Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3e38df56 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar
Browse files

evm: provide option to protect additional SMACK xattrs 



Newer versions of SMACK introduced following security xattrs:
SMACK64EXEC, SMACK64TRANSMUTE and SMACK64MMAP.

To protect these xattrs, this patch includes them in the HMAC
calculation.  However, for backwards compatibility with existing
labeled filesystems, including these xattrs needs to be
configurable.

Changelog:
- Add SMACK dependency on new option (Mimi)

Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent d3b33679

security/integrity/evm/Kconfig

+17 −0
Original line number Diff line number Diff line
@@ -30,6 +30,23 @@ config EVM_ATTR_FSUUID 
	  additional info to the calculation, requires existing EVM

	  labeled file systems to be relabeled.



config EVM_EXTRA_SMACK_XATTRS

	bool "Additional SMACK xattrs"

	depends on EVM && SECURITY_SMACK

	default n

	help

	  Include additional SMACK xattrs for HMAC calculation.



	  In addition to the original security xattrs (eg. security.selinux,

	  security.SMACK64, security.capability, and security.ima) included

	  in the HMAC calculation, enabling this option includes newly defined

	  Smack xattrs: security.SMACK64EXEC, security.SMACK64TRANSMUTE and

	  security.SMACK64MMAP.



	  WARNING: changing the HMAC calculation method or adding

	  additional info to the calculation, requires existing EVM

	  labeled file systems to be relabeled.



endmenu



endif

security/integrity/evm/evm_main.c

+5 −0
Original line number Diff line number Diff line
@@ -40,6 +40,11 @@ char *evm_config_xattrnames[] = { 
#endif

#ifdef CONFIG_SECURITY_SMACK

	XATTR_NAME_SMACK,

#ifdef CONFIG_EVM_EXTRA_SMACK_XATTRS

	XATTR_NAME_SMACKEXEC,

	XATTR_NAME_SMACKTRANSMUTE,

	XATTR_NAME_SMACKMMAP,

#endif

#endif

#ifdef CONFIG_IMA_APPRAISE

	XATTR_NAME_IMA,