ima: fix ima_d_path() possible race with rename
authorMimi Zohar <zohar@linux.vnet.ibm.com>
Tue, 17 Jan 2017 11:45:41 +0000 (06:45 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 12 Mar 2017 05:44:10 +0000 (06:44 +0100)
commit45c01d51bb34a686ea9b3741f9f0fe936e76f6cc
tree5f9f65c4fe992293cd70a4ca495c78a3aaaf66b0
parent87d1f686d6bf9d9003372469ffb5f1c310f28299
ima: fix ima_d_path() possible race with rename

commit bc15ed663e7e53ee4dc3e60f8d09c93a0528c694 upstream.

On failure to return a pathname from ima_d_path(), a pointer to
dname is returned, which is subsequently used in the IMA measurement
list, the IMA audit records, and other audit logging.  Saving the
pointer to dname for later use has the potential to race with rename.

Intead of returning a pointer to dname on failure, this patch returns
a pointer to a copy of the filename.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
security/integrity/ima/ima.h
security/integrity/ima/ima_api.c
security/integrity/ima/ima_main.c