diff options
author | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2011-02-22 10:19:43 -0500 |
---|---|---|
committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2011-02-23 16:38:52 -0500 |
commit | 1adace9bb04a5f4a4dea9e642089102661bb0ceb (patch) | |
tree | 2396099935c50d838899a01da1438b8a441619de /security/integrity/ima/ima_api.c | |
parent | 854fdd55bfdd56cfc61bd30f2062a9268fcebba6 (diff) | |
download | kernel_samsung_smdk4412-1adace9bb04a5f4a4dea9e642089102661bb0ceb.zip kernel_samsung_smdk4412-1adace9bb04a5f4a4dea9e642089102661bb0ceb.tar.gz kernel_samsung_smdk4412-1adace9bb04a5f4a4dea9e642089102661bb0ceb.tar.bz2 |
ima: remove unnecessary call to ima_must_measure
The original ima_must_measure() function based its results on cached
iint information, which required an iint be allocated for all files.
Currently, an iint is allocated only for files in policy. As a result,
for those files in policy, ima_must_measure() is now called twice: once
to determine if the inode is in the measurement policy and, the second
time, to determine if it needs to be measured/re-measured.
The second call to ima_must_measure() unnecessarily checks to see if
the file is in policy. As we already know the file is in policy, this
patch removes the second unnecessary call to ima_must_measure(), removes
the vestige iint parameter, and just checks the iint directly to determine
if the inode has been measured or needs to be measured/re-measured.
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Acked-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'security/integrity/ima/ima_api.c')
-rw-r--r-- | security/integrity/ima/ima_api.c | 13 |
1 files changed, 3 insertions, 10 deletions
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index d3963de..da36d2c 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -105,20 +105,13 @@ err_out: * mask: contains the permission mask * fsmagic: hex value * - * Must be called with iint->mutex held. - * - * Return 0 to measure. Return 1 if already measured. - * For matching a DONT_MEASURE policy, no policy, or other - * error, return an error code. + * Return 0 to measure. For matching a DONT_MEASURE policy, no policy, + * or other error, return an error code. */ -int ima_must_measure(struct ima_iint_cache *iint, struct inode *inode, - int mask, int function) +int ima_must_measure(struct inode *inode, int mask, int function) { int must_measure; - if (iint && iint->flags & IMA_MEASURED) - return 1; - must_measure = ima_match_policy(inode, function, mask); return must_measure ? 0 : -EACCES; } |