Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6be5cc52 authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar
Browse files

evm: add support for different security.evm data types 



EVM protects a file's security extended attributes(xattrs) against integrity
attacks. The current patchset maintains an HMAC-sha1 value across the security
xattrs, storing the value as the extended attribute 'security.evm'. We
anticipate other methods for protecting the security extended attributes.
This patch reserves the first byte of 'security.evm' as a place holder for
the type of method.

Changelog v6:
- move evm_ima_xattr_type definition to security/integrity/integrity.h
- defined a structure for the EVM xattr called evm_ima_xattr_data
  (based on Serge Hallyn's suggestion)
- removed unnecessary memset

Signed-off-by: default avatarDmitry Kasatkin <dmitry.kasatkin@nokia.com>
Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
parent 66dbc325

include/linux/integrity.h

+1 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ enum integrity_status { 
	INTEGRITY_UNKNOWN,

};



/* List of EVM protected security xattrs */

#ifdef CONFIG_INTEGRITY

extern int integrity_inode_alloc(struct inode *inode);

extern void integrity_inode_free(struct inode *inode);

security/integrity/evm/evm_crypto.c

+7 −4
Original line number Diff line number Diff line
@@ -141,14 +141,17 @@ int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name, 
			const char *xattr_value, size_t xattr_value_len)

{

	struct inode *inode = dentry->d_inode;

	u8 hmac[SHA1_DIGEST_SIZE];

	struct evm_ima_xattr_data xattr_data;

	int rc = 0;



	rc = evm_calc_hmac(dentry, xattr_name, xattr_value,

			   xattr_value_len, hmac);

	if (rc == 0)

			   xattr_value_len, xattr_data.digest);

	if (rc == 0) {

		xattr_data.type = EVM_XATTR_HMAC;

		rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_EVM,

					   hmac, SHA1_DIGEST_SIZE, 0);

					   &xattr_data,

					   sizeof(xattr_data), 0);

	}

	else if (rc == -ENODATA)

		rc = inode->i_op->removexattr(dentry, XATTR_NAME_EVM);

	return rc;

security/integrity/evm/evm_main.c

+5 −5
Original line number Diff line number Diff line
@@ -51,20 +51,20 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, 
					     size_t xattr_value_len,

					     struct integrity_iint_cache *iint)

{

	char hmac_val[SHA1_DIGEST_SIZE];

	struct evm_ima_xattr_data xattr_data;

	int rc;



	if (iint->hmac_status != INTEGRITY_UNKNOWN)

		return iint->hmac_status;



	memset(hmac_val, 0, sizeof hmac_val);

	rc = evm_calc_hmac(dentry, xattr_name, xattr_value,

			   xattr_value_len, hmac_val);

			   xattr_value_len, xattr_data.digest);

	if (rc < 0)

		return INTEGRITY_UNKNOWN;



	rc = vfs_xattr_cmp(dentry, XATTR_NAME_EVM, hmac_val, sizeof hmac_val,

			   GFP_NOFS);

	xattr_data.type = EVM_XATTR_HMAC;

	rc = vfs_xattr_cmp(dentry, XATTR_NAME_EVM, (u8 *)&xattr_data,

			   sizeof xattr_data, GFP_NOFS);

	if (rc < 0)

		goto err_out;

	iint->hmac_status = INTEGRITY_PASS;

security/integrity/integrity.h

+11 −0
Original line number Diff line number Diff line
@@ -18,6 +18,17 @@ 
/* iint cache flags */

#define IMA_MEASURED		0x01



enum evm_ima_xattr_type {

	IMA_XATTR_DIGEST = 0x01,

	EVM_XATTR_HMAC,

	EVM_IMA_XATTR_DIGSIG,

};



struct evm_ima_xattr_data {

	u8 type;

	u8 digest[SHA1_DIGEST_SIZE];

}  __attribute__((packed));



/* integrity data associated with an inode */

struct integrity_iint_cache {

	struct rb_node rb_node; /* rooted in integrity_iint_tree */