lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 203/862] ima: fix blocking of security.ima xattrs of unsupported algorithms
    Date
    From: Mimi Zohar <zohar@linux.ibm.com>

    [ Upstream commit 5926586f291b53cb8a0c9631fc19489be1186e2d ]

    Limit validating the hash algorithm to just security.ima xattr, not
    the security.evm xattr or any of the protected EVM security xattrs,
    nor posix acls.

    Fixes: 50f742dd9147 ("IMA: block writes of the security.ima xattr with unsupported algorithms")
    Reported-by: Christian Brauner <brauner@kernel.org>
    Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org>
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/integrity/ima/ima_appraise.c | 12 ++++++++----
    1 file changed, 8 insertions(+), 4 deletions(-)

    diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
    index bde74fcecee3..3e0fbbd99534 100644
    --- a/security/integrity/ima/ima_appraise.c
    +++ b/security/integrity/ima/ima_appraise.c
    @@ -750,22 +750,26 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
    const struct evm_ima_xattr_data *xvalue = xattr_value;
    int digsig = 0;
    int result;
    + int err;

    result = ima_protect_xattr(dentry, xattr_name, xattr_value,
    xattr_value_len);
    if (result == 1) {
    if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
    return -EINVAL;
    +
    + err = validate_hash_algo(dentry, xvalue, xattr_value_len);
    + if (err)
    + return err;
    +
    digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
    } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
    digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
    }
    if (result == 1 || evm_revalidate_status(xattr_name)) {
    - result = validate_hash_algo(dentry, xvalue, xattr_value_len);
    - if (result)
    - return result;
    -
    ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
    + if (result == 1)
    + result = 0;
    }
    return result;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 12:50    [W:2.454 / U:0.556 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site