tree 418c5afd03474267456e644bc62690dfda157116
parent 33fe46600d3dbb360d1aa4f767ae037c671aa5ba
author Mimi Zohar <zohar@linux.ibm.com> 1697654822 -0400
committer Robert Kolchmeyer <rkolchmeyer@google.com> 1702675664 +0000

ima: detect changes to the backing overlay file

commit b836c4d29f2744200b2af41e14bf50758dddc818 upstream.

Commit 18b44bc5a672 ("ovl: Always reevaluate the file signature for
IMA") forced signature re-evaulation on every file access.

Instead of always re-evaluating the file's integrity, detect a change
to the backing file, by comparing the cached file metadata with the
backing file's metadata.  Verifying just the i_version has not changed
is insufficient.  In addition save and compare the i_ino and s_dev
as well.

BUG=b/314212897
TEST=presubmit, benchmark in https://lore.kernel.org/stable/CAJc0_fz4LEyNT2rB7KAsAZuym8TT3DZLEfFqSoBigs-316LNKQ@mail.gmail.com/T/#mfd334cd7926076823fffc293b8cdd1badddde945
RELEASE_NOTE=None

cos-patch: bug
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Tested-by: Eric Snowberg <eric.snowberg@oracle.com>
Tested-by: Raul E Rangel <rrangel@chromium.org>
Cc: stable@vger.kernel.org
Change-Id: I5027baf02ae93a8815f7424b03b8afa7db1617f2
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 143f450c6cb28890da0002ebd1764cc804258de1)
Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/62392
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>