@@ -6,6 +6,6 @@ obj-$(CONFIG_INTEGRITY_DIGEST_CACHE) += digest_cache.o
obj-$(CONFIG_DIGEST_CACHE_TLV_PARSER) += parsers/tlv.o
digest_cache-y := main.o secfs.o htable.o parsers.o populate.o modsig.o \
- verif.o dir.o
+ verif.o dir.o reset.o
CFLAGS_parsers.o += -DPARSERS_DIR=\"$(MODLIB)/kernel/security/integrity/digest_cache/parsers\"
@@ -206,6 +206,12 @@ digest_cache_dir_lookup_digest(struct dentry *dentry,
list_for_each_entry(dir_entry, &dir_cache->dir_entries, list) {
mutex_lock(&dir_entry->digest_cache_mutex);
+ if (dir_entry->digest_cache &&
+ test_bit(RESET, &dir_entry->digest_cache->flags)) {
+ digest_cache_put(dir_entry->digest_cache);
+ dir_entry->digest_cache = NULL;
+ }
+
if (!dir_entry->digest_cache) {
digest_list_path.dentry = NULL;
digest_list_path.mnt = NULL;
@@ -203,7 +203,8 @@ EXPORT_SYMBOL_GPL(digest_cache_htable_lookup);
* passed digest cache, obtained with digest_cache_get().
*
* Return: A digest cache reference if the digest is found, NULL if not, an
- * error pointer if dir digest cache changed since last get.
+ * error pointer if dir digest cache changed since last get, or digest
+ * cache was reset.
*/
struct digest_cache *digest_cache_lookup(struct dentry *dentry,
struct digest_cache *digest_cache,
@@ -211,6 +212,9 @@ struct digest_cache *digest_cache_lookup(struct dentry *dentry,
{
int ret;
+ if (test_bit(RESET, &digest_cache->flags))
+ return ERR_PTR(-EAGAIN);
+
if (test_bit(IS_DIR, &digest_cache->flags))
return digest_cache_dir_lookup_digest(dentry, digest_cache,
digest, algo);
@@ -21,6 +21,7 @@
#define DIR_PREFETCH 4 /* Prefetch enabled for dir. */
#define FILE_PREFETCH 5 /* Prefetch enabled for dir entry. */
#define FILE_READ 6 /* Digest cache for reading file. */
+#define RESET 7 /* Digest cache to be recreated. */
/**
* struct readdir_callback - Structure to store information for dir iteration
@@ -267,4 +268,16 @@ int digest_cache_dir_prefetch(struct dentry *dentry,
struct digest_cache *digest_cache);
void digest_cache_dir_free(struct digest_cache *digest_cache);
+/* reset.c */
+int digest_cache_path_truncate(const struct path *path);
+void digest_cache_file_release(struct file *file);
+int digest_cache_inode_unlink(struct inode *dir, struct dentry *dentry);
+int digest_cache_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
+ struct inode *new_dir, struct dentry *new_dentry);
+void digest_cache_inode_post_setxattr(struct dentry *dentry, const char *name,
+ const void *value, size_t size,
+ int flags);
+void digest_cache_inode_post_removexattr(struct dentry *dentry,
+ const char *name);
+
#endif /* _DIGEST_CACHE_INTERNAL_H */
@@ -436,6 +436,11 @@ struct digest_cache *digest_cache_get(struct file *file)
/* Serialize accesses to inode for which the digest cache is used. */
mutex_lock(&dig_sec->dig_user_mutex);
+ if (dig_sec->dig_user && test_bit(RESET, &dig_sec->dig_user->flags)) {
+ digest_cache_put(dig_sec->dig_user);
+ dig_sec->dig_user = NULL;
+ }
+
if (!dig_sec->dig_user) {
down_read(&default_path_sem);
/* Consume extra reference from digest_cache_create(). */
@@ -553,6 +558,13 @@ static struct security_hook_list digest_cache_hooks[] __ro_after_init = {
LSM_HOOK_INIT(inode_alloc_security, digest_cache_inode_alloc_security),
LSM_HOOK_INIT(inode_free_security_rcu,
digest_cache_inode_free_security_rcu),
+ LSM_HOOK_INIT(path_truncate, digest_cache_path_truncate),
+ LSM_HOOK_INIT(file_release, digest_cache_file_release),
+ LSM_HOOK_INIT(inode_unlink, digest_cache_inode_unlink),
+ LSM_HOOK_INIT(inode_rename, digest_cache_inode_rename),
+ LSM_HOOK_INIT(inode_post_setxattr, digest_cache_inode_post_setxattr),
+ LSM_HOOK_INIT(inode_post_removexattr,
+ digest_cache_inode_post_removexattr),
};
/**
new file mode 100644
@@ -0,0 +1,227 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
+ *
+ * Author: Roberto Sassu <roberto.sassu@huawei.com>
+ *
+ * Reset digest cache on digest lists/directory modifications.
