| Message ID | 20200618160458.1579-9-roberto.sassu@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [01/11] evm: Execute evm_inode_init_security() only when the HMAC key is loaded | expand |
On Thu, 2020-06-18 at 18:04 +0200, Roberto Sassu wrote: > Files might come from a remote source and might have xattrs, including > security.ima. It should not be IMA task to decide whether security.ima > should be kept or not. This patch removes the removexattr() system > call in ima_inode_post_setattr(). > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Yes, this has been previously discussed. Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 9505bb390d90..83c62eaf342d 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -504,8 +504,6 @@ void ima_inode_post_setattr(struct dentry *dentry) return; action = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR); - if (!action) - __vfs_removexattr(dentry, XATTR_NAME_IMA); iint = integrity_iint_find(inode); if (iint) { set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
Files might come from a remote source and might have xattrs, including security.ima. It should not be IMA task to decide whether security.ima should be kept or not. This patch removes the removexattr() system call in ima_inode_post_setattr(). Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> --- security/integrity/ima/ima_appraise.c | 2 -- 1 file changed, 2 deletions(-)