ima_fs: don't bother with removal of files in directory we'll be removing

removal of parent takes all children out

Acked-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index e4a79a9b2d588478f595b83e68073aa06182dbac..88421e8895c447ca5a82b3dd210346dff6795a2e 100644 (file)
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -396,11 +396,6 @@ out:
 
 static struct dentry *ima_dir;
 static struct dentry *ima_symlink;
-static struct dentry *binary_runtime_measurements;
-static struct dentry *ascii_runtime_measurements;
-static struct dentry *runtime_measurements_count;
-static struct dentry *violations;
-static struct dentry *ima_policy;
 
 enum ima_fs_flags {
        IMA_FS_BUSY,
@@ -419,14 +414,7 @@ static const struct seq_operations ima_policy_seqops = {
 
 static void __init remove_securityfs_measurement_lists(struct dentry **lists)
 {
-       int i;
-
-       if (lists) {
-               for (i = 0; i < securityfs_measurement_list_count; i++)
-                       securityfs_remove(lists[i]);
-
-               kfree(lists);
-       }
+       kfree(lists);
 }
 
 static int __init create_securityfs_measurement_lists(void)
@@ -533,8 +521,7 @@ static int ima_release_policy(struct inode *inode, struct file *file)
 
        ima_update_policy();
 #if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY)
-       securityfs_remove(ima_policy);
-       ima_policy = NULL;
+       securityfs_remove(file->f_path.dentry);
 #elif defined(CONFIG_IMA_WRITE_POLICY)
        clear_bit(IMA_FS_BUSY, &ima_fs_flags);
 #elif defined(CONFIG_IMA_READ_POLICY)
@@ -553,6 +540,7 @@ static const struct file_operations ima_measure_policy_ops = {
 
 int __init ima_fs_init(void)
 {
+       struct dentry *dentry;
        int ret;
 
        ascii_securityfs_measurement_lists = NULL;
@@ -573,54 +561,45 @@ int __init ima_fs_init(void)
        if (ret != 0)
                goto out;
 
-       binary_runtime_measurements =
-           securityfs_create_symlink("binary_runtime_measurements", ima_dir,
+       dentry = securityfs_create_symlink("binary_runtime_measurements", ima_dir,
                                      "binary_runtime_measurements_sha1", NULL);
-       if (IS_ERR(binary_runtime_measurements)) {
-               ret = PTR_ERR(binary_runtime_measurements);
+       if (IS_ERR(dentry)) {
+               ret = PTR_ERR(dentry);
                goto out;
        }
 
-       ascii_runtime_measurements =
-           securityfs_create_symlink("ascii_runtime_measurements", ima_dir,
+       dentry = securityfs_create_symlink("ascii_runtime_measurements", ima_dir,
                                      "ascii_runtime_measurements_sha1", NULL);
-       if (IS_ERR(ascii_runtime_measurements)) {
-               ret = PTR_ERR(ascii_runtime_measurements);
+       if (IS_ERR(dentry)) {
+               ret = PTR_ERR(dentry);
                goto out;
        }
 
-       runtime_measurements_count =
-           securityfs_create_file("runtime_measurements_count",
+       dentry = securityfs_create_file("runtime_measurements_count",
                                   S_IRUSR | S_IRGRP, ima_dir, NULL,
                                   &ima_measurements_count_ops);
-       if (IS_ERR(runtime_measurements_count)) {
-               ret = PTR_ERR(runtime_measurements_count);
+       if (IS_ERR(dentry)) {
+               ret = PTR_ERR(dentry);
                goto out;
        }
 
-       violations =
-           securityfs_create_file("violations", S_IRUSR | S_IRGRP,
+       dentry = securityfs_create_file("violations", S_IRUSR | S_IRGRP,
                                   ima_dir, NULL, &ima_htable_violations_ops);
-       if (IS_ERR(violations)) {
-               ret = PTR_ERR(violations);
+       if (IS_ERR(dentry)) {
+               ret = PTR_ERR(dentry);
                goto out;
        }
 
-       ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS,
+       dentry = securityfs_create_file("policy", POLICY_FILE_FLAGS,
                                            ima_dir, NULL,
                                            &ima_measure_policy_ops);
-       if (IS_ERR(ima_policy)) {
-               ret = PTR_ERR(ima_policy);
+       if (IS_ERR(dentry)) {
+               ret = PTR_ERR(dentry);
                goto out;
        }
 
        return 0;
 out:
-       securityfs_remove(ima_policy);
-       securityfs_remove(violations);
-       securityfs_remove(runtime_measurements_count);
-       securityfs_remove(ascii_runtime_measurements);
-       securityfs_remove(binary_runtime_measurements);
        remove_securityfs_measurement_lists(ascii_securityfs_measurement_lists);
        remove_securityfs_measurement_lists(binary_securityfs_measurement_lists);
        securityfs_measurement_list_count = 0;