diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index aebf4cd9ad3b39689bb33fa53dc2dbb59f097847..f996c81fbf758fb946dcd192c45cecc4a5521c33 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6737,6 +6737,7 @@ CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y # CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set CONFIG_IMA_DIGEST_DB_MEGABYTES=16 CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists" +CONFIG_IMA_FIX_OVERLAYFS_DETECTION=y CONFIG_EVM=y # CONFIG_EVM_DEFAULT_HASH_SHA1 is not set CONFIG_EVM_DEFAULT_HASH_SHA256=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 5ba9d95ed62f8f75b104700d4687dfd822aebddb..25d0e88e888065bbdf2176e3270e4754b432a5fa 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7788,6 +7788,7 @@ CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y # CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set CONFIG_IMA_DIGEST_DB_MEGABYTES=16 CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists" +CONFIG_IMA_FIX_OVERLAYFS_DETECTION=y CONFIG_EVM=y # CONFIG_EVM_DEFAULT_HASH_SHA1 is not set CONFIG_EVM_DEFAULT_HASH_SHA256=y diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 9e254c5cb117210e0a5791517f95234996085cba..09f5d88d60e77ae84c203f5f43fa156b5d0e027a 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -370,7 +370,7 @@ config IMA_PARSER_BINARY_PATH This option defines the path of the parser binary. config IMA_FIX_OVERLAYFS_DETECTION - bool + bool "Fix for overlayfs backing inode change detection" default y help This option enables the fix for overlayfs backing inode change diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index ac5f82b2dd5894688958c6522ca9a725e8e9ac3d..c211a2c5f297be7bd469e9cbccdee161426bf115 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -267,7 +267,7 @@ static int process_measurement(struct file *file, const struct cred *cred, u32 secid, char *buf, loff_t size, int mask, enum ima_hooks func) { -#ifdef IMA_FIX_OVERLAYFS_DETECTION +#ifdef CONFIG_IMA_FIX_OVERLAYFS_DETECTION struct inode *backing_inode, *inode = file_inode(file); #else struct inode *inode = file_inode(file); @@ -348,7 +348,7 @@ static int process_measurement(struct file *file, const struct cred *cred, iint->measured_pcrs = 0; } -#ifdef IMA_FIX_OVERLAYFS_DETECTION +#ifdef CONFIG_IMA_FIX_OVERLAYFS_DETECTION /* Detect and re-evaluate changes made to the backing file. */ backing_inode = d_real_inode(file_dentry(file)); if (backing_inode != inode &&