summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorStefan Berger <stefanb@linux.ibm.com>2023-05-10 10:51:22 -0400
committerArmin Kuster <akuster808@gmail.com>2023-05-13 06:06:29 -0400
commit25dc18d6969c637bab14163aea0c95c80d3ed80c (patch)
tree9c3ceb26281011fb470b9e0eacef7d851a94895b
parent8a7112d37bfe0157289ed7e6baeb1d7e37707b29 (diff)
downloadmeta-security-25dc18d6969c637bab14163aea0c95c80d3ed80c.tar.gz
linux: overlayfs: Drop kernel patch resolving a file change notification issue
Revert the patch resolving a file change notitfication issue (for IMA appraisal) since this patch fails in 'many downstream kernels'. - https://lists.yoctoproject.org/g/yocto/message/59928 - https://lists.yoctoproject.org/g/yocto/message/59929 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
-rw-r--r--meta-integrity/recipes-kernel/linux/linux/0001-ovl-Increment-iversion-upon-file-changes.patch42
-rw-r--r--meta-integrity/recipes-kernel/linux/linux_ima.inc1
2 files changed, 0 insertions, 43 deletions
diff --git a/meta-integrity/recipes-kernel/linux/linux/0001-ovl-Increment-iversion-upon-file-changes.patch b/meta-integrity/recipes-kernel/linux/linux/0001-ovl-Increment-iversion-upon-file-changes.patch
deleted file mode 100644
index d2b5c28..0000000
--- a/meta-integrity/recipes-kernel/linux/linux/0001-ovl-Increment-iversion-upon-file-changes.patch
+++ /dev/null
@@ -1,42 +0,0 @@
1From e9ed62e8d1d3eee7ffe862d9812c5320d3b9bd88 Mon Sep 17 00:00:00 2001
2From: Stefan Berger <stefanb@linux.ibm.com>
3Date: Thu, 6 Apr 2023 11:27:29 -0400
4Subject: [PATCH] ovl: Increment iversion upon file changes
5
6This is a temporary patch for kernels that do not implement
7STATX_CHANGE_COOKIE (<= 6.2). The successor patch will be this one:
8
9https://lore.kernel.org/linux-integrity/20230418-engste-gastwirtschaft-601fb389bba5@brauner/T/#m3bf84296fe9e6499abb6e3191693948add2ff459
10
11Increment the lower inode's iversion for IMA to be able to recognize
12changes to the file.
13
14Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
15---
16 fs/overlayfs/file.c | 3 +++
17 1 file changed, 3 insertions(+)
18
19diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
20index 6011f955436b..1dfe5e7bfe1c 100644
21--- a/fs/overlayfs/file.c
22+++ b/fs/overlayfs/file.c
23@@ -13,6 +13,7 @@
24 #include <linux/security.h>
25 #include <linux/mm.h>
26 #include <linux/fs.h>
27+#include <linux/iversion.h>
28 #include "overlayfs.h"
29
30 struct ovl_aio_req {
31@@ -408,6 +409,8 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter)
32 if (ret != -EIOCBQUEUED)
33 ovl_aio_cleanup_handler(aio_req);
34 }
35+ if (ret > 0)
36+ inode_maybe_inc_iversion(inode, false);
37 out:
38 revert_creds(old_cred);
39 out_fdput:
40--
412.34.1
42
diff --git a/meta-integrity/recipes-kernel/linux/linux_ima.inc b/meta-integrity/recipes-kernel/linux/linux_ima.inc
index 9d48e5c..0b6f530 100644
--- a/meta-integrity/recipes-kernel/linux/linux_ima.inc
+++ b/meta-integrity/recipes-kernel/linux/linux_ima.inc
@@ -2,7 +2,6 @@ FILESEXTRAPATHS:append := "${THISDIR}/linux:"
2 2
3SRC_URI += " \ 3SRC_URI += " \
4 ${@bb.utils.contains('DISTRO_FEATURES', 'ima', 'file://ima.scc', '', d)} \ 4 ${@bb.utils.contains('DISTRO_FEATURES', 'ima', 'file://ima.scc', '', d)} \
5 file://0001-ovl-Increment-iversion-upon-file-changes.patch \
6" 5"
7 6
8do_configure() { 7do_configure() {