Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a924ce0b authored by Mimi Zohar's avatar Mimi Zohar
Browse files

evm: limit verifying current security.evm integrity 



evm_protect_xattr unnecessarily validates the current security.evm
integrity, before updating non-evm protected extended attributes
and other file metadata. This patch limits validating the current
security.evm integrity to evm protected metadata.

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
parent fb88c2b6

security/integrity/evm/evm_main.c

+24 −34
Original line number Diff line number Diff line
@@ -158,21 +158,6 @@ enum integrity_status evm_verifyxattr(struct dentry *dentry, 
}

EXPORT_SYMBOL_GPL(evm_verifyxattr);



/*

 * evm_protect_xattr - protect the EVM extended attribute

 *

 * Prevent security.evm from being modified or removed.

 */

static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,

			     const void *xattr_value, size_t xattr_value_len)

{

	if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {

		if (!capable(CAP_SYS_ADMIN))

			return -EPERM;

	}

	return 0;

}



/*

 * evm_verify_current_integrity - verify the dentry's metadata integrity

 * @dentry: pointer to the affected dentry
@@ -189,6 +174,26 @@ static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) 
	return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);

}



/*

 * evm_protect_xattr - protect the EVM extended attribute

 *

 * Prevent security.evm from being modified or removed.

 */

static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,

			     const void *xattr_value, size_t xattr_value_len)

{

	enum integrity_status evm_status;



	if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {

		if (!capable(CAP_SYS_ADMIN))

			return -EPERM;

	} else if (!evm_protected_xattr(xattr_name))

		return 0;



	evm_status = evm_verify_current_integrity(dentry);

	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;

}



/**

 * evm_inode_setxattr - protect the EVM extended attribute

 * @dentry: pointer to the affected dentry
@@ -202,16 +207,8 @@ static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) 
int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,

		       const void *xattr_value, size_t xattr_value_len)

{



	enum integrity_status evm_status;

	int ret;



	ret = evm_protect_xattr(dentry, xattr_name, xattr_value,

	return evm_protect_xattr(dentry, xattr_name, xattr_value,

				 xattr_value_len);

	if (ret)

		return ret;

	evm_status = evm_verify_current_integrity(dentry);

	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;

}



/**
@@ -224,14 +221,7 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, 
 */

int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name)

{

	enum integrity_status evm_status;

	int ret;



	ret = evm_protect_xattr(dentry, xattr_name, NULL, 0);

	if (ret)

		return ret;

	evm_status = evm_verify_current_integrity(dentry);

	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;

	return evm_protect_xattr(dentry, xattr_name, NULL, 0);

}



/**
@@ -286,7 +276,7 @@ int evm_inode_setattr(struct dentry *dentry, struct iattr *attr) 
	unsigned int ia_valid = attr->ia_valid;

	enum integrity_status evm_status;



	if (ia_valid & ~(ATTR_MODE | ATTR_UID | ATTR_GID))

	if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)))

		return 0;

	evm_status = evm_verify_current_integrity(dentry);

	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;