From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Eric Snowberg <eric.snowberg@oracle.com>,
Mimi Zohar <zohar@linux.ibm.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Sasha Levin <sashal@kernel.org>,
miklos@szeredi.hu, amir73il@gmail.com,
linux-unionfs@vger.kernel.org
Subject: [PATCH AUTOSEL 5.15 26/31] ovl: Always reevaluate the file signature for IMA
Date: Sun, 13 Aug 2023 12:05:59 -0400 [thread overview]
Message-ID: <20230813160605.1080385-26-sashal@kernel.org> (raw)
In-Reply-To: <20230813160605.1080385-1-sashal@kernel.org>
From: Eric Snowberg <eric.snowberg@oracle.com>
[ Upstream commit 18b44bc5a67275641fb26f2c54ba7eef80ac5950 ]
Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version")
partially closed an IMA integrity issue when directly modifying a file
on the lower filesystem. If the overlay file is first opened by a user
and later the lower backing file is modified by root, but the extended
attribute is NOT updated, the signature validation succeeds with the old
original signature.
Update the super_block s_iflags to SB_I_IMA_UNVERIFIABLE_SIGNATURE to
force signature reevaluation on every file access until a fine grained
solution can be found.
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/overlayfs/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 5310271cf2e38..e18025b5c8872 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -2140,7 +2140,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
ovl_trusted_xattr_handlers;
sb->s_fs_info = ofs;
sb->s_flags |= SB_POSIXACL;
- sb->s_iflags |= SB_I_SKIP_SYNC;
+ sb->s_iflags |= SB_I_SKIP_SYNC | SB_I_IMA_UNVERIFIABLE_SIGNATURE;
err = -ENOMEM;
root_dentry = ovl_get_root(sb, upperpath.dentry, oe);
--
2.40.1
next prev parent reply other threads:[~2023-08-13 16:11 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-13 16:05 [PATCH AUTOSEL 5.15 01/31] phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 02/31] phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 03/31] media: pulse8-cec: handle possible ping error Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 04/31] media: pci: cx23885: fix error handling for cx23885 ATSC boards Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 05/31] 9p: virtio: make sure 'offs' is initialized in zc_request Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 06/31] ksmbd: fix out of bounds in smb3_decrypt_req() Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 07/31] ksmbd: no response from compound read Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 08/31] ASoC: da7219: Flush pending AAD IRQ when suspending Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 09/31] ASoC: da7219: Check for failure reading AAD IRQ events Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 10/31] ethernet: atheros: fix return value check in atl1c_tso_csum() Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 11/31] vxlan: generalize vxlan_parse_gpe_hdr and remove unused args Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 12/31] m68k: Fix invalid .section syntax Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 13/31] s390/dasd: use correct number of retries for ERP requests Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 14/31] s390/dasd: fix hanging device after request requeue Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 15/31] fs/nls: make load_nls() take a const parameter Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 16/31] ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0 Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 17/31] ASoc: codecs: ES8316: Fix DMIC config Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 18/31] ASoC: rt711: fix for JD event handling in ClockStop Mode0 Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 19/31] ASoC: rt711-sdca: " Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 20/31] ASoC: atmel: Fix the 8K sample parameter in I2SC master Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 21/31] ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 22/31] platform/x86: intel: hid: Always call BTNL ACPI method Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 23/31] platform/x86/intel/hid: Add HP Dragonfly G2 to VGBS DMI quirks Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 24/31] platform/x86: huawei-wmi: Silence ambient light sensor Sasha Levin
2023-08-13 16:05 ` [PATCH AUTOSEL 5.15 25/31] drm/amd/display: Exit idle optimizations before attempt to access PHY Sasha Levin
2023-08-13 16:05 ` Sasha Levin [this message]
2023-08-13 16:06 ` [PATCH AUTOSEL 5.15 27/31] ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() Sasha Levin
2023-08-13 16:06 ` [PATCH AUTOSEL 5.15 28/31] rbd: make get_lock_owner_info() return a single locker or NULL Sasha Levin
2023-08-14 13:17 ` Ilya Dryomov
2023-08-13 16:06 ` [PATCH AUTOSEL 5.15 29/31] rbd: harden get_lock_owner_info() a bit Sasha Levin
2023-08-13 16:06 ` [PATCH AUTOSEL 5.15 30/31] security: keys: perform capable check only on privileged operations Sasha Levin
2023-08-13 16:06 ` [PATCH AUTOSEL 5.15 31/31] kprobes: Prohibit probing on CFI preamble symbol Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230813160605.1080385-26-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=amir73il@gmail.com \
--cc=eric.snowberg@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®