On Wed, 2020-12-02 at 11:56 +0000, Roberto Sassu wrote:

quoted

From: Roberto Sassu
Sent: Wednesday, November 11, 2020 10:23 AM
ima_inode_setxattr() and ima_inode_removexattr() hooks are called
before an
operation is performed. Thus, ima_reset_appraise_flags() should not be
called there, as flags might be unnecessarily reset if the operation is
denied.

This patch introduces the post hooks ima_inode_post_setxattr() and
ima_inode_post_removexattr(), removes ima_inode_removexattr() and
adds the
call to ima_reset_appraise_flags() in the new functions.

Removing ima_inode_removexattr() is not correct. We should still prevent
that security.ima is removed when CAP_SYS_ADMIN is not set. I will fix
this in the next version.

Ok.  So this patch will define the post hooks and defer
ima_reset_appraise_flags() to them, leaving the original hooks intact.

Mimi