Dmitry Kasatkin 0716abbb58 ima: use atomic bit operations to protect policy update interface ... The current implementation uses an atomic counter to provide exclusive access to the sysfs 'policy' entry to update the IMA policy. While it is highly unlikely, the usage of a counter might potentially allow another process to overflow the counter, open the interface and insert additional rules into the policy being loaded. This patch replaces using an atomic counter with atomic bit operations which is more reliable and a widely used method to provide exclusive access. As bit operation keep the interface locked after successful update, it makes it unnecessary to verify if the default policy was set or not during parsing and interface closing. This patch also removes that code. Changes in v3: * move audit log message to ima_relead_policy() to report successful and unsuccessful result * unnecessary comment removed Changes in v2: * keep interface locked after successful policy load as in original design * remove sysfs entry as in original design Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>		2014-10-11 23:33:02 -04:00
..
apparmor	sched: move no_new_privs into new atomic flags	2014-07-18 12:13:38 -07:00
integrity	ima: use atomic bit operations to protect policy update interface	2014-10-11 23:33:02 -04:00
keys	KEYS: Make the key matching functions return bool	2014-09-16 17:36:08 +01:00
selinux	selinux: normalize audit log formatting	2014-09-22 17:02:10 -04:00
smack	Make Smack operate on smack_known struct where it still used char*	2014-08-29 10:10:55 -07:00
tomoyo	get rid of pointless checks for NULL ->i_op	2014-04-01 23:19:16 -04:00
yama	yama: Better permission check for ptraceme	2013-03-26 13:17:58 -07:00
capability.c	security: introduce kernel_fw_from_file hook	2014-07-25 11:47:45 -07:00
commoncap.c	CAPABILITIES: remove undefined caps from all processes	2014-07-24 21:53:47 +10:00
device_cgroup.c	device_cgroup: use css_has_online_children() instead of has_children()	2014-05-16 13:22:52 -04:00
inode.c	securityfs: fix object creation races	2012-01-10 10:20:35 -05:00
Kconfig	security: select correct default LSM_MMAP_MIN_ADDR on arm on arm64	2014-02-05 14:59:14 +00:00
lsm_audit.c	audit: anchor all pid references in the initial pid namespace	2014-03-20 10:11:55 -04:00
Makefile	security: cleanup Makefiles to use standard syntax for specifying sub-directories	2014-02-17 11:08:04 +11:00
min_addr.c	mmap_min_addr check CAP_SYS_RAWIO only for write	2010-04-23 08:56:31 +10:00
security.c	ima: add support for measuring and appraising firmware	2014-07-25 11:47:46 -07:00