Re: [PATCH v3 0/2] ima/evm fixes for v5.2

From: Janne Karhunen <janne.karhunen@gmail.com>
To: Roberto Sassu <roberto.sassu@huawei.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>,
	dmitry.kasatkin@huawei.com, mjg59@google.com,
	linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	silviu.vlasceanu@huawei.com
Subject: Re: [PATCH v3 0/2] ima/evm fixes for v5.2
Date: Thu, 13 Jun 2019 11:04:42 +0300	[thread overview]
Message-ID: <CAE=NcraD_DcSqog8XbisA+0YdNqwj0v_jZhzjR2Na0eZ-2XgJQ@mail.gmail.com> (raw)
In-Reply-To: <3911846b-f836-592a-81e1-a2fd25470d98@huawei.com>

On Thu, Jun 13, 2019 at 10:50 AM Roberto Sassu <roberto.sassu@huawei.com> wrote:

> > Would the appraise actually need any changes, just keep the
> > IMA_NEW_FILE in ima_check_last_writer()? Of course it's not that easy
> > (it never is) as the iint could go away and things like that, but with
> > some tweaks?
>
> I think the problem would be that the code that sets the status to
> INTEGRITY_PASS is not executed, because the file gets security.ima after
> the first write.

We have a patchset coming shortly that starts tracking the inode
changes as we go, so first time we fix it is when the file is created
before it has any content (!);

diff --git a/security/integrity/ima/ima_appraise.c
b/security/integrity/ima/ima_appraise.c
index 5fb7127bbe68..da4f0afe0348 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -236,8 +236,10 @@ int ima_appraise_measurement(enum ima_hooks func,
                        iint->flags |= IMA_NEW_FILE;
                if ((iint->flags & IMA_NEW_FILE) &&
                    (!(iint->flags & IMA_DIGSIG_REQUIRED) ||
-                    (inode->i_size == 0)))
+                    (inode->i_size == 0))) {
+                       ima_fix_xattr(dentry, iint);
                        status = INTEGRITY_PASS;
+               }
                goto out;
        }



--
Janne
