mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 04:21:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

evm: fix security.evm for a file with IMA signature

Browse Source 
When both IMA and EVM fix modes are enabled, accessing a file with IMA
signature but missing EVM HMAC won't cause security.evm to be fixed.

Add a function evm_fix_hmac which will be explicitly called to fix EVM
HMAC for this case.

Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Coiby Xu
2025-09-30 10:26:56 +08:00
committed by Mimi Zohar
parent a2e507afd9
commit 0ec959cf4b
3 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/linux/evm.h
View File

@@ -18,6 +18,8 @@ extern enum integrity_status evm_verifyxattr(struct dentry *dentry,
const char *xattr_name,
void *xattr_value,
size_t xattr_value_len);
int evm_fix_hmac(struct dentry *dentry, const char *xattr_name,
const char *xattr_value, size_t xattr_value_len);
int evm_inode_init_security(struct inode *inode, struct inode *dir,
const struct qstr *qstr, struct xattr *xattrs,
int *xattr_count);
@@ -51,6 +53,12 @@ static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
{
return INTEGRITY_UNKNOWN;
}
static inline int evm_fix_hmac(struct dentry *dentry, const char *xattr_name,
const char *xattr_value, size_t xattr_value_len)
{
return -EOPNOTSUPP;
}
#endif
static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,

28
security/integrity/evm/evm_main.c
View File

@@ -795,6 +795,34 @@ bool evm_revalidate_status(const char *xattr_name)
return true;
}
/**
* evm_fix_hmac - Calculate the HMAC and add it to security.evm for fix mode
* @dentry: pointer to the affected dentry which doesn't yet have security.evm
* xattr
* @xattr_name: pointer to the affected extended attribute name
* @xattr_value: pointer to the new extended attribute value
* @xattr_value_len: pointer to the new extended attribute value length
*
* Expects to be called with i_mutex locked.
*
* Return: 0 on success, -EPERM/-ENOMEM/-EOPNOTSUPP on failure
*/
int evm_fix_hmac(struct dentry *dentry, const char *xattr_name,
const char *xattr_value, size_t xattr_value_len)
{
if (!evm_fixmode || !evm_revalidate_status((xattr_name)))
return -EPERM;
if (!(evm_initialized & EVM_INIT_HMAC))
return -EPERM;
if (is_unsupported_hmac_fs(dentry))
return -EOPNOTSUPP;
return evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
}
/**
* evm_inode_post_setxattr - update 'security.evm' to reflect the changes
* @dentry: pointer to the affected dentry

5
security/integrity/ima/ima_appraise.c
View File

@@ -591,6 +591,11 @@ int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
if (!ima_fix_xattr(dentry, iint))
status = INTEGRITY_PASS;
} else if (status == INTEGRITY_NOLABEL) {
if (!evm_fix_hmac(dentry, XATTR_NAME_IMA,
(const char *)xattr_value,
xattr_len))
status = INTEGRITY_PASS;
}
/*