raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-10 20:09:56 +00:00
Code Issues Projects Releases Wiki Activity

ima: re-evaluate file integrity on file metadata change

Browse Source 
Force a file's integrity to be re-evaluated on file metadata change by
resetting both the IMA and EVM status flags.

Co-developed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Stefan Berger
2024-02-23 12:25:10 -05:00
committed by Mimi Zohar
parent a652aa5906
commit cd9b909a11
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
security/integrity/ima/ima_main.c
View File

@@ -26,6 +26,7 @@
#include <linux/ima.h> #include <linux/ima.h>
#include <linux/fs.h> #include <linux/fs.h>
#include <linux/iversion.h> #include <linux/iversion.h>
#include <linux/evm.h>
#include "ima.h" #include "ima.h"
@@ -211,6 +212,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
struct inode *real_inode, *inode = file_inode(file); struct inode *real_inode, *inode = file_inode(file);
struct ima_iint_cache *iint = NULL; struct ima_iint_cache *iint = NULL;
struct ima_template_desc *template_desc = NULL; struct ima_template_desc *template_desc = NULL;
struct inode *metadata_inode;
char *pathbuf = NULL; char *pathbuf = NULL;
char filename[NAME_MAX]; char filename[NAME_MAX];
const char *pathname = NULL; const char *pathname = NULL;
@@ -286,7 +288,8 @@ static int process_measurement(struct file *file, const struct cred *cred,
} }
/* /*
* On stacked filesystems, detect and re-evaluate file data changes. * On stacked filesystems, detect and re-evaluate file data and
* metadata changes.
*/ */
real_inode = d_real_inode(file_dentry(file)); real_inode = d_real_inode(file_dentry(file));
if (real_inode != inode && if (real_inode != inode &&
@@ -297,6 +300,15 @@ static int process_measurement(struct file *file, const struct cred *cred,
iint->flags &= ~IMA_DONE_MASK; iint->flags &= ~IMA_DONE_MASK;
iint->measured_pcrs = 0; iint->measured_pcrs = 0;
} }
/*
* Reset the EVM status when metadata changed.
*/
metadata_inode = d_inode(d_real(file_dentry(file),
D_REAL_METADATA));
if (evm_metadata_changed(inode, metadata_inode))
iint->flags &= ~(IMA_APPRAISED |
IMA_APPRAISED_SUBMASK);
} }
/* Determine if already appraised/measured based on bitmask /* Determine if already appraised/measured based on bitmask