Commit bf6d0f5d authored by Mimi Zohar's avatar Mimi Zohar
Browse files

evm: posix acls modify i_mode 



The posix xattr acls are 'system' prefixed, which normally would not
affect security.evm.  An interesting side affect of writing posix xattr
acls is their modifying of the i_mode, which is included in security.evm.

This patch updates security.evm when posix xattr acls are written.

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
parent a924ce0b

include/linux/evm.h

+8 −0
Original line number Diff line number Diff line
@@ -33,6 +33,14 @@ extern void evm_inode_post_removexattr(struct dentry *dentry, 
extern int evm_inode_init_security(struct inode *inode,

				   const struct xattr *xattr_array,

				   struct xattr *evm);

#ifdef CONFIG_FS_POSIX_ACL

extern int posix_xattr_acl(const char *xattrname);

#else

static inline int posix_xattr_acl(const char *xattrname)

{

	return 0;

}

#endif

#else

#ifdef CONFIG_INTEGRITY

static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,

include/linux/xattr.h

+5 −0
Original line number Diff line number Diff line
@@ -52,6 +52,11 @@ 
#define XATTR_CAPS_SUFFIX "capability"

#define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX



#define XATTR_POSIX_ACL_ACCESS  "posix_acl_access"

#define XATTR_NAME_POSIX_ACL_ACCESS XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_ACCESS

#define XATTR_POSIX_ACL_DEFAULT  "posix_acl_default"

#define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT



#ifdef  __KERNEL__



#include <linux/types.h>

security/integrity/evm/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -4,3 +4,4 @@ 
obj-$(CONFIG_EVM) += evm.o



evm-y := evm_main.o evm_crypto.o evm_secfs.o

evm-$(CONFIG_FS_POSIX_ACL) += evm_posix_acl.o

security/integrity/evm/evm_main.c

+19 −5
Original line number Diff line number Diff line
@@ -177,7 +177,14 @@ static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) 
/*

 * evm_protect_xattr - protect the EVM extended attribute

 *

 * Prevent security.evm from being modified or removed.

 * Prevent security.evm from being modified or removed without the

 * necessary permissions or when the existing value is invalid.

 *

 * The posix xattr acls are 'system' prefixed, which normally would not

 * affect security.evm.  An interesting side affect of writing posix xattr

 * acls is their modifying of the i_mode, which is included in security.evm.

 * For posix xattr acls only, permit security.evm, even if it currently

 * doesn't exist, to be updated.

 */

static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,

			     const void *xattr_value, size_t xattr_value_len)
@@ -187,9 +194,15 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name, 
	if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {

		if (!capable(CAP_SYS_ADMIN))

			return -EPERM;

	} else if (!evm_protected_xattr(xattr_name))

	} else if (!evm_protected_xattr(xattr_name)) {

		if (!posix_xattr_acl(xattr_name))

			return 0;



		evm_status = evm_verify_current_integrity(dentry);

		if ((evm_status == INTEGRITY_PASS) ||

			(evm_status == INTEGRITY_NOLABEL))

			return 0;

		return -EPERM;

	}

	evm_status = evm_verify_current_integrity(dentry);

	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;

}
@@ -240,7 +253,8 @@ int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name) 
void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name,

			     const void *xattr_value, size_t xattr_value_len)

{

	if (!evm_initialized || !evm_protected_xattr(xattr_name))

	if (!evm_initialized || (!evm_protected_xattr(xattr_name)

				 && !posix_xattr_acl(xattr_name)))

		return;



	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);

security/integrity/evm/evm_posix_acl.c

0 → 100644
+26 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2011 IBM Corporation

 *

 * Author:

 * Mimi Zohar <zohar@us.ibm.com>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation, version 2 of the License.

 */



#include <linux/module.h>

#include <linux/xattr.h>



int posix_xattr_acl(char *xattr)

{

	int xattr_len = strlen(xattr);



	if ((strlen(XATTR_NAME_POSIX_ACL_ACCESS) == xattr_len)

	     && (strncmp(XATTR_NAME_POSIX_ACL_ACCESS, xattr, xattr_len) == 0))

		return 1;

	if ((strlen(XATTR_NAME_POSIX_ACL_DEFAULT) == xattr_len)

	     && (strncmp(XATTR_NAME_POSIX_ACL_DEFAULT, xattr, xattr_len) == 0))

		return 1;

	return 0;

}