Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> writes:
> This patch addresses the fuse privileged mounted filesystems in a "secure"
> environment, with a correctly enforced security policy, which is willing
> to assume the inherent risk of specific fuse filesystems that are well
> defined and properly implemented.
>
> As there is no way for the kernel to detect file changes, the kernel
> ignores the cached file integrity results and re-measures, re-appraises,
> and re-audits the file.
Acked-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
>
> Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx>
> Cc: Miklos Szeredi <miklos@xxxxxxxxxx>
> Cc: Seth Forshee <seth.forshee@xxxxxxxxxxxxx>
> Cc: Eric W. Biederman <ebiederm@xxxxxxxxxxxx>
> Cc: Dongsu Park <dongsu@xxxxxxxxxx>
> Cc: Alban Crequy <alban@xxxxxxxxxx>
> Cc: Serge E. Hallyn <serge@xxxxxxxxxx>
> ---
> security/integrity/ima/ima_main.c | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index a5d225ffc388..f550f25294a3 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -25,6 +25,7 @@
> #include <linux/xattr.h>
> #include <linux/ima.h>
> #include <linux/iversion.h>
> +#include <linux/fs.h>
>
> #include "ima.h"
>
> @@ -230,9 +231,17 @@ static int process_measurement(struct file *file, const struct cred *cred,
> IMA_APPRAISE_SUBMASK | IMA_APPRAISED_SUBMASK |
> IMA_ACTION_FLAGS);
>
> - if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags))
> - /* reset all flags if ima_inode_setxattr was called */
> + /*
> + * Re-evaulate the file if either the xattr has changed or the
> + * kernel has no way of detecting file change on the filesystem.
> + * (Limited to privileged mounted filesystems.)
> + */
> + if (test_and_clear_bit(IMA_CHANGE_XATTR, &iint->atomic_flags) ||
> + ((inode->i_sb->s_iflags & SB_I_IMA_UNVERIFIABLE_SIGNATURE) &&
> + !(inode->i_sb->s_iflags & SB_I_UNTRUSTED_MOUNTER))) {
> iint->flags &= ~IMA_DONE_MASK;
> + iint->measured_pcrs = 0;
> + }
>
> /* Determine if already appraised/measured based on bitmask
> * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,
