summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorStefan Berger <stefanb@linux.ibm.com>2024-02-23 12:25:10 -0500
committerMimi Zohar <zohar@linux.ibm.com>2024-04-09 17:14:57 -0400
commitcd9b909a117210bfd77a89bb06a3154c1fc51b51 (patch)
treee258bd0296c3401b5ab9352bb282ad0ad14b96cd /security
parenta652aa59068bd78d96a1ab6ea7c0c4d3c79fb5e8 (diff)
ima: re-evaluate file integrity on file metadata change
Force a file's integrity to be re-evaluated on file metadata change by resetting both the IMA and EVM status flags. Co-developed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'security')
-rw-r--r--security/integrity/ima/ima_main.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 4b215d85c14b..f04f43af651c 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -26,6 +26,7 @@
#include <linux/ima.h>
#include <linux/fs.h>
#include <linux/iversion.h>
+#include <linux/evm.h>
#include "ima.h"
@@ -211,6 +212,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
struct inode *real_inode, *inode = file_inode(file);
struct ima_iint_cache *iint = NULL;
struct ima_template_desc *template_desc = NULL;
+ struct inode *metadata_inode;
char *pathbuf = NULL;
char filename[NAME_MAX];
const char *pathname = NULL;
@@ -286,7 +288,8 @@ static int process_measurement(struct file *file, const struct cred *cred,
}
/*
- * On stacked filesystems, detect and re-evaluate file data changes.
+ * On stacked filesystems, detect and re-evaluate file data and
+ * metadata changes.
*/
real_inode = d_real_inode(file_dentry(file));
if (real_inode != inode &&
@@ -297,6 +300,15 @@ static int process_measurement(struct file *file, const struct cred *cred,
iint->flags &= ~IMA_DONE_MASK;
iint->measured_pcrs = 0;
}
+
+ /*
+ * Reset the EVM status when metadata changed.
+ */
+ metadata_inode = d_inode(d_real(file_dentry(file),
+ D_REAL_METADATA));
+ if (evm_metadata_changed(inode, metadata_inode))
+ iint->flags &= ~(IMA_APPRAISED |
+ IMA_APPRAISED_SUBMASK);
}
/* Determine if already appraised/measured based on bitmask