diff options
author | Dmitry Kasatkin <d.kasatkin@samsung.com> | 2014-09-02 09:31:43 -0400 |
---|---|---|
committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2014-09-09 10:26:10 -0400 |
commit | 3dcbad52cf18c3c379e96b992d22815439ebbe53 (patch) | |
tree | a5766bd074a95c62e2c67ccf3a72608a6929bb60 /security/integrity | |
parent | b151d6b00bbb798c58f2f21305e7d43fa763f34f (diff) |
evm: properly handle INTEGRITY_NOXATTRS EVM status
Unless an LSM labels a file during d_instantiate(), newly created
files are not labeled with an initial security.evm xattr, until
the file closes. EVM, before allowing a protected, security xattr
to be written, verifies the existing 'security.evm' value is good.
For newly created files without a security.evm label, this
verification prevents writing any protected, security xattrs,
until the file closes.
Following is the example when this happens:
fd = open("foo", O_CREAT | O_WRONLY, 0644);
setxattr("foo", "security.SMACK64", value, sizeof(value), 0);
close(fd);
While INTEGRITY_NOXATTRS status is handled in other places, such
as evm_inode_setattr(), it does not handle it in all cases in
evm_protect_xattr(). By limiting the use of INTEGRITY_NOXATTRS to
newly created files, we can now allow setting "protected" xattrs.
Changelog:
- limit the use of INTEGRITY_NOXATTRS to IMA identified new files
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org> 3.14+
Diffstat (limited to 'security/integrity')
-rw-r--r-- | security/integrity/evm/evm_main.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 40220124364c..9685af330de5 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c | |||
@@ -285,6 +285,13 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, | |||
285 | goto out; | 285 | goto out; |
286 | } | 286 | } |
287 | evm_status = evm_verify_current_integrity(dentry); | 287 | evm_status = evm_verify_current_integrity(dentry); |
288 | if (evm_status == INTEGRITY_NOXATTRS) { | ||
289 | struct integrity_iint_cache *iint; | ||
290 | |||
291 | iint = integrity_iint_find(dentry->d_inode); | ||
292 | if (iint && (iint->flags & IMA_NEW_FILE)) | ||
293 | return 0; | ||
294 | } | ||
288 | out: | 295 | out: |
289 | if (evm_status != INTEGRITY_PASS) | 296 | if (evm_status != INTEGRITY_PASS) |
290 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode, | 297 | integrity_audit_msg(AUDIT_INTEGRITY_METADATA, dentry->d_inode, |