Re: [PATCH 2/2] ima: limit the number of ToMToU integrity violations

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Roberto,

On Fri, 2025-02-21 at 18:36 +0100, Roberto Sassu wrote:
> On Wed, 2025-02-19 at 11:21 -0500, Mimi Zohar wrote:
> > Each time a file in policy, that is already opened for read, is opened
> > for write a Time-of-Measure-Time-of-Use (ToMToU) integrity violation
> > audit message is emitted and a violation record is added to the IMA
> > measurement list, even if a ToMToU violation has already been recorded.
> > 
> > Limit the number of ToMToU integrity violations for an existing file
> > open for read.
> > 
> > Note: The IMA_MUST_MEASURE atomic flag must be set from the reader side
> > based on policy.  This may result in a per open reader additional ToMToU
> > violation.
> 
> Probably the goal can be summarized as to limit emitting consecutive
> ToMToU violations.

Other audit messages and measurements could have been emitted, so they may not
be consecutive.

> 
> In the previous patch, we are not emitting a new open_writers violation
> until all writers close the file. Here, it is a bit different, we are
> not emitting an additional ToMToU violation until there is another
> reader matching the policy. Maybe we should highlight this difference.
> 
> > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> > ---
> >  security/integrity/ima/ima_main.c | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> > 
> > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> > index cde3ae55d654..f1671799a11b 100644
> > --- a/security/integrity/ima/ima_main.c
> > +++ b/security/integrity/ima/ima_main.c
> > @@ -129,9 +129,10 @@ static void ima_rdwr_violation_check(struct file *file,
> >  		if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) {
> >  			if (!iint)
> >  				iint = ima_iint_find(inode);
> > +
> >  			/* IMA_MEASURE is set from reader side */
> > -			if (iint && test_bit(IMA_MUST_MEASURE,
> > -						&iint->atomic_flags))
> > +			if (iint && test_and_clear_bit(IMA_MUST_MEASURE,
> 
> Since IMA_MUST_MEASURE is only used for violations, what if we rename
> it to:
> 
> IMA_TOMTOU_MAY_EMIT

How about naming the atomic flags as IMA_MAY_EMIT_TOMTOU and
IMA_EMIT_OPENWRITERS?

Mimi