ima: Instantiate file_truncate and path_truncate hooks

Instantiate the file_truncate and path_truncate LSM hooks to reset the
action cache flags (IMA_DONE_MASK) as soon as truncation is requested,
so the file, based on policy, is re-collected, re-measured, re-audited,
and re-appraised on next access.

Tested-by: Frederick Lawler <fred@cloudflare.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 5cea53fc36dffc55dc200ff3dfc37cedc38f2b6a..ff52becc3031872c0d3770b166823dbbb7aa5057 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -687,6 +687,43 @@ static int ima_file_check(struct file *file, int mask)
                                           MAY_APPEND), FILE_CHECK, 0, false);
 }
 
+/*
+ * ima_reset_action_flags - invalidate action flags after a content change
+ * @inode: inode of the file whose content is about to be truncated
+ *
+ * Clear IMA_DONE_MASK so the file is re-collected, re-measured,
+ * re-audited, and re-appraised on next access.
+ */
+static void ima_reset_action_flags(struct inode *inode)
+{
+       struct ima_iint_cache *iint;
+
+       if (!ima_policy_flag || !S_ISREG(inode->i_mode))
+               return;
+
+       iint = ima_iint_find(inode);
+       if (!iint)
+               return;
+
+       mutex_lock(&iint->mutex);
+       iint->flags &= ~IMA_DONE_MASK;
+       iint->measured_pcrs = 0;
+       mutex_unlock(&iint->mutex);
+       return;
+}
+
+static int ima_path_truncate(const struct path *path)
+{
+       ima_reset_action_flags(path->dentry->d_inode);
+       return 0;
+}
+
+static int ima_file_truncate(struct file *file)
+{
+       ima_reset_action_flags(file_inode(file));
+       return 0;
+}
+
 static int __ima_inode_hash(struct inode *inode, struct file *file, char *buf,
                            size_t buf_size)
 {
@@ -1300,11 +1337,13 @@ static struct security_hook_list ima_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(file_release, ima_file_free),
        LSM_HOOK_INIT(mmap_file, ima_file_mmap),
        LSM_HOOK_INIT(file_mprotect, ima_file_mprotect),
+       LSM_HOOK_INIT(file_truncate, ima_file_truncate),
        LSM_HOOK_INIT(kernel_load_data, ima_load_data),
        LSM_HOOK_INIT(kernel_post_load_data, ima_post_load_data),
        LSM_HOOK_INIT(kernel_read_file, ima_read_file),
        LSM_HOOK_INIT(kernel_post_read_file, ima_post_read_file),
        LSM_HOOK_INIT(path_post_mknod, ima_post_path_mknod),
+       LSM_HOOK_INIT(path_truncate, ima_path_truncate),
 #ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
        LSM_HOOK_INIT(key_post_create_or_update, ima_post_key_create_or_update),
 #endif