Re: [PATCH v3 04/11] ima: Move ima_reset_appraise_flags() call to post hooks

[Mimi Zohar]

On Wed, 2020-12-02 at 11:56 +0000, Roberto Sassu wrote:
> > From: Roberto Sassu
> > Sent: Wednesday, November 11, 2020 10:23 AM
> > ima_inode_setxattr() and ima_inode_removexattr() hooks are called
> > before an
> > operation is performed. Thus, ima_reset_appraise_flags() should not be
> > called there, as flags might be unnecessarily reset if the operation is
> > denied.
> > 
> > This patch introduces the post hooks ima_inode_post_setxattr() and
> > ima_inode_post_removexattr(), removes ima_inode_removexattr() and
> > adds the
> > call to ima_reset_appraise_flags() in the new functions.
> 
> Removing ima_inode_removexattr() is not correct. We should still prevent
> that security.ima is removed when CAP_SYS_ADMIN is not set. I will fix
> this in the next version.

Ok.  So this patch will define the post hooks and defer
ima_reset_appraise_flags() to them, leaving the original hooks intact.

Mimi