Re: [PATCH] integrity: make 'sync' update the inode integrity state

[Mimi Zohar <zohar@linux.ibm.com>]

On Thu, 2019-04-11 at 09:03 -0400, Mimi Zohar wrote:
> On Wed, 2019-04-10 at 17:56 +0300, Janne Karhunen wrote:
> 
> > +		clear_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
> > +		if (!IS_I_VERSION(inode) ||
> > +		    !inode_eq_iversion(inode, iint->version)) {
> > +			iint->flags &= ~IMA_COLLECTED;
> > +			ima_update_xattr(iint, file);
> 
> Relatively recently there were some changes to iversion so that it
> isn't being updated as frequently.  Can we use i_version here?

I was referring to Jeff Layton's i_version changes.[1]

Mimi

[1] f02a9ad1f15d ("fs: handle inode->i_version more efficiently")

> 
> > +		}
> > +	}
> > +	mutex_unlock(&iint->mutex);
> > +}
> > +EXPORT_SYMBOL_GPL(ima_file_update);
> > +
> >  /**
> >   * ima_path_check - based on policy, collect/store measurement.
> >   * @file: pointer to the file to be measured