[PATCH v3 07/10] ima: re-evaluate file integrity on file metadata change
Mimi Zohar
zohar at linux.ibm.com
Tue Mar 19 22:53:07 UTC 2024
> @@ -286,7 +288,8 @@ static int process_measurement(struct file *file, const
> struct cred *cred,
> }
>
> /*
> - * On stacked filesystems, detect and re-evaluate file data changes.
> + * On stacked filesystems, detect and re-evaluate file data and
> + * metadata changes.
> */
> real_inode = d_real_inode(file_dentry(file));
> if (real_inode != inode &&
> @@ -297,6 +300,15 @@ static int process_measurement(struct file *file, const
> struct cred *cred,
> iint->flags &= ~IMA_DONE_MASK;
> iint->measured_pcrs = 0;
> }
> +
> + /*
> + * Reset the EVM status when metadata changed.
> + */
-> To force re-validation, reset both the EVM and IMA status when the metadata
changes.
Mimi
> + metadata_inode = d_inode(d_real(file_dentry(file),
> + D_REAL_METADATA));
> + if (evm_metadata_changed(inode, metadata_inode))
> + iint->flags &= ~(IMA_APPRAISED |
> + IMA_APPRAISED_SUBMASK);
> }
>
> /* Determine if already appraised/measured based on bitmask
More information about the Linux-security-module-archive
mailing list