On Wed, 2020-12-02 at 11:56 +0000, Roberto Sassu wrote: > > From: Roberto Sassu > > Sent: Wednesday, November 11, 2020 10:23 AM > > ima_inode_setxattr() and ima_inode_removexattr() hooks are called > > before an > > operation is performed. Thus, ima_reset_appraise_flags() should not be > > called there, as flags might be unnecessarily reset if the operation is > > denied. > > > > This patch introduces the post hooks ima_inode_post_setxattr() and > > ima_inode_post_removexattr(), removes ima_inode_removexattr() and > > adds the > > call to ima_reset_appraise_flags() in the new functions. > > Removing ima_inode_removexattr() is not correct. We should still prevent > that security.ima is removed when CAP_SYS_ADMIN is not set. I will fix > this in the next version. Ok. So this patch will define the post hooks and defer ima_reset_appraise_flags() to them, leaving the original hooks intact. Mimi
