lkml.org 
[lkml]   [2020]   [Dec]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v3 04/11] ima: Move ima_reset_appraise_flags() call to post hooks
From
Date
On Wed, 2020-12-02 at 11:56 +0000, Roberto Sassu wrote:
> > From: Roberto Sassu
> > Sent: Wednesday, November 11, 2020 10:23 AM
> > ima_inode_setxattr() and ima_inode_removexattr() hooks are called
> > before an
> > operation is performed. Thus, ima_reset_appraise_flags() should not be
> > called there, as flags might be unnecessarily reset if the operation is
> > denied.
> >
> > This patch introduces the post hooks ima_inode_post_setxattr() and
> > ima_inode_post_removexattr(), removes ima_inode_removexattr() and
> > adds the
> > call to ima_reset_appraise_flags() in the new functions.
>
> Removing ima_inode_removexattr() is not correct. We should still prevent
> that security.ima is removed when CAP_SYS_ADMIN is not set. I will fix
> this in the next version.

Ok. So this patch will define the post hooks and defer
ima_reset_appraise_flags() to them, leaving the original hooks intact.

Mimi

\
 
 \ /
  Last update: 2020-12-03 21:46    [W:0.049 / U:0.536 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site