[systemd-commits] src/core

[David Herrmann]

 src/core/ima-setup.c |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

New commits:
commit 116b6c8687e1da25fcecf80ba6ac16866e308d50
Author: Zbigniew Jędrzejewski-Szmek <zbyszek at in.waw.pl>
Date:   Mon Jun 1 10:33:48 2015 -0400

    Partially revert "ma-setup: simplify"
    
    copy_bytes() tries to do the write in chunks, but ima kernel code
    needs every rule to be written in one write. Writing the whole file
    at once avoids the issue.
    
    http://lists.freedesktop.org/archives/systemd-devel/2015-June/032623.html
    http://sourceforge.net/p/linux-ima/mailman/message/34145236/
    https://bugzilla.redhat.com/show_bug.cgi?id=1226948

diff --git a/src/core/ima-setup.c b/src/core/ima-setup.c
index 7721b3e..4d8b638 100644
--- a/src/core/ima-setup.c
+++ b/src/core/ima-setup.c
@@ -24,9 +24,10 @@
 #include <unistd.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
 
 #include "ima-setup.h"
-#include "copy.h"
 #include "util.h"
 #include "log.h"
 
@@ -39,6 +40,8 @@ int ima_setup(void) {
 
 #ifdef HAVE_IMA
         _cleanup_close_ int policyfd = -1, imafd = -1;
+        struct stat st;
+        char *policy;
 
         if (access(IMA_SECFS_DIR, F_OK) < 0) {
                 log_debug("IMA support is disabled in the kernel, ignoring.");
@@ -63,12 +66,20 @@ int ima_setup(void) {
                 return 0;
         }
 
-        r = copy_bytes(policyfd, imafd, (off_t) -1, false);
+        if (fstat(policyfd, &st) < 0)
+                return log_error_errno(errno, "Failed to fstat "IMA_POLICY_PATH": %m");
+
+        policy = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, policyfd, 0);
+        if (policy == MAP_FAILED)
+                return log_error_errno(errno, "Failed to mmap "IMA_POLICY_PATH": %m");
+
+        r = loop_write(imafd, policy, (size_t) st.st_size, false);
         if (r < 0)
                 log_error_errno(r, "Failed to load the IMA custom policy file "IMA_POLICY_PATH": %m");
         else
                 log_info("Successfully loaded the IMA custom policy "IMA_POLICY_PATH".");
 
+        munmap(policy, st.st_size);
 #endif /* HAVE_IMA */
         return r;
 }