From: Stefan Berger <stefanb@linux.ibm.com>
To: linux-integrity@vger.kernel.org, linux-unionfs@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, zohar@linux.ibm.com,
roberto.sassu@huawei.com, amir73il@gmail.com, miklos@szeredi.hu,
Stefan Berger <stefanb@linux.ibm.com>
Subject: [RFC 2/2] ima: Fix detection of read/write violations on stacked filesystems
Date: Fri, 12 Apr 2024 10:01:22 -0400 [thread overview]
Message-ID: <20240412140122.2607743-3-stefanb@linux.ibm.com> (raw)
In-Reply-To: <20240412140122.2607743-1-stefanb@linux.ibm.com>
On a stacked filesystem, when one process opens the file holding a file's
data (e.g., on upper or lower layer on overlayfs) then issue a violation
when another process opens the file for reading on the top layer (overlay
layer on overlayfs). This then provides similar behavior to the existing
case where a violation is generated when one process opens a file for
writing and another one opens the same file for reading. On stacked
filesystem also search all the lower layers for relevant files opened for
writing and issue the violation if one is found.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
security/integrity/ima/ima_main.c | 27 ++++++++++++++++++++++-----
1 file changed, 22 insertions(+), 5 deletions(-)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index f04f43af651c..590dd9d5d99a 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -121,8 +121,11 @@ static void ima_rdwr_violation_check(struct file *file,
const char **pathname,
char *filename)
{
+ struct inode *real_inode = d_real_inode(file_dentry(file));
struct inode *inode = file_inode(file);
+ struct dentry *fd_dentry, *d;
fmode_t mode = file->f_mode;
+ struct inode *fd_inode;
bool send_tomtou = false, send_writers = false;
if (mode & FMODE_WRITE) {
@@ -134,11 +137,25 @@ static void ima_rdwr_violation_check(struct file *file,
&iint->atomic_flags))
send_tomtou = true;
}
- } else {
- if (must_measure)
- set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);
- if (inode_is_open_for_write(inode) && must_measure)
- send_writers = true;
+ } else if (must_measure) {
+ set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);
+
+ if (inode == real_inode) {
+ if (inode_is_open_for_write(inode))
+ send_writers = true;
+ } else {
+ d = d_real(file_dentry(file), D_REAL_FILEDATA);
+ do {
+ fd_dentry = d;
+ fd_inode = d_inode(fd_dentry);
+ if (inode_is_open_for_write(fd_inode)) {
+ send_writers = true;
+ break;
+ }
+ /* next layer of stacked fs */
+ d = d_real(fd_dentry, D_REAL_FILEDATA);
+ } while (d != fd_dentry);
+ }
}
if (!send_tomtou && !send_writers)
--
2.43.0
next prev parent reply other threads:[~2024-04-12 14:01 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-12 14:01 [RFC 0/2] ima: Fix detection of read/write violations on stacked filesystems Stefan Berger
2024-04-12 14:01 ` [RFC 1/2] ovl: Define D_REAL_FILEDATA for d_real to return dentry with data Stefan Berger
2024-04-12 18:05 ` Amir Goldstein
2024-04-12 14:01 ` Stefan Berger [this message]
2024-04-12 18:08 ` [RFC 2/2] ima: Fix detection of read/write violations on stacked filesystems Amir Goldstein
2024-04-12 19:08 ` Stefan Berger
2024-04-15 8:09 ` Miklos Szeredi
2024-04-15 10:47 ` Mimi Zohar
2024-04-15 12:57 ` Miklos Szeredi
2024-04-15 18:34 ` Mimi Zohar
2024-04-16 8:05 ` Miklos Szeredi
2024-04-16 12:18 ` Mimi Zohar
2024-04-16 14:46 ` Miklos Szeredi
2024-04-16 19:05 ` Mimi Zohar
2024-04-23 11:06 ` Miklos Szeredi
2024-05-01 21:13 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240412140122.2607743-3-stefanb@linux.ibm.com \
--to=stefanb@linux.ibm.com \
--cc=amir73il@gmail.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=roberto.sassu@huawei.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).