ovl: Always reevaluate the file signature for IMA

18b44bc5 · Eric Snowberg <[email protected]> · 2023-07-25 17:56:46 -04:00

Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version")
partially closed an IMA integrity issue when directly modifying a file
on the lower filesystem.  If the overlay file is first opened by a user
and later the lower backing file is modified by root, but the extended
attribute is NOT updated, the signature validation succeeds with the old
original signature.

Update the super_block s_iflags to SB_I_IMA_UNVERIFIABLE_SIGNATURE to
force signature reevaluation on every file access until a fine grained
solution can be found.

Signed-off-by: Eric Snowberg <[email protected]>
Signed-off-by: Mimi Zohar <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Commit: 18b44bc5a67275641fb26f2c54ba7eef80ac5950
Parents: 9f911640

Changes

1 files changed · +1 −1

File	Status	Add	Del	Content
fs/overlayfs/super.c	modified	+1	−1	View file

fs/overlayfs/super.c

View file

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 5b069f1..cc89774 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1460,7 +1460,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
 		ovl_trusted_xattr_handlers;
 	sb->s_fs_info = ofs;
 	sb->s_flags |= SB_POSIXACL;
-	sb->s_iflags |= SB_I_SKIP_SYNC;
+	sb->s_iflags |= SB_I_SKIP_SYNC | SB_I_IMA_UNVERIFIABLE_SIGNATURE;
 
 	err = -ENOMEM;
 	root_dentry = ovl_get_root(sb, ctx->upper.dentry, oe);