From: Roberto Sassu <roberto.sassu@huawei.com>
To: <zohar@linux.ibm.com>, <mjg59@srcf.ucam.org>
Cc: <linux-integrity@vger.kernel.org>,
<linux-security-module@vger.kernel.org>,
<linux-kernel@vger.kernel.org>,
Roberto Sassu <roberto.sassu@huawei.com>
Subject: [PATCH v7 12/12] ima: Don't remove security.ima if file must not be appraised
Date: Fri, 14 May 2021 17:27:53 +0200 [thread overview]
Message-ID: <20210514152753.982958-13-roberto.sassu@huawei.com> (raw)
In-Reply-To: <20210514152753.982958-1-roberto.sassu@huawei.com>
Files might come from a remote source and might have xattrs, including
security.ima. It should not be IMA task to decide whether security.ima
should be kept or not. This patch removes the removexattr() system
call in ima_inode_post_setattr().
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
security/integrity/ima/ima_appraise.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index d9a627de3930..940695e7b535 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -532,8 +532,6 @@ void ima_inode_post_setattr(struct user_namespace *mnt_userns,
return;
action = ima_must_appraise(mnt_userns, inode, MAY_ACCESS, POST_SETATTR);
- if (!action)
- __vfs_removexattr(&init_user_ns, dentry, XATTR_NAME_IMA);
iint = integrity_iint_find(inode);
if (iint) {
set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
--
2.25.1
next prev parent reply other threads:[~2021-05-14 15:30 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-14 15:27 [PATCH v7 00/12] evm: Improve usability of portable signatures Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 01/12] evm: Execute evm_inode_init_security() only when an HMAC key is loaded Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 02/12] evm: Load EVM key in ima_load_x509() to avoid appraisal Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 03/12] evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 04/12] evm: Introduce evm_revalidate_status() Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 05/12] evm: Introduce evm_hmac_disabled() to safely ignore verification errors Roberto Sassu
2021-05-20 8:48 ` [RESEND][PATCH " Roberto Sassu
2021-05-20 8:51 ` Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 06/12] evm: Allow xattr/attr operations for portable signatures Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 07/12] evm: Pass user namespace to set/remove xattr hooks Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 08/12] evm: Allow setxattr() and setattr() for unmodified metadata Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 09/12] evm: Deprecate EVM_ALLOW_METADATA_WRITES Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 10/12] ima: Allow imasig requirement to be satisfied by EVM portable signatures Roberto Sassu
2021-05-14 15:27 ` [PATCH v7 11/12] ima: Introduce template field evmsig and write to field sig as fallback Roberto Sassu
2021-05-14 15:27 ` Roberto Sassu [this message]
2021-05-20 18:55 ` [PATCH v7 00/12] evm: Improve usability of portable signatures Mimi Zohar
2021-05-21 7:07 ` Roberto Sassu
2021-05-21 17:31 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210514152753.982958-13-roberto.sassu@huawei.com \
--to=roberto.sassu@huawei.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mjg59@srcf.ucam.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).