From: Andrew Morton Cc: Kylene Hall Cc: Mimi Zohar Cc: Mimi Zohar Signed-off-by: Andrew Morton --- security/evm/evm_secfs.c | 1 - security/evm/ima/ima.h | 3 +-- security/evm/ima/ima_fs.c | 17 ++++++----------- security/evm/ima/ima_init.c | 10 +++++----- security/evm/ima/ima_queue.c | 10 +++++----- 5 files changed, 17 insertions(+), 24 deletions(-) diff -puN security/evm/evm_secfs.c~integrity-ima-integrity_measure-support-tidy security/evm/evm_secfs.c --- a/security/evm/evm_secfs.c~integrity-ima-integrity_measure-support-tidy +++ a/security/evm/evm_secfs.c @@ -103,7 +103,6 @@ static ssize_t evm_write_secfs(struct fi size_t rc = buflen; char *data; int error; - struct evm_xattr_config *evm_data = NULL; int evm_datasize; diff -puN security/evm/ima/ima.h~integrity-ima-integrity_measure-support-tidy security/evm/ima/ima.h --- a/security/evm/ima/ima.h~integrity-ima-integrity_measure-support-tidy +++ a/security/evm/ima/ima.h @@ -97,8 +97,7 @@ static inline void ima_pcrread(int idx, if (!ima_used_chip) return; - if (tpm_pcr_read(IMA_TPM, idx, pcr, pcr_size) != 0) { + if (tpm_pcr_read(IMA_TPM, idx, pcr, pcr_size) != 0) ima_error("Error Communicating to TPM chip\n"); - } } #endif diff -puN security/evm/ima/ima_fs.c~integrity-ima-integrity_measure-support-tidy security/evm/ima/ima_fs.c --- a/security/evm/ima/ima_fs.c~integrity-ima-integrity_measure-support-tidy +++ a/security/evm/ima/ima_fs.c @@ -172,7 +172,6 @@ static struct file_operations ima_measur .release = seq_release, }; - /* print in ascii */ static int ima_ascii_measurements_show(struct seq_file *m, void *v) { @@ -221,21 +220,18 @@ static struct file_operations ima_ascii_ .release = seq_release, }; -static struct dentry - *ima_dir = NULL, - *binary_runtime_measurements = NULL, - *ascii_runtime_measurements = NULL, - *runtime_measurements_count = NULL, - *violations = NULL; +static struct dentry *ima_dir; +static struct dentry *binary_runtime_measurements; +static struct dentry *ascii_runtime_measurements; +static struct dentry *runtime_measurements_count; +static struct dentry *violations; int ima_fs_init(void) { - ima_dir = securityfs_create_dir("ima", NULL); if (!ima_dir || IS_ERR(ima_dir)) return -1; - binary_runtime_measurements = securityfs_create_file("binary_runtime_measurements", S_IRUSR | S_IRGRP, ima_dir, NULL, @@ -265,13 +261,12 @@ int ima_fs_init(void) goto out; return 0; - out: securityfs_remove(runtime_measurements_count); securityfs_remove(ascii_runtime_measurements); securityfs_remove(binary_runtime_measurements); securityfs_remove(ima_dir); - return -1; + return -1; } void __exit ima_fs_cleanup(void) diff -puN security/evm/ima/ima_init.c~integrity-ima-integrity_measure-support-tidy security/evm/ima/ima_init.c --- a/security/evm/ima/ima_init.c~integrity-ima-integrity_measure-support-tidy +++ a/security/evm/ima/ima_init.c @@ -21,9 +21,9 @@ /* name for boot aggregate entry */ static char *boot_aggregate_name = "boot_aggregate"; static const char version[] = "v7.6 02/27/2007"; -static const char illegal_pcr[20] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; +static const char illegal_pcr[20]; -int ima_used_chip = 0; +int ima_used_chip; static void ima_add_boot_aggregate(void) { @@ -33,8 +33,7 @@ static void ima_add_boot_aggregate(void) int err; /* create new entry for boot aggregate */ - entry = (struct measure_entry *) - kzalloc(sizeof(struct measure_entry), GFP_ATOMIC); + entry = kzalloc(sizeof(struct measure_entry), GFP_ATOMIC); if (entry == NULL) { ima_invalidate_pcr("error allocating new measurement entry"); return; @@ -101,7 +100,8 @@ int ima_init(void) ima_used_chip = 1; if (!ima_used_chip) - ima_info("No TPM chip found(rc = %d), activating TPM-bypass!\n", rc); + ima_info("No TPM chip found(rc = %d), activating TPM-bypass!\n", + rc); create_htable(); /* for measurements */ diff -puN security/evm/ima/ima_queue.c~integrity-ima-integrity_measure-support-tidy security/evm/ima/ima_queue.c --- a/security/evm/ima/ima_queue.c~integrity-ima-integrity_measure-support-tidy +++ a/security/evm/ima/ima_queue.c @@ -32,7 +32,7 @@ DEFINE_SPINLOCK(ima_queue_lock); * and extending the TPM PCR aggregate. Since tpm_extend can take * long (and the tpm driver uses a mutex), we can't use the spinlock. */ -static DECLARE_MUTEX(ima_extend_list_mutex); +static DEFINE_MUTEX(ima_extend_list_mutex); void create_htable(void) { @@ -49,7 +49,7 @@ void create_htable(void) atomic_set(&ima_htable.queue_len[i], 0); } - init_MUTEX(&ima_extend_list_mutex); + mutex_init(&ima_extend_list_mutex); spin_unlock(&ima_queue_lock); } @@ -95,7 +95,7 @@ int ima_add_measure_entry(struct measure struct queue_entry *qe; int error = 0; - down(&ima_extend_list_mutex); + mutex_lock(&ima_extend_list_mutex); spin_lock(&ima_queue_lock); if (ima_lookup_digest_entry(entry->digest)) { error = -EEXIST; @@ -122,7 +122,7 @@ int ima_add_measure_entry(struct measure } spin_unlock(&ima_queue_lock); ima_extend(entry->digest); - out: - up(&ima_extend_list_mutex); +out: + mutex_unlock(&ima_extend_list_mutex); return error; } _