lkml.org 
[lkml]   [2020]   [Sep]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2 06/12] evm: Refuse EVM_ALLOW_METADATA_WRITES only if the HMAC key is loaded
    Date
    EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to
    temporarily disable metadata verification until all xattrs/attrs necessary
    to verify an EVM portable signature are copied to the file. This flag is
    cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is
    calculated on unverified xattrs/attrs.

    Currently EVM unnecessarily denies setting this flag if EVM is initialized
    with public key, which is not a concern as it cannot be used to trust
    xattrs/attrs updates. This patch removes this limitation.

    Cc: stable@vger.kernel.org # 4.16.x
    Fixes: ae1ba1676b88e ("EVM: Allow userland to permit modification of EVM-protected metadata")
    Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    ---
    Documentation/ABI/testing/evm | 6 ++++--
    security/integrity/evm/evm_secfs.c | 2 +-
    2 files changed, 5 insertions(+), 3 deletions(-)

    diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
    index 201d10319fa1..cbb50ab09c78 100644
    --- a/Documentation/ABI/testing/evm
    +++ b/Documentation/ABI/testing/evm
    @@ -42,8 +42,10 @@ Description:
    modification of EVM-protected metadata and
    disable all further modification of policy

    - Note that once a key has been loaded, it will no longer be
    - possible to enable metadata modification.
    + Note that once HMAC validation and creation is enabled,
    + it will no longer be possible to enable metadata modification
    + and if metadata modification is already enabled, it will be
    + disabled.

    Until key loading has been signaled EVM can not create
    or validate the 'security.evm' xattr, but returns
    diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
    index cfc3075769bb..92fe26ace797 100644
    --- a/security/integrity/evm/evm_secfs.c
    +++ b/security/integrity/evm/evm_secfs.c
    @@ -84,7 +84,7 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf,
    * keys are loaded.
    */
    if ((i & EVM_ALLOW_METADATA_WRITES) &&
    - ((evm_initialized & EVM_KEY_MASK) != 0) &&
    + ((evm_initialized & EVM_INIT_HMAC) != 0) &&
    !(evm_initialized & EVM_ALLOW_METADATA_WRITES))
    return -EPERM;

    --
    2.27.GIT
    \
     
     \ /
      Last update: 2020-09-04 11:31    [W:3.616 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site