Commit eafb121e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'integrity-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity 

Pull integrity updates from Mimi Zohar:
 "Just two bug fixes"

* tag 'integrity-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  efi: Correct Macmini DMI match in uefi cert quirk
  ima: fix blocking of security.ima xattrs of unsupported algorithms
parents 74a0f845 bab715bd

security/integrity/ima/ima_appraise.c

+8 −4
Original line number Diff line number Diff line
@@ -750,22 +750,26 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, 
	const struct evm_ima_xattr_data *xvalue = xattr_value;

	int digsig = 0;

	int result;

	int err;



	result = ima_protect_xattr(dentry, xattr_name, xattr_value,

				   xattr_value_len);

	if (result == 1) {

		if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))

			return -EINVAL;



		err = validate_hash_algo(dentry, xvalue, xattr_value_len);

		if (err)

			return err;



		digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);

	} else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {

		digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);

	}

	if (result == 1 || evm_revalidate_status(xattr_name)) {

		result = validate_hash_algo(dentry, xvalue, xattr_value_len);

		if (result)

			return result;



		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);

		if (result == 1)

			result = 0;

	}

	return result;

}

security/integrity/platform_certs/load_uefi.c

+1 −1
Original line number Diff line number Diff line
@@ -31,7 +31,7 @@ static const struct dmi_system_id uefi_skip_cert[] = { 
	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },

	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },

	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },

	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacMini8,1") },

	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },

	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },

	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },

	{ UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },