security/integrity/ima/ima_fs.c
Source file repositories/reference/linux-study-clean/security/integrity/ima/ima_fs.c
File Facts
- System
- Linux kernel
- Corpus path
security/integrity/ima/ima_fs.c- Extension
.c- Size
- 20780 bytes
- Lines
- 850
- Domain
- Core OS
- Bucket
- Security And Isolation
- Inferred role
- Core OS: operation-table or driver-model contract
- Status
- pattern implementation candidate
Why This File Exists
Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Defines an operation table; this is where Linux turns generic core objects into subsystem-specific behavior.
- Touches user memory; correctness depends on fault-safe copying and privilege boundary handling.
- Uses kernel synchronization; read lock ordering, sleepability, and interrupt context assumptions before translating.
- Allocates kernel memory; connect allocation flags and lifetime to context constraints.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
linux/fcntl.hlinux/kernel_read_file.hlinux/slab.hlinux/init.hlinux/seq_file.hlinux/rculist.hlinux/rcupdate.hlinux/parser.hlinux/vmalloc.hima.h
Detected Declarations
enum ima_fs_flagsfunction default_canonical_fmt_setupfunction ima_show_counterfunction ima_show_num_violationsfunction ima_show_measurements_countfunction ima_measurements_stopfunction ima_measurements_showfunction ima_measure_lockfunction ima_measure_unlockfunction _ima_measurements_openfunction ima_measurements_openfunction ima_measurements_releasefunction ima_measurements_staged_openfunction _ima_measurements_writefunction ima_measurements_writefunction ima_measurements_staged_writefunction ima_print_digestfunction ima_ascii_measurements_showfunction ima_ascii_measurements_openfunction ima_ascii_measurements_staged_openfunction ima_read_policyfunction ima_write_policyfunction create_securityfs_measurement_listsfunction create_securityfs_staging_linksfunction ima_open_policyfunction ima_release_policyfunction ima_fs_init
Annotated Snippet
static const struct file_operations ima_num_violations_ops = {
.read = ima_show_num_violations,
.llseek = generic_file_llseek,
};
static ssize_t ima_show_measurements_count(struct file *filp,
char __user *buf,
size_t count, loff_t *ppos)
{
return ima_show_counter(buf, count, ppos, &ima_num_records[BINARY]);
}
static const struct file_operations ima_measurements_count_ops = {
.read = ima_show_measurements_count,
.llseek = generic_file_llseek,
};
/* returns pointer to hlist_node */
static void *_ima_measurements_start(struct seq_file *m, loff_t *pos,
struct list_head *head)
{
loff_t l = *pos;
struct ima_queue_entry *qe;
/* we need a lock since pos could point beyond last element */
rcu_read_lock();
list_for_each_entry_rcu(qe, head, later) {
if (!l--) {
rcu_read_unlock();
return qe;
}
}
rcu_read_unlock();
return NULL;
}
static void *ima_measurements_start(struct seq_file *m, loff_t *pos)
{
return _ima_measurements_start(m, pos, &ima_measurements);
}
static void *ima_measurements_staged_start(struct seq_file *m, loff_t *pos)
{
return _ima_measurements_start(m, pos, &ima_measurements_staged);
}
static void *_ima_measurements_next(struct seq_file *m, void *v, loff_t *pos,
struct list_head *head)
{
struct ima_queue_entry *qe = v;
/* lock protects when reading beyond last element
* against concurrent list-extension
*/
rcu_read_lock();
qe = list_entry_rcu(qe->later.next, struct ima_queue_entry, later);
rcu_read_unlock();
(*pos)++;
return (&qe->later == head) ? NULL : qe;
}
static void *ima_measurements_next(struct seq_file *m, void *v, loff_t *pos)
{
return _ima_measurements_next(m, v, pos, &ima_measurements);
}
static void *ima_measurements_staged_next(struct seq_file *m, void *v,
loff_t *pos)
{
return _ima_measurements_next(m, v, pos, &ima_measurements_staged);
}
static void ima_measurements_stop(struct seq_file *m, void *v)
{
}
void ima_putc(struct seq_file *m, void *data, int datalen)
{
while (datalen--)
seq_putc(m, *(char *)data++);
}
/* print format:
* 32bit-le=pcr#
* char[n]=template digest
* 32bit-le=template name size
* char[n]=template name
* [eventdata length]
* eventdata[n]=template specific data
Annotation
- Immediate include surface: `linux/fcntl.h`, `linux/kernel_read_file.h`, `linux/slab.h`, `linux/init.h`, `linux/seq_file.h`, `linux/rculist.h`, `linux/rcupdate.h`, `linux/parser.h`.
- Detected declarations: `enum ima_fs_flags`, `function default_canonical_fmt_setup`, `function ima_show_counter`, `function ima_show_num_violations`, `function ima_show_measurements_count`, `function ima_measurements_stop`, `function ima_measurements_show`, `function ima_measure_lock`, `function ima_measure_unlock`, `function _ima_measurements_open`.
- Atlas domain: Core OS / Security And Isolation.
- Implementation status: pattern implementation candidate.
- This snippet crosses the user/kernel memory boundary; validate fault handling and access checks before translating the pattern.
- Synchronization appears in or near this file; preserve lock ordering, sleepability, and interrupt-context constraints.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.