Re: [PATCH v3 1/6] fs: ima: Remove S_IMA and IS_IMA()
From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2025-01-31 16:55:14
Also in:
linux-doc, linux-fsdevel, linux-integrity, lkml
On Wed, 2025-01-22 at 18:24 +0100, Roberto Sassu wrote:
From: Roberto Sassu <roberto.sassu@huawei.com>
Commit 196f518128d2e ("IMA: explicit IMA i_flag to remove global lock on
inode_delete") introduced the new S_IMA inode flag to determine whether or
not an inode was processed by IMA. In that way, it was not necessary to
take the global lock on inode delete.
Since commit 4de2f084fbff ("ima: Make it independent from 'integrity'
LSM"), the pointer of the inode integrity metadata managed by IMA has been
moved to the inode security blob, from the rb-tree. The pointer is not NULL
only if the inode has been processed by IMA, i.e. ima_inode_get() has been
called for that inode.
Thus, since the IS_IMA() check can be now implemented by trivially testing
whether or not the pointer of inode integrity metadata is NULL, remove the
S_IMA definition in include/linux/fs.h and also the IS_IMA() macro.
Remove also the IS_IMA() invocation in ima_rdwr_violation_check(), since
whether the inode was processed by IMA will be anyway detected by a
subsequent call to ima_iint_find(). It does not have an additional overhead
since the decision can be made in constant time, as opposed to logarithm
when the inode integrity metadata was stored in the rb-tree.
Suggested-by: Shu Han <redacted>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Acked-by: Jan Kara <jack@suse.cz>
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>Reviewd-by: Mimi Zohar [off-list ref]