diff options
| author | Roberto Sassu <roberto.sassu@huawei.com> | 2021-05-14 17:27:44 +0200 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2021-05-21 18:47:08 +0200 |
| commit | 9acc89d31f0c94c8e573ed61f3e4340bbd526d0c (patch) | |
| tree | bdd16363bef347fdd26f39735797816090f306cb /security | |
| parent | evm: Load EVM key in ima_load_x509() to avoid appraisal (diff) | |
| download | linux-9acc89d31f0c94c8e573ed61f3e4340bbd526d0c.tar.xz linux-9acc89d31f0c94c8e573ed61f3e4340bbd526d0c.zip | |
evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded
EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to
temporarily disable metadata verification until all xattrs/attrs necessary
to verify an EVM portable signature are copied to the file. This flag is
cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is
calculated on unverified xattrs/attrs.
Currently EVM unnecessarily denies setting this flag if EVM is initialized
with a public key, which is not a concern as it cannot be used to trust
xattrs/attrs updates. This patch removes this limitation.
Fixes: ae1ba1676b88e ("EVM: Allow userland to permit modification of EVM-protected metadata")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Cc: stable@vger.kernel.org # 4.16.x
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/integrity/evm/evm_secfs.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c index 0007d3362754..5f0da41bccd0 100644 --- a/security/integrity/evm/evm_secfs.c +++ b/security/integrity/evm/evm_secfs.c @@ -81,12 +81,12 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf, if (!i || (i & ~EVM_INIT_MASK) != 0) return -EINVAL; - /* Don't allow a request to freshly enable metadata writes if - * keys are loaded. + /* + * Don't allow a request to enable metadata writes if + * an HMAC key is loaded. */ if ((i & EVM_ALLOW_METADATA_WRITES) && - ((evm_initialized & EVM_KEY_MASK) != 0) && - !(evm_initialized & EVM_ALLOW_METADATA_WRITES)) + (evm_initialized & EVM_INIT_HMAC) != 0) return -EPERM; if (i & EVM_INIT_HMAC) { |