From 07bcb5b0a10aec291b8cb7d5b26fa76d609603e7 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Tue, 12 May 2009 15:13:55 -0400 Subject: [PATCH] --- yaml --- r: 146429 b: refs/heads/master c: f850a7c040d9faafb41bceb0a05d6bb7432c8c7a h: refs/heads/master i: 146427: a81e8d264c8c9aa0621a7549fdb6543e54fdb723 v: v3 --- [refs] | 2 +- trunk/security/integrity/ima/ima_fs.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/[refs] b/[refs] index 7d3ecfa43f80..b5b3b5752e77 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: b103387037cea2ba0f04b44d408d54c53f678061 +refs/heads/master: f850a7c040d9faafb41bceb0a05d6bb7432c8c7a diff --git a/trunk/security/integrity/ima/ima_fs.c b/trunk/security/integrity/ima/ima_fs.c index ffbe259700b1..3305a9615863 100644 --- a/trunk/security/integrity/ima/ima_fs.c +++ b/trunk/security/integrity/ima/ima_fs.c @@ -15,6 +15,7 @@ * implemenents security file system for reporting * current measurement list and IMA statistics */ +#include #include #include #include @@ -283,6 +284,9 @@ static atomic_t policy_opencount = ATOMIC_INIT(1); */ int ima_open_policy(struct inode * inode, struct file * filp) { + /* No point in being allowed to open it if you aren't going to write */ + if (!(filp->f_flags & O_WRONLY)) + return -EACCES; if (atomic_dec_and_test(&policy_opencount)) return 0; return -EBUSY; @@ -349,7 +353,7 @@ int ima_fs_init(void) goto out; ima_policy = securityfs_create_file("policy", - S_IRUSR | S_IRGRP | S_IWUSR, + S_IWUSR, ima_dir, NULL, &ima_measure_policy_ops); if (IS_ERR(ima_policy))