Skip to content
Commit 42a4c603 authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: fix ima_inode_post_setattr



Changing file metadata (eg. uid, guid) could result in having to
re-appraise a file's integrity, but does not change the "new file"
status nor the security.ima xattr.  The IMA_PERMIT_DIRECTIO and
IMA_DIGSIG_REQUIRED flags are policy rule specific.  This patch
only resets these flags, not the IMA_NEW_FILE or IMA_DIGSIG flags.

With this patch, changing the file timestamp will not remove the
file signature on new files.

Reported-by: default avatarDmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Tested-by: default avatarDmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
parent 39d637af
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment