On Fri, Apr 12, 2024 at 5:01 PM Stefan Berger <stefanb@xxxxxxxxxxxxx> wrote:
>
> On a stacked filesystem, when one process opens the file holding a file's
> data (e.g., on upper or lower layer on overlayfs) then issue a violation
> when another process opens the file for reading on the top layer (overlay
> layer on overlayfs). This then provides similar behavior to the existing
> case where a violation is generated when one process opens a file for
> writing and another one opens the same file for reading. On stacked
> filesystem also search all the lower layers for relevant files opened for
> writing and issue the violation if one is found.
>
> Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
> ---
> security/integrity/ima/ima_main.c | 27 ++++++++++++++++++++++-----
> 1 file changed, 22 insertions(+), 5 deletions(-)
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index f04f43af651c..590dd9d5d99a 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -121,8 +121,11 @@ static void ima_rdwr_violation_check(struct file *file,
> const char **pathname,
> char *filename)
> {
> + struct inode *real_inode = d_real_inode(file_dentry(file));
> struct inode *inode = file_inode(file);
> + struct dentry *fd_dentry, *d;
> fmode_t mode = file->f_mode;
> + struct inode *fd_inode;
> bool send_tomtou = false, send_writers = false;
>
> if (mode & FMODE_WRITE) {
> @@ -134,11 +137,25 @@ static void ima_rdwr_violation_check(struct file *file,
> &iint->atomic_flags))
> send_tomtou = true;
> }
> - } else {
> - if (must_measure)
> - set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);
> - if (inode_is_open_for_write(inode) && must_measure)
> - send_writers = true;
> + } else if (must_measure) {
> + set_bit(IMA_MUST_MEASURE, &iint->atomic_flags);
> +
> + if (inode == real_inode) {
> + if (inode_is_open_for_write(inode))
> + send_writers = true;
> + } else {
> + d = d_real(file_dentry(file), D_REAL_FILEDATA);
> + do {
> + fd_dentry = d;
> + fd_inode = d_inode(fd_dentry);
> + if (inode_is_open_for_write(fd_inode)) {
> + send_writers = true;
> + break;
> + }
> + /* next layer of stacked fs */
> + d = d_real(fd_dentry, D_REAL_FILEDATA);
> + } while (d != fd_dentry);
> + }
The idea of digging though ovl layers feels wrong to me.
As Miklos is the designer of overlayfs and its vfs architecture,
I am deferring the call about adding this interface to Miklos.
Thanks,
Amir.
