diff options
| author | Stefan Berger <stefanb@linux.ibm.com> | 2024-02-23 12:25:09 -0500 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2024-04-09 17:14:57 -0400 |
| commit | a652aa59068bd78d96a1ab6ea7c0c4d3c79fb5e8 (patch) | |
| tree | 46c5b38246b8c5fabd7f5f6b1d7f535ad78db104 /security/integrity/evm/evm.h | |
| parent | 309e2b775da8b2c28fccc4ac2621801f06920ce0 (diff) | |
evm: Store and detect metadata inode attributes changes
On stacked filesystem the metadata inode may be different than the one
file data inode and therefore changes to it need to be detected
independently. Therefore, store the i_version, device number, and inode
number associated with the file metadata inode.
Implement a function to detect changes to the inode and if a change is
detected reset the evm_status. This function will be called by IMA when
IMA detects that the metadata inode is different from the file's inode.
Co-developed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'security/integrity/evm/evm.h')
| -rw-r--r-- | security/integrity/evm/evm.h | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h index 72e3341ae6f7..51aba5a54275 100644 --- a/security/integrity/evm/evm.h +++ b/security/integrity/evm/evm.h @@ -39,6 +39,7 @@ struct xattr_list { struct evm_iint_cache { unsigned long flags; enum integrity_status evm_status:4; + struct integrity_inode_attributes metadata_inode; }; extern struct lsm_blob_sizes evm_blob_sizes; @@ -74,11 +75,12 @@ int evm_update_evmxattr(struct dentry *dentry, size_t req_xattr_value_len); int evm_calc_hmac(struct dentry *dentry, const char *req_xattr_name, const char *req_xattr_value, - size_t req_xattr_value_len, struct evm_digest *data); + size_t req_xattr_value_len, struct evm_digest *data, + struct evm_iint_cache *iint); int evm_calc_hash(struct dentry *dentry, const char *req_xattr_name, const char *req_xattr_value, size_t req_xattr_value_len, char type, - struct evm_digest *data); + struct evm_digest *data, struct evm_iint_cache *iint); int evm_init_hmac(struct inode *inode, const struct xattr *xattrs, char *hmac_val); int evm_init_secfs(void); |