lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

evm: limit verifying current security.evm integrity

Browse Source 
evm_protect_xattr unnecessarily validates the current security.evm
integrity, before updating non-evm protected extended attributes
and other file metadata. This patch limits validating the current
security.evm integrity to evm protected metadata.

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
This commit is contained in:
Mimi Zohar
2011-08-11 01:22:30 -04:00
parent fb88c2b6cb
commit a924ce0b35
1 changed files with 24 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
security/integrity/evm/evm_main.c
View File

@@ -158,21 +158,6 @@ enum integrity_status evm_verifyxattr(struct dentry *dentry,
} }
EXPORT_SYMBOL_GPL(evm_verifyxattr); EXPORT_SYMBOL_GPL(evm_verifyxattr);
/*
* evm_protect_xattr - protect the EVM extended attribute
*
* Prevent security.evm from being modified or removed.
*/
static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
const void *xattr_value, size_t xattr_value_len)
{
if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
}
return 0;
}
/* /*
* evm_verify_current_integrity - verify the dentry's metadata integrity * evm_verify_current_integrity - verify the dentry's metadata integrity
* @dentry: pointer to the affected dentry * @dentry: pointer to the affected dentry
@@ -189,6 +174,26 @@ static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
return evm_verify_hmac(dentry, NULL, NULL, 0, NULL); return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
} }
/*
* evm_protect_xattr - protect the EVM extended attribute
*
* Prevent security.evm from being modified or removed.
*/
static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
const void *xattr_value, size_t xattr_value_len)
{
enum integrity_status evm_status;
if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
} else if (!evm_protected_xattr(xattr_name))
return 0;
evm_status = evm_verify_current_integrity(dentry);
return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
}
/** /**
* evm_inode_setxattr - protect the EVM extended attribute * evm_inode_setxattr - protect the EVM extended attribute
* @dentry: pointer to the affected dentry * @dentry: pointer to the affected dentry
@@ -202,16 +207,8 @@ static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
const void *xattr_value, size_t xattr_value_len) const void *xattr_value, size_t xattr_value_len)
{ {
return evm_protect_xattr(dentry, xattr_name, xattr_value,
enum integrity_status evm_status; xattr_value_len);
int ret;
ret = evm_protect_xattr(dentry, xattr_name, xattr_value,
xattr_value_len);
if (ret)
return ret;
evm_status = evm_verify_current_integrity(dentry);
return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
} }
/** /**
@@ -224,14 +221,7 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
*/ */
int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name) int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name)
{ {
enum integrity_status evm_status; return evm_protect_xattr(dentry, xattr_name, NULL, 0);
int ret;
ret = evm_protect_xattr(dentry, xattr_name, NULL, 0);
if (ret)
return ret;
evm_status = evm_verify_current_integrity(dentry);
return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
} }
/** /**
@@ -286,7 +276,7 @@ int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
unsigned int ia_valid = attr->ia_valid; unsigned int ia_valid = attr->ia_valid;
enum integrity_status evm_status; enum integrity_status evm_status;
if (ia_valid & ~(ATTR_MODE | ATTR_UID | ATTR_GID)) if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)))
return 0; return 0;
evm_status = evm_verify_current_integrity(dentry); evm_status = evm_verify_current_integrity(dentry);
return evm_status == INTEGRITY_PASS ? 0 : -EPERM; return evm_status == INTEGRITY_PASS ? 0 : -EPERM;