From: Roberto Sassu <roberto.sassu@huawei.com>
To: <zohar@linux.ibm.com>, <mjg59@google.com>
Cc: <linux-integrity@vger.kernel.org>,
<linux-security-module@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <silviu.vlasceanu@huawei.com>,
Roberto Sassu <roberto.sassu@huawei.com>
Subject: [PATCH 09/11] ima: Don't remove security.ima if file must not be appraised
Date: Thu, 18 Jun 2020 18:04:56 +0200 [thread overview]
Message-ID: <20200618160458.1579-9-roberto.sassu@huawei.com> (raw)
In-Reply-To: <20200618160329.1263-2-roberto.sassu@huawei.com>
Files might come from a remote source and might have xattrs, including
security.ima. It should not be IMA task to decide whether security.ima
should be kept or not. This patch removes the removexattr() system
call in ima_inode_post_setattr().
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
security/integrity/ima/ima_appraise.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 9505bb390d90..83c62eaf342d 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -504,8 +504,6 @@ void ima_inode_post_setattr(struct dentry *dentry)
return;
action = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
- if (!action)
- __vfs_removexattr(dentry, XATTR_NAME_IMA);
iint = integrity_iint_find(inode);
if (iint) {
set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
--
2.17.1
next prev parent reply other threads:[~2020-06-18 16:08 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200618160329.1263-2-roberto.sassu@huawei.com>
2020-06-18 16:04 ` [PATCH 06/11] evm: Allow setxattr() and setattr() if metadata digest won't change Roberto Sassu
2020-08-24 12:17 ` Mimi Zohar
2020-08-31 8:51 ` Roberto Sassu
2020-06-18 16:04 ` [PATCH 07/11] evm: Set IMA_CHANGE_XATTR/ATTR bit if EVM_ALLOW_METADATA_WRITES is set Roberto Sassu
2020-08-24 12:17 ` Mimi Zohar
2020-09-01 9:08 ` Roberto Sassu
2020-09-01 11:05 ` Mimi Zohar
2020-09-01 11:41 ` Roberto Sassu
2020-09-01 12:55 ` Mimi Zohar
2020-06-18 16:04 ` [PATCH 08/11] ima: Allow imasig requirement to be satisfied by EVM portable signatures Roberto Sassu
2020-08-24 13:02 ` Mimi Zohar
2020-06-18 16:04 ` Roberto Sassu [this message]
2020-08-24 13:02 ` [PATCH 09/11] ima: Don't remove security.ima if file must not be appraised Mimi Zohar
2020-06-18 16:04 ` [PATCH 10/11] ima: Don't ignore errors from crypto_shash_update() Roberto Sassu
2020-08-24 13:02 ` Mimi Zohar
2020-06-18 16:06 ` [PATCH 11/11] ima: Remove semicolon at the end of ima_get_binary_runtime_size() Roberto Sassu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200618160458.1579-9-roberto.sassu@huawei.com \
--to=roberto.sassu@huawei.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mjg59@google.com \
--cc=silviu.vlasceanu@huawei.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox