Received-SPF: pass (google.com: domain of linux-kernel+bounces-108210-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <6211c10334fa9f51c6aad827b14f322b09ec8760.camel@linux.ibm.com>
Subject: Re: [PATCH v3 07/10] ima: re-evaluate file integrity on file
 metadata change
From: Mimi Zohar <zohar@linux.ibm.com>
To: Stefan Berger <stefanb@linux.ibm.com>, linux-integrity@vger.kernel.org,
        linux-security-module@vger.kernel.org, linux-unionfs@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, paul@paul-moore.com, jmorris@namei.org,
        serge@hallyn.com, roberto.sassu@huawei.com, amir73il@gmail.com,
        brauner@kernel.org, miklos@szeredi.hu
Date: Tue, 19 Mar 2024 18:53:07 -0400
In-Reply-To: <20240223172513.4049959-8-stefanb@linux.ibm.com>
References: <20240223172513.4049959-1-stefanb@linux.ibm.com>
	 <20240223172513.4049959-8-stefanb@linux.ibm.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit

> @@ -286,7 +288,8 @@ static int process_measurement(struct file *file, const
> struct cred *cred,
>  	}
>  
>  	/*
> -	 * On stacked filesystems, detect and re-evaluate file data changes.
> +	 * On stacked filesystems, detect and re-evaluate file data and
> +	 * metadata changes.
>  	 */
>  	real_inode = d_real_inode(file_dentry(file));
>  	if (real_inode != inode &&
> @@ -297,6 +300,15 @@ static int process_measurement(struct file *file, const
> struct cred *cred,
>  			iint->flags &= ~IMA_DONE_MASK;
>  			iint->measured_pcrs = 0;
>  		}
> +
> +		/*
> +		 * Reset the EVM status when metadata changed.
> +		 */

-> To force re-validation, reset both the EVM and IMA status when the metadata
changes.

Mimi

> +		metadata_inode = d_inode(d_real(file_dentry(file),
> +					 D_REAL_METADATA));
> +		if (evm_metadata_changed(inode, metadata_inode))
> +			iint->flags &= ~(IMA_APPRAISED |
> +					 IMA_APPRAISED_SUBMASK);
>  	}
>  
>  	/* Determine if already appraised/measured based on bitmask