ima: Move file-change detection variables into new structure

Move all the variables used for file change detection into a structure
that can be used by IMA and EVM. Implement an inline function for storing
the identification of an inode and one for detecting changes to an inode
based on this new structure.

Co-developed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/include/linux/integrity.h b/include/linux/integrity.h
index 459b796837830df311cbc573e24d7c3b79f15613..f5842372359be5341b6870a43b92e695e8fc78af 100644 (file)
--- a/include/linux/integrity.h
+++ b/include/linux/integrity.h
@@ -8,6 +8,7 @@
 #define _LINUX_INTEGRITY_H
 
 #include <linux/fs.h>
+#include <linux/iversion.h>
 
 enum integrity_status {
        INTEGRITY_PASS = 0,
@@ -28,4 +29,37 @@ static inline void integrity_load_keys(void)
 }
 #endif /* CONFIG_INTEGRITY */
 
+/* An inode's attributes for detection of changes */
+struct integrity_inode_attributes {
+       u64 version;            /* track inode changes */
+       unsigned long ino;
+       dev_t dev;
+};
+
+/*
+ * On stacked filesystems the i_version alone is not enough to detect file data
+ * or metadata change. Additional metadata is required.
+ */
+static inline void
+integrity_inode_attrs_store(struct integrity_inode_attributes *attrs,
+                           u64 i_version, const struct inode *inode)
+{
+       attrs->version = i_version;
+       attrs->dev = inode->i_sb->s_dev;
+       attrs->ino = inode->i_ino;
+}
+
+/*
+ * On stacked filesystems detect whether the inode or its content has changed.
+ */
+static inline bool
+integrity_inode_attrs_changed(const struct integrity_inode_attributes *attrs,
+                             const struct inode *inode)
+{
+       return (inode->i_sb->s_dev != attrs->dev ||
+               inode->i_ino != attrs->ino ||
+               !inode_eq_iversion(inode, attrs->version));
+}
+
+
 #endif /* _LINUX_INTEGRITY_H */

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 11d7c03322070006044b3b1e96ef739f21fda8a8..9151b5369cdc0b2402ba511e0951040b55bd42e3 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -175,12 +175,10 @@ struct ima_kexec_hdr {
 /* IMA integrity metadata associated with an inode */
 struct ima_iint_cache {
        struct mutex mutex;     /* protects: version, flags, digest */
-       u64 version;            /* track inode changes */
+       struct integrity_inode_attributes real_inode;
        unsigned long flags;
        unsigned long measured_pcrs;
        unsigned long atomic_flags;
-       unsigned long real_ino;
-       dev_t real_dev;
        enum integrity_status ima_file_status:4;
        enum integrity_status ima_mmap_status:4;
        enum integrity_status ima_bprm_status:4;

diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 3d286de231e1d5e373cc7029d1372e9e1ddbf043..984e861f6e3328290de2aee4cbd5ba30cf8dd5cf 100644 (file)
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -305,11 +305,11 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
 
        iint->ima_hash = tmpbuf;
        memcpy(iint->ima_hash, &hash, length);
-       iint->version = i_version;
-       if (real_inode != inode) {
-               iint->real_ino = real_inode->i_ino;
-               iint->real_dev = real_inode->i_sb->s_dev;
-       }
+       if (real_inode == inode)
+               iint->real_inode.version = i_version;
+       else
+               integrity_inode_attrs_store(&iint->real_inode, i_version,
+                                           real_inode);
 
        /* Possibly temporary failure due to type of read (eg. O_DIRECT) */
        if (!result)

diff --git a/security/integrity/ima/ima_iint.c b/security/integrity/ima/ima_iint.c
index e7c9c216c1c6f32c59c8f8df84599d56184bd13e..e23412a2c56b092173d7f0db111d32c6fce37c67 100644 (file)
--- a/security/integrity/ima/ima_iint.c
+++ b/security/integrity/ima/ima_iint.c
@@ -59,7 +59,7 @@ static void ima_iint_init_always(struct ima_iint_cache *iint,
                                 struct inode *inode)
 {
        iint->ima_hash = NULL;
-       iint->version = 0;
+       iint->real_inode.version = 0;
        iint->flags = 0UL;
        iint->atomic_flags = 0UL;
        iint->ima_file_status = INTEGRITY_UNKNOWN;

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index eebf629f192ecc6cfd4a8506920b1ad8bd663391..4b215d85c14bbcd2f65a99ad8d5289a8a89df8b9 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -173,7 +173,7 @@ static void ima_check_last_writer(struct ima_iint_cache *iint,
                                      STATX_CHANGE_COOKIE,
                                      AT_STATX_SYNC_AS_STAT) ||
                    !(stat.result_mask & STATX_CHANGE_COOKIE) ||
-                   stat.change_cookie != iint->version) {
+                   stat.change_cookie != iint->real_inode.version) {
                        iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
                        iint->measured_pcrs = 0;
                        if (update)
@@ -292,9 +292,8 @@ static int process_measurement(struct file *file, const struct cred *cred,
        if (real_inode != inode &&
            (action & IMA_DO_MASK) && (iint->flags & IMA_DONE_MASK)) {
                if (!IS_I_VERSION(real_inode) ||
-                   real_inode->i_sb->s_dev != iint->real_dev ||
-                   real_inode->i_ino != iint->real_ino ||
-                   !inode_eq_iversion(real_inode, iint->version)) {
+                   integrity_inode_attrs_changed(&iint->real_inode,
+                                                 real_inode)) {
                        iint->flags &= ~IMA_DONE_MASK;
                        iint->measured_pcrs = 0;
                }