| Message ID | 20200904092339.19598-5-roberto.sassu@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | IMA/EVM fixes | expand |
Hi Roberto, On Fri, 2020-09-04 at 11:23 +0200, Roberto Sassu wrote: > evm_inode_init_security() requires the HMAC key to calculate the HMAC on > initial xattrs provided by LSMs. Unfortunately, with the evm_key_loaded() > check, the function continues even if the HMAC key is not loaded > (evm_key_loaded() returns true also if EVM has been initialized only with a > public key). If the HMAC key is not loaded, evm_inode_init_security() > returns an error later when it calls evm_init_hmac(). This is all true, but the context for why it wasn't an issue previously is missing. The original usecase for allowing signature verificaton prior to loading the HMAC key was a fully signed, possibly immutable, initrd. No new files were created or, at least, were in policy until the HMAC key was loaded. More recently support for requiring an EVM HMAC key was removed. Files having a portable and immutable signature were given additional privileges. Please update the patch description with the context of what has changed. Mimi
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index e4b47759ba1c..4e9f5e8b21d5 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -527,7 +527,8 @@ int evm_inode_init_security(struct inode *inode, struct evm_xattr *xattr_data; int rc; - if (!evm_key_loaded() || !evm_protected_xattr(lsm_xattr->name)) + if (!(evm_initialized & EVM_INIT_HMAC) || + !evm_protected_xattr(lsm_xattr->name)) return 0; xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
evm_inode_init_security() requires the HMAC key to calculate the HMAC on initial xattrs provided by LSMs. Unfortunately, with the evm_key_loaded() check, the function continues even if the HMAC key is not loaded (evm_key_loaded() returns true also if EVM has been initialized only with a public key). If the HMAC key is not loaded, evm_inode_init_security() returns an error later when it calls evm_init_hmac(). Thus, this patch replaces the evm_key_loaded() check with a check of the EVM_INIT_HMAC flag in evm_initialized, so that evm_inode_init_security() returns 0 instead of an error. Cc: stable@vger.kernel.org # 4.5.x Fixes: 26ddabfe96b ("evm: enable EVM when X509 certificate is loaded") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> --- security/integrity/evm/evm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)