Received-SPF: pass (google.com: domain of linux-kernel+bounces-142785-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Stefan Berger <stefanb@linux.ibm.com>
To: linux-integrity@vger.kernel.org, linux-unionfs@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, zohar@linux.ibm.com,
        roberto.sassu@huawei.com, amir73il@gmail.com, miklos@szeredi.hu,
        Stefan Berger <stefanb@linux.ibm.com>
Subject: [RFC 2/2] ima: Fix detection of read/write violations on stacked filesystems
Date: Fri, 12 Apr 2024 10:01:22 -0400
Message-ID: <20240412140122.2607743-3-stefanb@linux.ibm.com>
In-Reply-To: <20240412140122.2607743-1-stefanb@linux.ibm.com>
References: <20240412140122.2607743-1-stefanb@linux.ibm.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On a stacked filesystem, when one process opens the file holding a file's
data (e.g., on upper or lower layer on overlayfs) then issue a violation
when another process opens the file for reading on the top layer (overlay
layer on overlayfs). This then provides similar behavior to the existing
case where a violation is generated when one process opens a file for
writing and another one opens the same file for reading. On stacked
filesystem also search all the lower layers for relevant files opened for
writing and issue the violation if one is found.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
 security/integrity/ima/ima_main.c | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index f04f43af651c..590dd9d5d99a 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -121,8 +121,11 @@ static void ima_rdwr_violation_check(struct file *file,
 				     const char **pathname,
 				     char *filename)
 {
+	struct inode *real_inode = d_real_inode(file_dentry(file));
 	struct inode *inode = file_inode(file);
+	struct dentry *fd_dentry, *d;
 	fmode_t mode = file->f_mode;
+	struct inode *fd_inode;
 	bool send_tomtou = false, send_writers = false;
 
 	if (mode & FMODE_WRITE) {
@@ -134,11 +137,25 @@ static void ima_rdwr_violation_check(struct file *file,
 						&iint->atomic_flags))
 				send_tomtou = true;
 		}
-	} else {
-		if (must_measure)
-			set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);
-		if (inode_is_open_for_write(inode) && must_measure)
-			send_writers = true;
+	} else if (must_measure) {
+		set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);
+
+		if (inode == real_inode) {
+			if (inode_is_open_for_write(inode))
+				send_writers = true;
+		} else {
+			d = d_real(file_dentry(file), D_REAL_FILEDATA);
+			do {
+				fd_dentry = d;
+				fd_inode = d_inode(fd_dentry);
+				if (inode_is_open_for_write(fd_inode)) {
+					send_writers = true;
+					break;
+				}
+				/* next layer of stacked fs */
+				d = d_real(fd_dentry, D_REAL_FILEDATA);
+			} while (d != fd_dentry);
+		}
 	}
 
 	if (!send_tomtou && !send_writers)
-- 
2.43.0