[PATCH] ima: setting security.ima to fix security.evm for a file with IMA signature

[Coiby Xu]

When both IMA and EVM fix modes are enabled, accessing a file with IMA
signature won't cause security.evm to be fixed. But this doesn't happen
to a file with correct IMA hash already set because accessing it will
cause setting security.ima again which triggers fixing security.evm
thanks to security_inode_post_setxattr->evm_update_evmxattr.

Let's use the same mechanism to fix security.evm for a file with IMA
signature.

Signed-off-by: Coiby Xu <coxu at redhat.com>
---
 security/integrity/ima/ima_appraise.c | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index f435eff4667f..18c3907c5e44 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -595,12 +595,27 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
 		integrity_audit_msg(audit_msgno, inode, filename,
 				    op, cause, rc, 0);
 	} else if (status != INTEGRITY_PASS) {
-		/* Fix mode, but don't replace file signatures. */
-		if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig &&
-		    (!xattr_value ||
-		     xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
-			if (!ima_fix_xattr(dentry, iint))
-				status = INTEGRITY_PASS;
+		/*
+		 * Fix mode, but don't replace file signatures.
+		 *
+		 * When EVM fix mode is also enabled, security.evm will be
+		 * fixed automatically when security.ima is set because of
+		 * security_inode_post_setxattr->evm_update_evmxattr.
+		 */
+		if ((ima_appraise & IMA_APPRAISE_FIX) && !try_modsig) {
+			if (!xattr_value ||
+			    xattr_value->type != EVM_IMA_XATTR_DIGSIG) {
+				if (ima_fix_xattr(dentry, iint))
+					status = INTEGRITY_PASS;
+			} else if (xattr_value->type == EVM_IMA_XATTR_DIGSIG &&
+				   evm_revalidate_status(XATTR_NAME_IMA)) {
+				if (!__vfs_setxattr_noperm(&nop_mnt_idmap,
+							   dentry,
+							   XATTR_NAME_IMA,
+							   xattr_value,
+							   xattr_len, 0))
+					status = INTEGRITY_PASS;
+			}
 		}
 
 		/*

base-commit: b320789d6883cc00ac78ce83bccbfe7ed58afcf0
-- 
2.51.0