)]}'
{
  "commit": "f9b2a735bdddf836214b5dca74f6ca7712e5a08c",
  "tree": "c4793e07a83230143e3490dc274ad2c9883d980c",
  "parents": [
    "ed1c96429a6aa6ffd8c4ee3e80bcde28aad270bc"
  ],
  "author": {
    "name": "Mimi Zohar",
    "email": "zohar@linux.vnet.ibm.com",
    "time": "Mon May 12 09:28:11 2014 -0400"
  },
  "committer": {
    "name": "Serge Hallyn",
    "email": "serge.hallyn@ubuntu.com",
    "time": "Tue Jun 03 14:21:50 2014 -0500"
  },
  "message": "ima: audit log files opened with O_DIRECT flag\n\nFiles are measured or appraised based on the IMA policy.  When a\nfile, in policy, is opened with the O_DIRECT flag, a deadlock\noccurs.\n\nThe first attempt at resolving this lockdep temporarily removed the\nO_DIRECT flag and restored it, after calculating the hash.  The\nsecond attempt introduced the O_DIRECT_HAVELOCK flag. Based on this\nflag, do_blockdev_direct_IO() would skip taking the i_mutex a second\ntime.  The third attempt, by Dmitry Kasatkin, resolves the i_mutex\nlocking issue, by re-introducing the IMA mutex, but uncovered\nanother problem.  Reading a file with O_DIRECT flag set, writes\ndirectly to userspace pages.  A second patch allocates a user-space\nlike memory.  This works for all IMA hooks, except ima_file_free(),\nwhich is called on __fput() to recalculate the file hash.\n\nUntil this last issue is addressed, do not \u0027collect\u0027 the\nmeasurement for measuring, appraising, or auditing files opened\nwith the O_DIRECT flag set.  Based on policy, permit or deny file\naccess.  This patch defines a new IMA policy rule option named\n\u0027permit_directio\u0027.  Policy rules could be defined, based on LSM\nor other criteria, to permit specific applications to open files\nwith the O_DIRECT flag set.\n\nChangelog v1:\n- permit or deny file access based IMA policy rules\n\nSigned-off-by: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nAcked-by: Dmitry Kasatkin \u003cd.kasatkin@samsung.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f1c5cc9d17a87def20095fb1ead651bc5887cf00",
      "old_mode": 33188,
      "old_path": "Documentation/ABI/testing/ima_policy",
      "new_id": "4c3efe4348060a10d1282059967b3725f5f41e34",
      "new_mode": 33188,
      "new_path": "Documentation/ABI/testing/ima_policy"
    },
    {
      "type": "modify",
      "old_id": "ba9e4d792dd577acd3662ade0928b55fdc02d21b",
      "old_mode": 33188,
      "old_path": "security/integrity/ima/ima_api.c",
      "new_id": "d9cd5ce14d2be3a341e9046213dfe6bb2b4c1306",
      "new_mode": 33188,
      "new_path": "security/integrity/ima/ima_api.c"
    },
    {
      "type": "modify",
      "old_id": "52ac6cf41f880bec8360f42a6526213117bdbc43",
      "old_mode": 33188,
      "old_path": "security/integrity/ima/ima_main.c",
      "new_id": "dcc98cf542d83fb4768ff3bd2ec113c204c7ecb6",
      "new_mode": 33188,
      "new_path": "security/integrity/ima/ima_main.c"
    },
    {
      "type": "modify",
      "old_id": "93873a450ff720ff47bf5ec92b23b179bb0628dd",
      "old_mode": 33188,
      "old_path": "security/integrity/ima/ima_policy.c",
      "new_id": "40a7488f6721b15a70ea0677dce5e10503b9e7b8",
      "new_mode": 33188,
      "new_path": "security/integrity/ima/ima_policy.c"
    },
    {
      "type": "modify",
      "old_id": "2fb5e53e927f2bf5432a34af1251c89f359d90f7",
      "old_mode": 33188,
      "old_path": "security/integrity/integrity.h",
      "new_id": "33c0a70f6b15a66a7b024aa8fbb534d72c76c898",
      "new_mode": 33188,
      "new_path": "security/integrity/integrity.h"
    }
  ]
}