The logic for comparing kstat.change_cookie against IMA version is hard to read. Abstract comparison logic into a new function integrity_inode_attrs_stat_changed().
No functional change intended. Signed-off-by: Frederick Lawler <[email protected]> --- include/linux/integrity.h | 11 +++++++++++ security/integrity/ima/ima_main.c | 4 ++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/include/linux/integrity.h b/include/linux/integrity.h index f5842372359be5341b6870a43b92e695e8fc78af..beb9ab19fa6257e79266b58bcb5f55b0c5445828 100644 --- a/include/linux/integrity.h +++ b/include/linux/integrity.h @@ -49,6 +49,17 @@ integrity_inode_attrs_store(struct integrity_inode_attributes *attrs, attrs->ino = inode->i_ino; } +/* Compares stat attributes for change detection. */ +static inline bool +integrity_inode_attrs_stat_changed +(const struct integrity_inode_attributes *attrs, const struct kstat *stat) +{ + if (stat->result_mask & STATX_CHANGE_COOKIE) + return stat->change_cookie != attrs->version; + + return true; +} + /* * On stacked filesystems detect whether the inode or its content has changed. */ diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 5770cf691912aa912fc65280c59f5baac35dd725..6570ad10887b9ea1172c78274cf62482350e87ff 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -201,8 +201,8 @@ static void ima_check_last_writer(struct ima_iint_cache *iint, vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE, AT_STATX_SYNC_AS_STAT) || - !(stat.result_mask & STATX_CHANGE_COOKIE) || - stat.change_cookie != iint->real_inode.version) { + integrity_inode_attrs_stat_changed(&iint->real_inode, + &stat)) { iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE); iint->measured_pcrs = 0; if (update) -- 2.43.0
