integrity: move integrity_audit_msg()

This patch moves the integrity_audit_msg() function and defintion to
security/integrity/, the parent directory, renames the 'ima_audit'
boot command line option to 'integrity_audit', and fixes the Kconfig
help text to reflect the actual code.

Changelog:
- Fixed ifdef inclusion of integrity_audit_msg() (Fengguang Wu)

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index c3bfacb92910dc8d044bec88122c4a85328ed8d5..cb5daa1cd605506c7c964f5328cc200957073fa1 100644 (file)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1129,11 +1129,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        The builtin appraise policy appraises all files
                        owned by uid=0.
 
                        The builtin appraise policy appraises all files
                        owned by uid=0.
 

-       ima_audit=      [IMA]
-                       Format: { "0" | "1" }
-                       0 -- integrity auditing messages. (Default)
-                       1 -- enable informational integrity auditing messages.
-

        ima_hash=       [IMA]
                        Format: { "sha1" | "md5" }
                        default: "sha1"
        ima_hash=       [IMA]
                        Format: { "sha1" | "md5" }
                        default: "sha1"


@@ -1158,6 +1153,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        inport.irq=     [HW] Inport (ATI XL and Microsoft) busmouse driver
                        Format: <irq>
 
        inport.irq=     [HW] Inport (ATI XL and Microsoft) busmouse driver
                        Format: <irq>
 

+       integrity_audit=[IMA]
+                       Format: { "0" | "1" }
+                       0 -- basic integrity auditing messages. (Default)
+                       1 -- additional integrity auditing messages.
+

        intel_iommu=    [DMAR] Intel IOMMU driver (DMAR) option
                on
                        Enable intel iommu driver.
        intel_iommu=    [DMAR] Intel IOMMU driver (DMAR) option
                on
                        Enable intel iommu driver.

diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
index 4bb3a775a996041c02fe6db7373e340e73a5f7ac..245c6d92065b36ae748c6936d696d4a2222d9b9d 100644 (file)
--- a/security/integrity/Kconfig
+++ b/security/integrity/Kconfig
@@ -17,6 +17,21 @@ config INTEGRITY_SIGNATURE
          This is useful for evm and module keyrings, when keys are
          usually only added from initramfs.
 
          This is useful for evm and module keyrings, when keys are
          usually only added from initramfs.
 

+config INTEGRITY_AUDIT
+       bool "Enables integrity auditing support "
+       depends on INTEGRITY && AUDIT
+       default y
+       help
+         In addition to enabling integrity auditing support, this
+         option adds a kernel parameter 'integrity_audit', which
+         controls the level of integrity auditing messages.
+         0 - basic integrity auditing messages (default)
+         1 - additional integrity auditing messages
+
+         Additional informational integrity auditing messages would
+         be enabled by specifying 'integrity_audit=1' on the kernel
+         command line.
+

 config INTEGRITY_ASYMMETRIC_KEYS
        boolean "Enable asymmetric keys support"
        depends on INTEGRITY_SIGNATURE
 config INTEGRITY_ASYMMETRIC_KEYS
        boolean "Enable asymmetric keys support"
        depends on INTEGRITY_SIGNATURE

diff --git a/security/integrity/Makefile b/security/integrity/Makefile
index ebb6409b3fcb97caeb15d211e1427a1148050f60..0f9cffb1f9ade08400a916d7a5e3694679266e49 100644 (file)
--- a/security/integrity/Makefile
+++ b/security/integrity/Makefile
@@ -3,6 +3,7 @@
 #
 
 obj-$(CONFIG_INTEGRITY) += integrity.o
 #
 
 obj-$(CONFIG_INTEGRITY) += integrity.o

+obj-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o

 obj-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o
 obj-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o
 
 obj-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o
 obj-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o
 

diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index d232c73647ae46ee0f8295a4965419f5b044ca99..39196abaff0d69d7d600ecd53847ba62b8cebed1 100644 (file)
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -38,18 +38,6 @@ config IMA_MEASURE_PCR_IDX
          that IMA uses to maintain the integrity aggregate of the
          measurement list.  If unsure, use the default 10.
 
          that IMA uses to maintain the integrity aggregate of the
          measurement list.  If unsure, use the default 10.
 

