ima: detect changes to the backing overlay file

[platform/kernel/linux-rpi.git] / security / integrity / ima / ima_main.c

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 365db0e..cc1217a 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -25,6 +25,7 @@
 #include <linux/xattr.h>
 #include <linux/ima.h>
 #include <linux/fs.h>
+#include <linux/iversion.h>
 
 #include "ima.h"
 
@@ -207,7 +208,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
                               u32 secid, char *buf, loff_t size, int mask,
                               enum ima_hooks func)
 {
-       struct inode *inode = file_inode(file);
+       struct inode *backing_inode, *inode = file_inode(file);
        struct integrity_iint_cache *iint = NULL;
        struct ima_template_desc *template_desc = NULL;
        char *pathbuf = NULL;
@@ -284,6 +285,19 @@ static int process_measurement(struct file *file, const struct cred *cred,
                iint->measured_pcrs = 0;
        }
 
+       /* Detect and re-evaluate changes made to the backing file. */
+       backing_inode = d_real_inode(file_dentry(file));
+       if (backing_inode != inode &&
+           (action & IMA_DO_MASK) && (iint->flags & IMA_DONE_MASK)) {
+               if (!IS_I_VERSION(backing_inode) ||
+                   backing_inode->i_sb->s_dev != iint->real_dev ||
+                   backing_inode->i_ino != iint->real_ino ||
+                   !inode_eq_iversion(backing_inode, iint->version)) {
+                       iint->flags &= ~IMA_DONE_MASK;
+                       iint->measured_pcrs = 0;
+               }
+       }
+
        /* Determine if already appraised/measured based on bitmask
         * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,
         *  IMA_AUDIT, IMA_AUDITED)