linux

iv/linux

History

Eric Snowberg 331d85f0bc ovl: Always reevaluate the file signature for IMA

[ Upstream commit 18b44bc5a67275641fb26f2c54ba7eef80ac5950 ]

Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version")
partially closed an IMA integrity issue when directly modifying a file
on the lower filesystem.  If the overlay file is first opened by a user
and later the lower backing file is modified by root, but the extended
attribute is NOT updated, the signature validation succeeds with the old
original signature.

Update the super_block s_iflags to SB_I_IMA_UNVERIFIABLE_SIGNATURE to
force signature reevaluation on every file access until a fine grained
solution can be found.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-09-19 12:20:05 +02:00

copy_up.c

ovl: update of dentry revalidate flags after copy up

2023-07-27 08:43:55 +02:00

dir.c

ovl: update of dentry revalidate flags after copy up

2023-07-27 08:43:55 +02:00

export.c

ovl: update of dentry revalidate flags after copy up

2023-07-27 08:43:55 +02:00

file.c

ovl: remove privs in ovl_fallocate()