Commit 9ce5f5ac authored by Roberto Sassu's avatar Roberto Sassu Committed by Zheng Zengkai
Browse files

evm: Reset status even when security.evm is modified 



hulk inclusion
category: feature
feature: IMA Digest Lists extension
bugzilla: 46797

-------------------------------------------------

Without resetting the status when security.evm is modified, IMA appraisal
would continue to use the cached result and wouldn't detect whether the
meta_immutable requirement is still satisfied.

This patch calls evm_reset_status() in the post hooks when security.evm is
modified.

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: default avatarTianxing Zhang <zhangtianxing3@huawei.com>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent e8bfe1b7

security/integrity/evm/evm_main.c

+8 −2
Original line number Diff line number Diff line
@@ -211,7 +211,6 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, 
			evm_status = INTEGRITY_FAIL;

			goto out;

		}



		digest.hdr.algo = HASH_ALGO_SHA1;

		rc = evm_calc_hmac(dentry, xattr_name, xattr_value,

				   xattr_value_len, &digest);
@@ -618,7 +617,8 @@ bool evm_status_revalidate(const char *xattr_name) 
	if (!xattr_name)

		return true;



	if (!evm_protected_xattr(xattr_name) && !posix_xattr_acl(xattr_name))

	if (!evm_protected_xattr(xattr_name) && !posix_xattr_acl(xattr_name) &&

	    strcmp(xattr_name, XATTR_NAME_EVM))

		return false;



	return true;
@@ -645,6 +645,9 @@ void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name, 


	evm_reset_status(dentry->d_inode);



	if (!strcmp(xattr_name, XATTR_NAME_EVM))

		return;



	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);

}
@@ -665,6 +668,9 @@ void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name) 


	evm_reset_status(dentry->d_inode);



	if (!strcmp(xattr_name, XATTR_NAME_EVM))

		return;



	evm_update_evmxattr(dentry, xattr_name, NULL, 0);

}