Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 523b74b1 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar
Browse files

evm: reset EVM status when file attributes change 



The EVM verification status is cached in iint->evm_status and if it
was successful, never re-verified again when IMA passes the 'iint' to
evm_verifyxattr().

When file attributes or extended attributes change, we may wish to
re-verify EVM integrity as well.  For example, after setting a digital
signature we may need to re-verify the signature and update the
iint->flags that there is an EVM signature.

This patch enables that by resetting evm_status to INTEGRITY_UKNOWN
state.

Changes in v2:
* Flag setting moved to EVM layer

Signed-off-by: default avatarDmitry Kasatkin <dmitry.kasatkin@huawei.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent 76266763

security/integrity/evm/evm_main.c

+13 −0
Original line number Diff line number Diff line
@@ -358,6 +358,15 @@ int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name) 
	return evm_protect_xattr(dentry, xattr_name, NULL, 0);

}



static void evm_reset_status(struct inode *inode)

{

	struct integrity_iint_cache *iint;



	iint = integrity_iint_find(inode);

	if (iint)

		iint->evm_status = INTEGRITY_UNKNOWN;

}



/**

 * evm_inode_post_setxattr - update 'security.evm' to reflect the changes

 * @dentry: pointer to the affected dentry
@@ -378,6 +387,8 @@ void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name, 
				 && !posix_xattr_acl(xattr_name)))

		return;



	evm_reset_status(dentry->d_inode);



	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);

}
@@ -396,6 +407,8 @@ void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name) 
	if (!evm_initialized || !evm_protected_xattr(xattr_name))

		return;



	evm_reset_status(dentry->d_inode);



	evm_update_evmxattr(dentry, xattr_name, NULL, 0);

}