_namespace *mnt_userns,
 
 /**
  * ima_post_path_mknod - mark as a new inode
- * @mnt_userns: user namespace of the mount the inode was found from
+ * @idmap: idmap of the mount the inode was found from
  * @dentry: newly created dentry
  *
  * Mark files created via the mknodat syscall as new, so that the
  * file data can be written later.
  */
-void ima_post_path_mknod(struct user_namespace *mnt_userns,
+void ima_post_path_mknod(struct mnt_idmap *idmap,
                         struct dentry *dentry)
 {
        struct integrity_iint_cache *iint;
@@ -707,7 +707,7 @@ void ima_post_path_mknod(struct user_namespace *mnt_userns,
        if (!ima_policy_flag || !S_ISREG(inode->i_mode))
                return;
 
-       must_appraise = ima_must_appraise(mnt_userns, inode, MAY_ACCESS,
+       must_appraise = ima_must_appraise(idmap, inode, MAY_ACCESS,
                                          FILE_CHECK);
        if (!must_appraise)
                return;
@@ -889,7 +889,7 @@ int ima_post_load_data(char *buf, loff_t size,
 
 /**
  * process_buffer_measurement - Measure the buffer or the buffer data hash
- * @mnt_userns:        user namespace of the mount the inode was found from
+ * @idmap: idmap of the mount the inode was found from
  * @inode: inode associated with the object being measured (NULL for KEY_CHECK)
  * @buf: pointer to the buffer that needs to be added to the log.
  * @size: size of buffer(in bytes).
@@ -907,7 +907,7 @@ int ima_post_load_data(char *buf, loff_t size,
  * has been written to the passed location but not added to a measurement entry,
  * a negative value otherwise.
  */
-int process_buffer_measurement(struct user_namespace *mnt_userns,
+int process_buffer_measurement(struct mnt_idmap *idmap,
                               struct inode *inode, const void *buf, int size,
                               const char *eventname, enum ima_hooks func,
                               int pcr, const char *func_data,
@@ -951,7 +951,7 @@ int process_buffer_measurement(struct user_namespace *mnt_userns,
         */
        if (func) {
                security_current_getsecid_subj(&secid);
-               action = ima_get_action(mnt_userns, inode, current_cred(),
+               action = ima_get_action(idmap, inode, current_cred(),
                                        secid, 0, func, &pcr, &template,
                                        func_data, NULL);
                if (!(action & IMA_MEASURE) && !digest)
@@ -1031,7 +1031,7 @@ void ima_kexec_cmdline(int kernel_fd, const void *buf, int size)
        if (!f.file)
                return;
 
-       process_buffer_measurement(file_mnt_user_ns(f.file), file_inode(f.file),
+       process_buffer_measurement(file_mnt_idmap(f.file), file_inode(f.file),
                                   buf, size, "kexec-cmdline", KEXEC_CMDLINE, 0,
                                   NULL, false, NULL, 0);
        fdput(f);
@@ -1064,7 +1064,7 @@ int ima_measure_critical_data(const char *event_label,
        if (!event_name || !event_label || !buf || !buf_len)
                return -ENOPARAM;
 
-       return process_buffer_measurement(&init_user_ns, NULL, buf, buf_len,
+       return process_buffer_measurement(&nop_mnt_idmap, NULL, buf, buf_len,
                                          event_name, CRITICAL_DATA, 0,
                                          event_label, hash, digest,
                                          digest_len);