+ */
+
+#define pr_fmt(fmt) "digest_cache: "fmt
+#include "internal.h"
+
+/**
+ * digest_cache_reset_clear_owner - Reset and clear dig_owner
+ * @inode: Inode of the digest list/directory containing the digest list
+ * @reason: Reason for reset and clear
+ *
+ * This function sets the RESET bit of the digest cache referenced by dig_owner
+ * of the passed inode, and puts and clears dig_owner.
+ *
+ * The next time they are called, digest_cache_get() and
+ * digest_cache_dir_lookup_digest() replace respectively dig_user and the digest
+ * cache of the directory entry.
+ */
+static void digest_cache_reset_clear_owner(struct inode *inode,
+ const char *reason)
+{
+ struct digest_cache_security *dig_sec;
+
+ dig_sec = digest_cache_get_security(inode);
+ if (unlikely(!dig_sec))
+ return;
+
+ mutex_lock(&dig_sec->dig_owner_mutex);
+ if (dig_sec->dig_owner) {
+ pr_debug("Resetting and clearing %s (dig_owner), reason: %s\n",
+ dig_sec->dig_owner->path_str, reason);
+ set_bit(RESET, &dig_sec->dig_owner->flags);
+ digest_cache_put(dig_sec->dig_owner);
+ dig_sec->dig_owner = NULL;
+ }
+ mutex_unlock(&dig_sec->dig_owner_mutex);
+}
+
+/**
+ * digest_cache_clear_user - Clear dig_user
+ * @inode: Inode of the file using the digest cache
+ * @filename: File name of the affected inode
+ * @reason: Reason for clear
+ *
+ * This function clears dig_user in the inode security blob, so that
+ * digest_cache_get() requests a new digest cache based on the updated digest
+ * list location.
+ */
+static void digest_cache_clear_user(struct inode *inode, const char *filename,
+ const char *reason)
+{
+ struct digest_cache_security *dig_sec;
+
+ dig_sec = digest_cache_get_security(inode);
+ if (unlikely(!dig_sec))
+ return;
+
+ mutex_lock(&dig_sec->dig_user_mutex);
+ if (dig_sec->dig_user && !test_bit(RESET, &dig_sec->dig_user->flags)) {
+ pr_debug("Clearing %s (dig_user of %s), reason: %s\n",
+ dig_sec->dig_user->path_str, filename, reason);
+ digest_cache_put(dig_sec->dig_user);
+ dig_sec->dig_user = NULL;
+ }
+ mutex_unlock(&dig_sec->dig_user_mutex);
+}
+
+/**
+ * digest_cache_path_truncate - A file is being truncated
+ * @path: File path
+ *
+ * This function is called when a file is being truncated. If the inode is a
+ * digest list and/or the parent is a directory containing digest lists, it
+ * resets the inode and/or directory dig_owner, to force rebuilding the digest
+ * cache.
+ *
+ * Return: Zero.
+ */
+int digest_cache_path_truncate(const struct path *path)
+{
+ struct inode *inode = d_backing_inode(path->dentry);
+ struct inode *dir = d_backing_inode(path->dentry->d_parent);
+
+ if (!S_ISREG(inode->i_mode))
+ return 0;
+
+ digest_cache_reset_clear_owner(inode, "path_truncate(file)");
+ digest_cache_reset_clear_owner(dir, "path_truncate(dir)");
+ return 0;
+}
+
+/**
+ * digest_cache_file_release - Last reference of a file desc is being released
+ * @file: File descriptor
+ *
+ * This function is called when the last reference of a file descriptor is
+ * being released. If the inode is a regular file and was opened for write or
+ * was created, it resets the inode and the parent directory dig_owner, to
+ * force rebuilding the digest caches.
