On Wed, 2022-03-02 at 12:13 +0100, Roberto Sassu wrote: > __ima_inode_hash() checks if a digest has been already calculated by > looking for the integrity_iint_cache structure associated to the passed > inode. > > Users of ima_file_hash() (e.g. eBPF) might be interested in obtaining the > information without having to setup an IMA policy so that the digest is > always available at the time they call this function. > > In addition, they likely expect the digest to be fresh, e.g. recalculated > by IMA after a file write. Although getting the digest from the > bprm_committed_creds hook (as in the eBPF test) ensures that the digest is > fresh, as the IMA hook is executed before that hook, this is not always the > case (e.g. for the mmap_file hook). > > Call ima_collect_measurement() in __ima_inode_hash(), if the file > descriptor is available (passed by ima_file_hash()) and the digest is not > available/not fresh, and store the file measurement in a temporary > integrity_iint_cache structure. > > This change does not cause memory usage increase, due to using the > temporary integrity_iint_cache structure, and due to freeing the > ima_digest_data structure inside integrity_iint_cache before exiting from > __ima_inode_hash(). > > For compatibility reasons, the behavior of ima_inode_hash() remains > unchanged. > > Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx> The patch itself is fine, but with great hesitancy due to the existing eBPF integrity gaps and how these functions are planned to be used, Reviewed-by: Mimi Zohar <zohar@xxxxxxxxxxxxx>
