diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 4a368f3a5964d0c29c8ba66dcbc7b47278a1072b..fc528818dfff1c8f3f3632c0dbb316a0f382b226 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7364,6 +7364,7 @@ CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y # CONFIG_IMA_CUSTOM_DIGEST_DB_SIZE is not set CONFIG_IMA_DIGEST_DB_MEGABYTES=16 CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists" +CONFIG_IMA_OVERLAYFS_DETECTION_BYPASS=y CONFIG_EVM=y # CONFIG_EVM_DEFAULT_HASH_SHA1 is not set CONFIG_EVM_DEFAULT_HASH_SHA256=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 38c191ea24be6190047e3eb2f35c998a86cb5852..2ade7462402dd87f83e4d49e67155592b023e9a5 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -8518,6 +8518,7 @@ CONFIG_IMA_STANDARD_DIGEST_DB_SIZE=y CONFIG_IMA_DIGEST_DB_MEGABYTES=16 CONFIG_IMA_PARSER_BINARY_PATH="/usr/bin/upload_digest_lists" CONFIG_EVM=y +CONFIG_IMA_OVERLAYFS_DETECTION_BYPASS=y # CONFIG_EVM_DEFAULT_HASH_SHA1 is not set CONFIG_EVM_DEFAULT_HASH_SHA256=y # CONFIG_EVM_DEFAULT_HASH_SHA512 is not set diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 46cb469e06ab2dee7ca809fba5b3848a40d3caeb..9d920d3ff4f099e1293d0f041d071757e2126df5 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -368,4 +368,12 @@ config IMA_PARSER_BINARY_PATH help This option defines the path of the parser binary. +config IMA_OVERLAYFS_DETECTION_BYPASS + bool "Bypass overlayfs backing inode change detection" + default n + help + This option enables user to bypass the overlayfs backing inode + change detection, while the detection may causes performance + regression. With this config enabled, IMA will not detect inode + change through i_version of the backing inode. If unsure, say N. endif diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index d29dc604e1d3a3b00e5d636b5ba6fc9ae35b1e0e..9b251ecfa7c2be797bdefd397c070257b925820c 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -282,7 +282,11 @@ static int process_measurement(struct file *file, const struct cred *cred, u32 secid, char *buf, loff_t size, int mask, enum ima_hooks func) { +#ifndef CONFIG_IMA_OVERLAYFS_DETECTION_BYPASS struct inode *backing_inode, *inode = file_inode(file); +#else + struct inode *inode = file_inode(file); +#endif struct integrity_iint_cache *iint = NULL; struct ima_template_desc *template_desc = NULL; char *pathbuf = NULL; @@ -362,6 +366,7 @@ static int process_measurement(struct file *file, const struct cred *cred, iint->measured_pcrs = 0; } +#ifndef CONFIG_IMA_OVERLAYFS_DETECTION_BYPASS /* Detect and re-evaluate changes made to the backing file. */ backing_inode = d_real_inode(file_dentry(file)); if (backing_inode != inode && @@ -374,6 +379,7 @@ static int process_measurement(struct file *file, const struct cred *cred, iint->measured_pcrs = 0; } } +#endif /* Determine if already appraised/measured based on bitmask * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,