| Message ID | 20240130214620.3155380-3-stefanb@linux.ibm.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | evm: Support signatures on stacked filesystem | expand |
On Tue, Jan 30, 2024 at 11:46 PM Stefan Berger <stefanb@linux.ibm.com> wrote: > > To support portable and immutable signatures on otherwise unsupported > filesystems, determine the EVM signature type by the content of a file's > xattr. If the file has the appropriate signature then allow it to be > copied up. All other signature types are discarded as before. > > Portable and immutable EVM signatures can be copied up by stacked file- > system since the metadata their signature covers does not include file- > system-specific data such as a file's inode number, generation, and UUID. > > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> > --- > security/integrity/evm/evm_main.c | 27 ++++++++++++++++++++++++--- > 1 file changed, 24 insertions(+), 3 deletions(-) > > diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c > index 2555aa4501ae..22a5e26860ea 100644 > --- a/security/integrity/evm/evm_main.c > +++ b/security/integrity/evm/evm_main.c > @@ -898,9 +898,30 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) > > int evm_inode_copy_up_xattr(struct dentry *src, const char *name) > { > - if (strcmp(name, XATTR_NAME_EVM) == 0) > - return 1; /* Discard */ > - return -EOPNOTSUPP; > + struct evm_ima_xattr_data *xattr_data = NULL; > + int rc; > + > + if (strcmp(name, XATTR_NAME_EVM) != 0) > + return -EOPNOTSUPP; > + > + /* first need to know the sig type */ > + rc = vfs_getxattr_alloc(&nop_mnt_idmap, src, XATTR_NAME_EVM, > + (char **)&xattr_data, 0, GFP_NOFS); See my suggestion for post-getxattr hook: security_inode_copy_up_xattr(name, value, size) to avoid using nop_mnt_idmap here. Unless it is fine to use nop_mnt_idmap in this context? not sure. Thanks, Amir.
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 2555aa4501ae..22a5e26860ea 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -898,9 +898,30 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) int evm_inode_copy_up_xattr(struct dentry *src, const char *name) { - if (strcmp(name, XATTR_NAME_EVM) == 0) - return 1; /* Discard */ - return -EOPNOTSUPP; + struct evm_ima_xattr_data *xattr_data = NULL; + int rc; + + if (strcmp(name, XATTR_NAME_EVM) != 0) + return -EOPNOTSUPP; + + /* first need to know the sig type */ + rc = vfs_getxattr_alloc(&nop_mnt_idmap, src, XATTR_NAME_EVM, + (char **)&xattr_data, 0, GFP_NOFS); + if (rc <= 0) + return -EPERM; + + switch (xattr_data->type) { + case EVM_XATTR_PORTABLE_DIGSIG: + rc = 0; /* allow copy-up */ + break; + case EVM_XATTR_HMAC: + case EVM_IMA_XATTR_DIGSIG: + default: + rc = 1; /* discard */ + } + + kfree(xattr_data); + return rc; } /*
To support portable and immutable signatures on otherwise unsupported filesystems, determine the EVM signature type by the content of a file's xattr. If the file has the appropriate signature then allow it to be copied up. All other signature types are discarded as before. Portable and immutable EVM signatures can be copied up by stacked file- system since the metadata their signature covers does not include file- system-specific data such as a file's inode number, generation, and UUID. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> --- security/integrity/evm/evm_main.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-)