[PATCH OLK-5.10 0/2] Fix the incorrect definition and use of IMA_FIX_OVERLAYFS_DETECTION
Xiang Yang (2): IMA: Fix the incorrect definition and use of IMA_FIX_OVERLAYFS_DETECTION config: Enable IMA_FIX_OVERLAYFS_DETECTION in openeuler defconfigs
arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + security/integrity/ima/Kconfig | 2 +- security/integrity/ima/ima_main.c | 4 ++-- 4 files changed, 5 insertions(+), 3 deletions(-)
hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBCASR
--------------------------------
The definition of IMA_FIX_OVERLAYFS_DETECTION is wrong with the bool field has no content, and the use of it in ima_main.c is wrong with the missing prefix CONFIG_, so correct them.
Fixes: a670a0ede1e7 ("IMA: Introduce a config for fix on IMA with Overlayfs issue") Signed-off-by: Xiang Yang xiangyang3@huawei.com --- security/integrity/ima/Kconfig | 2 +- security/integrity/ima/ima_main.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 9e254c5cb117..09f5d88d60e7 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -370,7 +370,7 @@ config IMA_PARSER_BINARY_PATH This option defines the path of the parser binary.
config IMA_FIX_OVERLAYFS_DETECTION - bool + bool "Fix for overlayfs backing inode change detection" default y help This option enables the fix for overlayfs backing inode change diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index ac5f82b2dd58..c211a2c5f297 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -267,7 +267,7 @@ static int process_measurement(struct file *file, const struct cred *cred, u32 secid, char *buf, loff_t size, int mask, enum ima_hooks func) { -#ifdef IMA_FIX_OVERLAYFS_DETECTION +#ifdef CONFIG_IMA_FIX_OVERLAYFS_DETECTION struct inode *backing_inode, *inode = file_inode(file); #else struct inode *inode = file_inode(file); @@ -348,7 +348,7 @@ static int process_measurement(struct file *file, const struct cred *cred, iint->measured_pcrs = 0; }
-#ifdef IMA_FIX_OVERLAYFS_DETECTION +#ifdef CONFIG_IMA_FIX_OVERLAYFS_DETECTION /* Detect and re-evaluate changes made to the backing file. */ backing_inode = d_real_inode(file_dentry(file)); if (backing_inode != inode &&
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBCASR
--------------------------------
Signed-off-by: Xiang Yang xiangyang3@huawei.com --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + 2 files changed, 2 insertions(+)
diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index aebf4cd9ad3b..f996c81fbf75 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6737,6 +6737,7 @@ CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y # CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set CONFIG_IMA_DIGEST_DB_MEGABYTES=16 CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists" +CONFIG_IMA_FIX_OVERLAYFS_DETECTION=y CONFIG_EVM=y # CONFIG_EVM_DEFAULT_HASH_SHA1 is not set CONFIG_EVM_DEFAULT_HASH_SHA256=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 5ba9d95ed62f..25d0e88e8880 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7788,6 +7788,7 @@ CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y # CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set CONFIG_IMA_DIGEST_DB_MEGABYTES=16 CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists" +CONFIG_IMA_FIX_OVERLAYFS_DETECTION=y CONFIG_EVM=y # CONFIG_EVM_DEFAULT_HASH_SHA1 is not set CONFIG_EVM_DEFAULT_HASH_SHA256=y
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/14260 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6...
FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/14260 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6...
-
patchwork bot -
Xiang Yang