Groups > linux.kernel > #1205778

[PATCH 3.16.y-ckt 071/118] evm: labeling pseudo filesystems exception

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod
From	Luis Henriques <luis.henriques@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.16.y-ckt 071/118] evm: labeling pseudo filesystems exception
Date	Wed, 12 Aug 2015 11:30:01 +0200
Message-ID	<pWAw9-dw-3@gated-at.bofh.it> (permalink)
References	<pWA37-7Qw-9@gated-at.bofh.it>
X-Original-To	linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com
X-Mailer	git-send-email 2.1.4
X-Extended-Stable	3.16
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	59
Organization	linux.* mail to news gateway
X-Original-Cc	Mimi Zohar <zohar@linux.vnet.ibm.com>, Luis Henriques <luis.henriques@canonical.com>
X-Original-Date	Wed, 12 Aug 2015 09:56:13 +0100
X-Original-Message-ID	<1439369820-27005-72-git-send-email-luis.henriques@canonical.com>
X-Original-References	<1439369820-27005-1-git-send-email-luis.henriques@canonical.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1205778

Show key headers only | View raw

3.16.7-ckt16 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mimi Zohar <zohar@linux.vnet.ibm.com>

commit 5101a1850bb7ccbf107929dee9af0cd2f400940f upstream.

To prevent offline stripping of existing file xattrs and relabeling of
them at runtime, EVM allows only newly created files to be labeled.  As
pseudo filesystems are not persistent, stripping of xattrs is not a
concern.

Some LSMs defer file labeling on pseudo filesystems.  This patch
permits the labeling of existing files on pseudo files systems.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
[ luis: backported to 3.16:
  - added magic.h header file ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 security/integrity/evm/evm_main.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 970772c731ff..41f32259437c 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -22,6 +22,7 @@
 #include <linux/xattr.h>
 #include <linux/integrity.h>
 #include <linux/evm.h>
+#include <linux/magic.h>
 #include <crypto/hash.h>
 #include "evm.h"
 
@@ -290,6 +291,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
 		iint = integrity_iint_find(dentry->d_inode);
 		if (iint && (iint->flags & IMA_NEW_FILE))
 			return 0;
+
+		/* exception for pseudo filesystems */
+		if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
+		    || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
+			return 0;
+
+		integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
+				    dentry->d_inode, dentry->d_name.name,
+				    "update_metadata",
+				    integrity_status_msg[evm_status],
+				    -EPERM, 0);
 	}
 out:
 	if (evm_status != INTEGRITY_PASS)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.16.y-ckt 071/118] evm: labeling pseudo filesystems exception Luis Henriques <luis.henriques@canonical.com> - 2015-08-12 11:30 +0200

csiph-web