Unverified Commit 0ddfc4b9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8255 IMA: Introduce a config for fix on IMA with Overlayfs issue 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xiang Yang <xiangyang3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/A7XZVI53AVVXBYUWS4XEDQDYW4RISJO2/ 
 
https://gitee.com/openeuler/kernel/issues/I9T6ZD 
 
Link:https://gitee.com/openeuler/kernel/pulls/8255

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 00379e5e a670a0ed

security/integrity/ima/Kconfig

+8 −0
Original line number Diff line number Diff line
@@ -368,3 +368,11 @@ config IMA_PARSER_BINARY_PATH 
	default "/usr/bin/upload_digest_lists"

	help

	   This option defines the path of the parser binary.



config IMA_FIX_OVERLAYFS_DETECTION

	bool

	default y

	help

	   This option enables the fix for overlayfs backing inode change

	   detection. With this config enabled, IMA would be detecting

	   backing inode changes through i_version of the backing inode.

security/integrity/ima/ima_main.c

+6 −0
Original line number Diff line number Diff line
@@ -267,7 +267,11 @@ static int process_measurement(struct file *file, const struct cred *cred, 
			       u32 secid, char *buf, loff_t size, int mask,

			       enum ima_hooks func)

{

#ifdef IMA_FIX_OVERLAYFS_DETECTION

	struct inode *backing_inode, *inode = file_inode(file);

#else

	struct inode *inode = file_inode(file);

#endif

	struct integrity_iint_cache *iint = NULL;

	struct ima_template_desc *template_desc = NULL;

	char *pathbuf = NULL;
@@ -344,6 +348,7 @@ static int process_measurement(struct file *file, const struct cred *cred, 
		iint->measured_pcrs = 0;

	}



#ifdef IMA_FIX_OVERLAYFS_DETECTION

	/* Detect and re-evaluate changes made to the backing file. */

	backing_inode = d_real_inode(file_dentry(file));

	if (backing_inode != inode &&
@@ -356,6 +361,7 @@ static int process_measurement(struct file *file, const struct cred *cred, 
			iint->measured_pcrs = 0;

		}

	}

#endif



	/* Determine if already appraised/measured based on bitmask

	 * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,