On Mon, Feb 5, 2024 at 8:25 PM Stefan Berger <[email protected]> wrote: > > Changes to file attributes (mode bits, uid, gid) on the lower layer are > not taken into account when d_backing_inode() is used when a file is > accessed on the overlay layer and this file has not yet been copied up. > This is because d_backing_inode() does not return the real inode of the > lower layer but instead returns the backing inode which in this case > holds wrong file attributes. Further, when CONFIG_OVERLAY_FS_METACOPY is > enabled and a copy-up is triggered due to file metadata changes, then > the metadata are held by the backing inode while the data are still held > by the real inode. Therefore, use d_inode(d_real(dentry, D_REAL_METADATA)) > to get to the inode holding the file's metadata and use it to calculate > the metadata hash with. > > Signed-off-by: Stefan Berger <[email protected]>
Acked-by: Amir Goldstein <[email protected]> > --- > security/integrity/evm/evm_crypto.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/security/integrity/evm/evm_crypto.c > b/security/integrity/evm/evm_crypto.c > index b1ffd4cc0b44..51e24a75742c 100644 > --- a/security/integrity/evm/evm_crypto.c > +++ b/security/integrity/evm/evm_crypto.c > @@ -223,7 +223,7 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry, > size_t req_xattr_value_len, > uint8_t type, struct evm_digest *data) > { > - struct inode *inode = d_backing_inode(dentry); > + struct inode *inode = d_inode(d_real(dentry, D_REAL_METADATA)); > struct xattr_list *xattr; > struct shash_desc *desc; > size_t xattr_size = 0; > -- > 2.43.0 >