-config IMA_AUDIT
-       bool "Enables auditing support"
-       depends on IMA
-       depends on AUDIT
-       default y
-       help
-         This option adds a kernel parameter 'ima_audit', which
-         allows informational auditing messages to be enabled
-         at boot.  If this option is selected, informational integrity
-         auditing messages can be enabled with 'ima_audit=1' on
-         the kernel command line.
-

 config IMA_LSM_RULES
        bool
        depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK)
 config IMA_LSM_RULES
        bool
        depends on IMA && AUDIT && (SECURITY_SELINUX || SECURITY_SMACK)

diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile
index 3f2ca6bdc384ecbb5b3de4dc53d32c9a802d5958..56dfee7cbf61c6605adf103dbf91393b33fe9256 100644 (file)
--- a/security/integrity/ima/Makefile
+++ b/security/integrity/ima/Makefile
@@ -7,5 +7,4 @@ obj-$(CONFIG_IMA) += ima.o
 
 ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
         ima_policy.o
 
 ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
         ima_policy.o

-ima-$(CONFIG_IMA_AUDIT) += ima_audit.o

 ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o
 ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index a41c9c18e5e0706498d44a26e3ece7d49f307e4c..b3dd616560f72054e13ddeaedaa39017585c2e5c 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -62,20 +62,6 @@ struct ima_queue_entry {
 };
 extern struct list_head ima_measurements;      /* list of all measurements */
 
 };
 extern struct list_head ima_measurements;      /* list of all measurements */
 

-#ifdef CONFIG_IMA_AUDIT
-/* declarations */
-void integrity_audit_msg(int audit_msgno, struct inode *inode,
-                        const unsigned char *fname, const char *op,
-                        const char *cause, int result, int info);
-#else
-static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
-                                      const unsigned char *fname,
-                                      const char *op, const char *cause,
-                                      int result, int info)
-{
-}
-#endif
-

 /* Internal IMA function definitions */
 int ima_init(void);
 void ima_cleanup(void);
 /* Internal IMA function definitions */
 int ima_init(void);
 void ima_cleanup(void);

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 84c37c4db914ac46cd07adae4ee4040fe9446390..c42fb7a70dee78dfdf1ebbc5f1d3a43fb6c6c233 100644 (file)
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -113,5 +113,19 @@ static inline int asymmetric_verify(struct key *keyring, const char *sig,
 }
 #endif
 
 }
 #endif
 

+#ifdef CONFIG_INTEGRITY_AUDIT
+/* declarations */
+void integrity_audit_msg(int audit_msgno, struct inode *inode,
+                        const unsigned char *fname, const char *op,
+                        const char *cause, int result, int info);
+#else
+static inline void integrity_audit_msg(int audit_msgno, struct inode *inode,
+                                      const unsigned char *fname,
+                                      const char *op, const char *cause,
+                                      int result, int info)
+{
+}
+#endif
+

 /* set during initialization */
 extern int iint_initialized;
 /* set during initialization */
 extern int iint_initialized;

diff --git a/security/integrity/ima/ima_audit.c b/security/integrity/integrity_audit.c
similarity index 85%
rename from security/integrity/ima/ima_audit.c
rename to security/integrity/integrity_audit.c
index c586faae8fd6c7901baf6b37b3db0500157f8644..d7efb30404aaed01d860a5bf274477ce56e2e481 100644 (file)
--- a/security/integrity/ima/ima_audit.c
+++ b/security/integrity/integrity_audit.c
@@ -13,20 +13,20 @@
 #include <linux/fs.h>
 #include <linux/gfp.h>
 #include <linux/audit.h>
 #include <linux/fs.h>
 #include <linux/gfp.h>
 #include <linux/audit.h>

-#include "ima.h"
+#include "integrity.h"

 
 

-static int ima_audit;
+static int integrity_audit_info;

 
 /* ima_audit_setup - enable informational auditing messages */
 
 /* ima_audit_setup - enable informational auditing messages */

-static int __init ima_audit_setup(char *str)
+static int __init integrity_audit_setup(char *str)

 {
        unsigned long audit;
 
        if (!strict_strtoul(str, 0, &audit))
 {
        unsigned long audit;
 
        if (!strict_strtoul(str, 0, &audit))

-               ima_audit = audit ? 1 : 0;
+               integrity_audit_info = audit ? 1 : 0;

        return 1;
 }
        return 1;
 }

-__setup("ima_audit=", ima_audit_setup);
+__setup("integrity_audit=", integrity_audit_setup);

 
 void integrity_audit_msg(int audit_msgno, struct inode *inode,
                         const unsigned char *fname, const char *op,
 
 void integrity_audit_msg(int audit_msgno, struct inode *inode,
                         const unsigned char *fname, const char *op,


@@ -34,7 +34,7 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
 {
        struct audit_buffer *ab;
 
 {
        struct audit_buffer *ab;
 

-       if (!ima_audit && audit_info == 1) /* Skip informational messages */
+       if (!integrity_audit_info && audit_info == 1)   /* Skip info messages */

                return;
 
        ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);
                return;
 
        ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno);