evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded

stable inclusion
from linux-4.19.198
commit 77c94b2a1deea733e2796a2da7b637c1afd0cdb8

--------------------------------

commit 9acc89d3 upstream.

EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to
temporarily disable metadata verification until all xattrs/attrs necessary
to verify an EVM portable signature are copied to the file. This flag is
cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is
calculated on unverified xattrs/attrs.

Currently EVM unnecessarily denies setting this flag if EVM is initialized
with a public key, which is not a concern as it cannot be used to trust
xattrs/attrs updates. This patch removes this limitation.

Fixes: ae1ba167 ("EVM: Allow userland to permit modification of EVM-protected metadata")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Cc: stable@vger.kernel.org # 4.16.x
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Conflicts:
  security/integrity/evm/evm_secfs.c
[yyl: keep same as mainline]
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>