+ */
+void digest_cache_file_release(struct file *file)
+{
+ struct inode *dir = d_backing_inode(file_dentry(file)->d_parent);
+
+ if (!S_ISREG(file_inode(file)->i_mode) ||
+ ((!(file->f_mode & FMODE_WRITE)) &&
+ !(file->f_mode & FMODE_CREATED)))
+ return;
+
+ digest_cache_reset_clear_owner(file_inode(file), "file_release(file)");
+ digest_cache_reset_clear_owner(dir, "file_release(dir)");
+}
+
+/**
+ * digest_cache_inode_unlink - An inode is being removed
+ * @dir: Inode of the affected directory
+ * @dentry: Dentry of the inode being removed
+ *
+ * This function is called when an existing inode is being removed. If the
+ * inode is a digest list/digest list directory, or the parent inode is the
+ * digest list directory and the inode is a regular file, it resets the
+ * affected inode dig_owner, to force rebuilding the digest cache.
+ *
+ * Return: Zero.
+ */
+int digest_cache_inode_unlink(struct inode *dir, struct dentry *dentry)
+{
+ struct inode *inode = d_backing_inode(dentry);
+
+ if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
+ return 0;
+
+ digest_cache_reset_clear_owner(inode, S_ISREG(inode->i_mode) ?
+ "inode_unlink(file)" :
+ "inode_unlink(dir)");
+
+ if (S_ISREG(inode->i_mode))
+ digest_cache_reset_clear_owner(dir, "inode_unlink(dir)");
+
+ return 0;
+}
+
+/**
+ * digest_cache_inode_rename - An inode is being renamed
+ * @old_dir: Inode of the directory containing the inode being renamed
+ * @old_dentry: Dentry of the inode being renamed
+ * @new_dir: Directory where the inode will be placed into
+ * @new_dentry: Dentry of the inode after being renamed
+ *
+ * This function is called when an existing inode is being moved from a
+ * directory to another (rename). If the inode is a digest list or the digest
+ * list directory, or that inode is a digest list moved from/to the digest list
+ * directory, it resets the affected inode dig_owner, to force rebuilding the
+ * digest cache.
+ *
+ * Return: Zero.
+ */
+int digest_cache_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
+ struct inode *new_dir, struct dentry *new_dentry)
+{
+ struct inode *old_inode = d_backing_inode(old_dentry);
+
+ if (!S_ISREG(old_inode->i_mode) && !S_ISDIR(old_inode->i_mode))
+ return 0;
+
+ digest_cache_reset_clear_owner(old_inode, S_ISREG(old_inode->i_mode) ?
+ "inode_rename(file)" :
+ "inode_rename(dir)");
+
+ if (S_ISREG(old_inode->i_mode)) {
+ digest_cache_reset_clear_owner(old_dir,
+ "inode_rename(from_dir)");
+ digest_cache_reset_clear_owner(new_dir,
+ "inode_rename(to_dir)");
+ }
+
+ return 0;
+}
+
+/**
+ * digest_cache_inode_post_setxattr - An xattr was set
+ * @dentry: File
+ * @name: Xattr name
+ * @value: Xattr value
+ * @size: Size of xattr value
+ * @flags: Flags
+ *
+ * This function is called after an xattr was set on an existing inode. If the
+ * inode points to a digest cache and the xattr set is security.digest_list, it
+ * puts and clears dig_user in the inode security blob, to force retrieving a
+ * fresh digest cache.
+ */
+void digest_cache_inode_post_setxattr(struct dentry *dentry, const char *name,
+ const void *value, size_t size, int flags)
+{
+ if (strcmp(name, XATTR_NAME_DIGEST_LIST))
+ return;
+
+ digest_cache_clear_user(d_backing_inode(dentry), dentry->d_name.name,
+ "inode_post_setxattr");
+}
+
+/**
+ * digest_cache_inode_post_removexattr - An xattr was removed
+ * @dentry: File
+ * @name: Xattr name
+ *
+ * This function is called after an xattr was removed from an existing inode.
+ * If the inode points to a digest cache and the xattr removed is
+ * security.digest_list, it puts and clears dig_user in the inode security
+ * blob, to force retrieving a fresh digest cache.
+ */
+void digest_cache_inode_post_removexattr(struct dentry *dentry,
+ const char *name)
+{
+ if (strcmp(name, XATTR_NAME_DIGEST_LIST))
+ return;
+
+ digest_cache_clear_user(d_backing_inode(dentry), dentry->d_name.name,
+ "inode_post_removexattr");
+}