All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stefan Berger <stefanb@linux.ibm.com>
To: linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-unionfs@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, paul@paul-moore.com,
	jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com,
	roberto.sassu@huawei.com, amir73il@gmail.com, brauner@kernel.org,
	miklos@szeredi.hu, Stefan Berger <stefanb@linux.ibm.com>
Subject: [PATCH v2 9/9] ima: Record i_version of real_inode for change detection
Date: Mon,  5 Feb 2024 13:25:06 -0500	[thread overview]
Message-ID: <20240205182506.3569743-10-stefanb@linux.ibm.com> (raw)
In-Reply-To: <20240205182506.3569743-1-stefanb@linux.ibm.com>

process_measurement() will try to detect file content changes for not-yet-
copied-up files on a stacked filesystem based on the i_version number of
the real inode: !inode_eq_iversion(real_inode, iint->version)
Therefore, take a snapshot of the i_version of the real file to be used
for i_version number-based file content change detection by IMA in
process_meassurements().

In this case vfs_getattr_nosec() cannot be used since it will return the
i_version number of the file on the overlay layer which will trigger more
iint resets in process_measurements() than necessary since this i_version
number represents different state than that of the real_inode (of a
not-yet-copied up file).

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
 security/integrity/ima/ima_api.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 597ea0c4d72f..530888cc481e 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -14,6 +14,7 @@
 #include <linux/xattr.h>
 #include <linux/evm.h>
 #include <linux/fsverity.h>
+#include <linux/iversion.h>
 
 #include "ima.h"
 
@@ -250,7 +251,6 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
 	int result = 0;
 	int length;
 	void *tmpbuf;
-	u64 i_version = 0;
 
 	/*
 	 * Always collect the modsig, because IMA might have already collected
@@ -263,16 +263,6 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
 	if (iint->flags & IMA_COLLECTED)
 		goto out;
 
-	/*
-	 * Detecting file change is based on i_version. On filesystems
-	 * which do not support i_version, support was originally limited
-	 * to an initial measurement/appraisal/audit, but was modified to
-	 * assume the file changed.
-	 */
-	result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE,
-				   AT_STATX_SYNC_AS_STAT);
-	if (!result && (stat.result_mask & STATX_CHANGE_COOKIE))
-		i_version = stat.change_cookie;
 	hash.hdr.algo = algo;
 	hash.hdr.length = hash_digest_size[algo];
 
@@ -302,10 +292,22 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
 
 	iint->ima_hash = tmpbuf;
 	memcpy(iint->ima_hash, &hash, length);
-	iint->version = i_version;
-	if (real_inode != inode) {
+	if (real_inode == inode) {
+		/*
+		 * Detecting file change is based on i_version. On filesystems
+		 * which do not support i_version, support was originally limited
+		 * to an initial measurement/appraisal/audit, but was modified to
+		 * assume the file changed.
+		 */
+		result = vfs_getattr_nosec(&file->f_path, &stat,
+					   STATX_CHANGE_COOKIE,
+					   AT_STATX_SYNC_AS_STAT);
+		if (!result && (stat.result_mask & STATX_CHANGE_COOKIE))
+			iint->version = stat.change_cookie;
+	} else {
 		iint->real_ino = real_inode->i_ino;
 		iint->real_dev = real_inode->i_sb->s_dev;
+		iint->version = inode_query_iversion(real_inode);
 	}
 
 	/* Possibly temporary failure due to type of read (eg. O_DIRECT) */
-- 
2.43.0


  parent reply	other threads:[~2024-02-05 18:25 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-02-05 18:24 [PATCH v2 0/9] evm: Support signatures on stacked filesystem Stefan Berger
2024-02-05 18:24 ` [PATCH v2 1/9] ima: Rename backing_inode to real_inode Stefan Berger
2024-02-06 15:23   ` Amir Goldstein
2024-02-05 18:24 ` [PATCH v2 2/9] security: allow finer granularity in permitting copy-up of security xattrs Stefan Berger
2024-02-06 15:12   ` Amir Goldstein
2024-02-20 22:57   ` Paul Moore
2024-02-05 18:25 ` [PATCH v2 3/9] evm: Implement per signature type decision in security_inode_copy_up_xattr Stefan Berger
2024-02-05 18:25 ` [PATCH v2 4/9] ima: Reset EVM status upon detecting changes to the real file Stefan Berger
2024-02-06 12:38   ` kernel test robot
2024-02-06 15:44   ` Amir Goldstein
2024-02-07  5:04   ` kernel test robot
2024-02-05 18:25 ` [PATCH v2 5/9] evm: Use the inode holding the metadata to calculate metadata hash Stefan Berger
2024-02-06 15:33   ` Amir Goldstein
2024-02-06 18:22   ` kernel test robot
2024-02-05 18:25 ` [PATCH v2 6/9] evm: Enforce signatures on unsupported filesystem for EVM_INIT_X509 Stefan Berger
2024-02-05 18:25 ` [PATCH v2 7/9] fs: Rename SB_I_EVM_UNSUPPORTED to SB_I_EVM_HMAC_UNSUPPORTED Stefan Berger
2024-02-06 15:11   ` Amir Goldstein
2024-02-05 18:25 ` [PATCH v2 8/9] evm: Rename is_unsupported_fs to is_unsupported_hmac_fs Stefan Berger
2024-02-05 18:25 ` Stefan Berger [this message]
2024-02-06 15:23   ` [PATCH v2 9/9] ima: Record i_version of real_inode for change detection Amir Goldstein
2024-02-06 15:54     ` Jeff Layton
2024-02-13 23:14       ` Stefan Berger

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240205182506.3569743-10-stefanb@linux.ibm.com \
    --to=stefanb@linux.ibm.com \
    --cc=amir73il@gmail.com \
    --cc=brauner@kernel.org \
    --cc=jmorris@namei.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=linux-unionfs@vger.kernel.org \
    --cc=miklos@szeredi.hu \
    --cc=paul@paul-moore.com \
    --cc=roberto.sassu@huawei.com \
    --cc=serge@hallyn.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.