Commit 6db7d1de authored by Roberto Sassu's avatar Roberto Sassu Committed by Paul Moore
Browse files

evm: Align evm_inode_init_security() definition with LSM infrastructure 



Change the evm_inode_init_security() definition to align with the LSM
infrastructure. Keep the existing behavior of including in the HMAC
calculation only the first xattr provided by LSMs.

Changing the evm_inode_init_security() definition requires passing the
xattr array allocated by security_inode_init_security(), and the number of
xattrs filled by previously invoked LSMs.

Use the newly introduced lsm_get_xattr_slot() to position EVM correctly in
the xattrs array, like a regular LSM, and to increment the number of filled
slots. For now, the LSM infrastructure allocates enough xattrs slots to
store the EVM xattr, without using the reservation mechanism.

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Acked-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent baed456a

include/linux/evm.h

+8 −6
Original line number Diff line number Diff line
@@ -56,9 +56,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry, 
{

	return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);

}

extern int evm_inode_init_security(struct inode *inode,

				   const struct xattr *xattr_array,

				   struct xattr *evm);



int evm_inode_init_security(struct inode *inode, struct inode *dir,

			    const struct qstr *qstr, struct xattr *xattrs,

			    int *xattr_count);

extern bool evm_revalidate_status(const char *xattr_name);

extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);

extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
@@ -157,9 +158,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry, 
	return;

}



static inline int evm_inode_init_security(struct inode *inode,

					  const struct xattr *xattr_array,

					  struct xattr *evm)

static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,

					  const struct qstr *qstr,

					  struct xattr *xattrs,

					  int *xattr_count)

{

	return 0;

}

security/integrity/evm/evm_main.c

+10 −6
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
#include <linux/evm.h>

#include <linux/magic.h>

#include <linux/posix_acl_xattr.h>

#include <linux/lsm_hooks.h>



#include <crypto/hash.h>

#include <crypto/hash_info.h>
@@ -866,23 +867,26 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) 
/*

 * evm_inode_init_security - initializes security.evm HMAC value

 */

int evm_inode_init_security(struct inode *inode,

				 const struct xattr *lsm_xattr,

				 struct xattr *evm_xattr)

int evm_inode_init_security(struct inode *inode, struct inode *dir,

			    const struct qstr *qstr, struct xattr *xattrs,

			    int *xattr_count)

{

	struct evm_xattr *xattr_data;

	struct xattr *evm_xattr;

	int rc;



	if (!(evm_initialized & EVM_INIT_HMAC) ||

	    !evm_protected_xattr(lsm_xattr->name))

	if (!(evm_initialized & EVM_INIT_HMAC) || !xattrs ||

	    !evm_protected_xattr(xattrs->name))

		return 0;



	evm_xattr = lsm_get_xattr_slot(xattrs, xattr_count);



	xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);

	if (!xattr_data)

		return -ENOMEM;



	xattr_data->data.type = EVM_XATTR_HMAC;

	rc = evm_init_hmac(inode, lsm_xattr, xattr_data->digest);

	rc = evm_init_hmac(inode, xattrs, xattr_data->digest);

	if (rc < 0)

		goto out;

security/security.c

+2 −2
Original line number Diff line number Diff line
@@ -1647,8 +1647,8 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, 
	if (!xattr_count)

		goto out;



	ret = evm_inode_init_security(inode, new_xattrs,

				      &new_xattrs[xattr_count]);

	ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,

				      &xattr_count);

	if (ret)

		goto out;

	ret = initxattrs(inode, new_xattrs, fs_data);