• Thiago Jung Bauermann's avatar
    ima: Store the measurement again when appraising a modsig · e5092255
    Thiago Jung Bauermann authored
    If the IMA template contains the "modsig" or "d-modsig" field, then the
    modsig should be added to the measurement list when the file is appraised.
    
    And that is what normally happens, but if a measurement rule caused a file
    containing a modsig to be measured before a different rule causes it to be
    appraised, the resulting measurement entry will not contain the modsig
    because it is only fetched during appraisal. When the appraisal rule
    triggers, it won't store a new measurement containing the modsig because
    the file was already measured.
    
    We need to detect that situation and store an additional measurement with
    the modsig. This is done by adding an IMA_MEASURE action flag if we read a
    modsig and the IMA template contains a modsig field.
    Suggested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: default avatarThiago Jung Bauermann <bauerman@linux.ibm.com>
    Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    e5092255
ima.h 11.4 KB