qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

evm: don't copy up 'security.evm' xattr 

JIRA: https://issues.redhat.com/browse/RHEL-29566

Upstream Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

Conflict: RHEL misses 39f60c1ccee7 ("fs: port xattr to mnt_idmap").

commit 40ca4ee3136d2d09977d1cab8c0c0e1582c3359d
Author: Mimi Zohar <zohar@linux.ibm.com>
Date:   Tue Dec 12 06:12:43 2023 -0500

    evm: don't copy up 'security.evm' xattr

    The security.evm HMAC and the original file signatures contain
    filesystem specific data.  As a result, the HMAC and signature
    are not the same on the stacked and backing filesystems.

    Don't copy up 'security.evm'.

    Reviewed-by: Amir Goldstein <amir73il@gmail.com>
    Reviewed-by: Christian Brauner <brauner@kernel.org>
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

Signed-off-by: Coiby Xu <coxu@redhat.com>
This commit is contained in:
Coiby Xu 2024-03-01 20:01:06 +08:00
parent 898884142d
commit 67e2fcb2f3
3 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/linux/evm.h
View File

@ -31,6 +31,7 @@ extern void evm_inode_post_setxattr(struct dentry *dentry,
const char *xattr_name,
const void *xattr_value,
size_t xattr_value_len);
extern int evm_inode_copy_up_xattr(const char *name);
extern int evm_inode_removexattr(struct user_namespace *mnt_userns,
struct dentry *dentry, const char *xattr_name);
extern void evm_inode_post_removexattr(struct dentry *dentry,
@ -102,6 +103,11 @@ static inline int evm_inode_removexattr(struct user_namespace *mnt_userns,
return 0;
}
static inline int evm_inode_copy_up_xattr(const char *name)
{
return 0;
}
static inline void evm_inode_post_removexattr(struct dentry *dentry,
const char *xattr_name)
{

7
security/integrity/evm/evm_main.c
View File

@ -840,6 +840,13 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
evm_update_evmxattr(dentry, NULL, NULL, 0);
}
int evm_inode_copy_up_xattr(const char *name)
{
if (strcmp(name, XATTR_NAME_EVM) == 0)
return 1; /* Discard */
return -EOPNOTSUPP;
}
/*
* evm_inode_init_security - initializes security.evm HMAC value
*/

2
security/security.c
View File

@ -1535,7 +1535,7 @@ int security_inode_copy_up_xattr(const char *name)
return rc;
}
return LSM_RET_DEFAULT(inode_copy_up_xattr);
return evm_inode_copy_up_xattr(name);
}
EXPORT_SYMBOL(security_inode_copy_up_xattr);