On Tue, 2021-05-11 at 14:54 +0000, Roberto Sassu wrote:

quoted

On Tue, 2021-05-11 at 14:21 +0000, Roberto Sassu wrote:

quoted

quoted

On Wed, 2021-05-05 at 13:33 +0200, Roberto Sassu wrote:

quoted

With the patch to allow xattr/attr operations if a portable signature
verification fails, cp and tar can copy all xattrs/attrs so that at the
end of the process verification succeeds.

However, it might happen that the xattrs/attrs are already set to the
correct value (taken at signing time) and signature verification succeeds
before the copy has completed. For example, an archive might contains

files

quoted

quoted

quoted

owned by root and the archive is extracted by root.

Then, since portable signatures are immutable, all subsequent operations
fail (e.g. fchown()), even if the operation is legitimate (does not alter
the current value).

This patch avoids this problem by reporting successful operation to user
space when that operation does not alter the current value of

xattrs/attrs.

quoted

quoted

I must be missing something.  If both the IMA and EVM status flags are
reset after xattr or attr modification, do we really need to prevent
any metadata - same or different - changes?  Both evm_protect_xattr()
and evm_inode_setattr() would need to be modified to allow
INTEGRITY_PASS_IMMUTABLE.

yes, given that the IMA and EVM flags are reset, it should not be
a problem to allow changes. However, I think it is useful to keep
the current behavior. For example, it would prevent an accidental
change of the SELinux label during the relabeling process.

I understand we might want to prevent accidental or malicious changes,
but that isn't the purpose of this patch set.  The patch description
would also need to be updated to reflect the real purpose.

We would be changing the expectation that metadata changes
are denied, which was defined with the original patches.

I would prefer to keep the current behavior, but if your suggestion
is to allow metadata changes, I will modify the patch set.

Please re-write the patch description appropriately.

thanks,

Mimi