1 files changed, 0 insertions, 145 deletions
diff --git a/ima-allow-it-to-be-completely-disabled-and-default-off.patch b/ima-allow-it-to-be-completely-disabled-and-default-off.patch
deleted file mode 100644
index 4f8f1f18..00000000
--- a/ima-allow-it-to-be-completely-disabled-and-default-off.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From 785465d9cffd65b5a69dd2f465d2f7c917713220 Mon Sep 17 00:00:00 2001
-From: Kyle McMartin <kyle@mcmartin.ca>
-Date: Mon, 18 Oct 2010 13:30:39 -0400
-Subject: [PATCH] ima: provide a toggle to disable it entirely
-
-Signed-off-by: Kyle McMartin <kyle@redhat.com>
----
- security/integrity/ima/ima.h      |    1 +
- security/integrity/ima/ima_iint.c |    9 +++++++++
- security/integrity/ima/ima_main.c |   24 +++++++++++++++++++++---
- 3 files changed, 31 insertions(+), 3 deletions(-)
-
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index 3fbcd1d..65c3977 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -37,6 +37,7 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
- /* set during initialization */
- extern int iint_initialized;
- extern int ima_initialized;
-+extern int ima_enabled;
- extern int ima_used_chip;
- extern char *ima_hash;
- 
-diff --git a/security/integrity/ima/ima_iint.c b/security/integrity/ima/ima_iint.c
-index afba4ae..3d191ef 100644
---- a/security/integrity/ima/ima_iint.c
-+++ b/security/integrity/ima/ima_iint.c
-@@ -54,6 +54,9 @@ int ima_inode_alloc(struct inode *inode)
- 	struct ima_iint_cache *iint = NULL;
- 	int rc = 0;
- 
-+	if (!ima_enabled)
-+		return 0;
-+
- 	iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
- 	if (!iint)
- 		return -ENOMEM;
-@@ -116,6 +119,9 @@ void ima_inode_free(struct inode *inode)
- {
- 	struct ima_iint_cache *iint;
- 
-+	if (!ima_enabled)
-+		return;
-+
- 	spin_lock(&ima_iint_lock);
- 	iint = radix_tree_delete(&ima_iint_store, (unsigned long)inode);
- 	spin_unlock(&ima_iint_lock);
-@@ -139,6 +145,9 @@ static void init_once(void *foo)
- 
- static int __init ima_iintcache_init(void)
- {
-+	if (!ima_enabled)
-+		return 0;
-+
- 	iint_cache =
- 	    kmem_cache_create("iint_cache", sizeof(struct ima_iint_cache), 0,
- 			      SLAB_PANIC, init_once);
-diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
-index e662b89..6e91905 100644
---- a/security/integrity/ima/ima_main.c
-+++ b/security/integrity/ima/ima_main.c
-@@ -26,6 +26,7 @@
- #include "ima.h"
- 
- int ima_initialized;
-+int ima_enabled;
- 
- char *ima_hash = "sha1";
- static int __init hash_setup(char *str)
-@@ -36,6 +37,14 @@ static int __init hash_setup(char *str)
- }
- __setup("ima_hash=", hash_setup);
- 
-+static int __init ima_enable(char *str)
-+{
-+	if (strncmp(str, "on", 2) == 0)
-+		ima_enabled = 1;
-+	return 1;
-+}
-+__setup("ima=", ima_enable);
-+
- struct ima_imbalance {
- 	struct hlist_node node;
- 	unsigned long fsmagic;
-@@ -148,7 +157,7 @@ void ima_counts_get(struct file *file)
- 	struct ima_iint_cache *iint;
- 	int rc;
- 
--	if (!iint_initialized || !S_ISREG(inode->i_mode))
-+	if (!ima_enabled || !iint_initialized || !S_ISREG(inode->i_mode))
- 		return;
- 	iint = ima_iint_find_get(inode);
- 	if (!iint)
-@@ -215,7 +224,7 @@ void ima_file_free(struct file *file)
- 	struct inode *inode = file->f_dentry->d_inode;
- 	struct ima_iint_cache *iint;
- 
--	if (!iint_initialized || !S_ISREG(inode->i_mode))
-+	if (!ima_enabled || !iint_initialized || !S_ISREG(inode->i_mode))
- 		return;
- 	iint = ima_iint_find_get(inode);
- 	if (!iint)
-@@ -269,7 +278,7 @@ int ima_file_mmap(struct file *file, unsigned long prot)
- {
- 	int rc;
- 
--	if (!file)
-+	if (!ima_enabled || !file)
- 		return 0;
- 	if (prot & PROT_EXEC)
- 		rc = process_measurement(file, file->f_dentry->d_name.name,
-@@ -294,6 +303,9 @@ int ima_bprm_check(struct linux_binprm *bprm)
- {
- 	int rc;
- 
-+	if (!ima_enabled)
-+		return 0;
-+
- 	rc = process_measurement(bprm->file, bprm->filename,
- 				 MAY_EXEC, BPRM_CHECK);
- 	return 0;
-@@ -313,6 +325,9 @@ int ima_file_check(struct file *file, int mask)
- {
- 	int rc;
- 
-+	if (!ima_enabled)
-+		return 0;
-+
- 	rc = process_measurement(file, file->f_dentry->d_name.name,
- 				 mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
- 				 FILE_CHECK);
-@@ -324,6 +339,9 @@ static int __init init_ima(void)
- {
- 	int error;
- 
-+	if (!ima_enabled)
-+		return 0;
-+
- 	error = ima_init();
- 	ima_initialized = 1;
- 	return error;
--- 
-1.7.3.1
-