Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1254092

[PATCHv3 6/6] evm: reset EVM status when file attributes changes

Show all headers | View raw

EVM verification status is cached in iint->evm_status
and if it was successful, never re-verified again when
IMA passes 'iint' to evm_verifyxattr().

When file attribute or extended attributes changes we may
wish to re-verify EVM integrity as well. For example,
after setting digital signature we may need to re-verify
the signature and update iint->flags that there is EVM
signature.

This patch enables that by resetting evm_status to
INTEGRITY_UKNOWN state.

Changes in v2:
* Flag setting moved to EVM layer

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
---
 security/integrity/evm/evm_main.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 420d94d..f716025 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -358,6 +358,15 @@ int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name)
 	return evm_protect_xattr(dentry, xattr_name, NULL, 0);
 }
 
+static void evm_reset_status(struct inode *inode)
+{
+	struct integrity_iint_cache *iint;
+
+	iint = integrity_iint_find(inode);
+	if (iint)
+		iint->evm_status = INTEGRITY_UNKNOWN;
+}
+
 /**
  * evm_inode_post_setxattr - update 'security.evm' to reflect the changes
  * @dentry: pointer to the affected dentry
@@ -378,6 +387,8 @@ void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name,
 				 && !posix_xattr_acl(xattr_name)))
 		return;
 
+	evm_reset_status(dentry->d_inode);
+
 	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
 }
 
@@ -396,6 +407,8 @@ void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name)
 	if (!evm_initialized || !evm_protected_xattr(xattr_name))
 		return;
 
+	evm_reset_status(dentry->d_inode);
+
 	evm_update_evmxattr(dentry, xattr_name, NULL, 0);
 }
 
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCHv3 0/6] integrity: few EVM patches Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 20:50 +0200
  [PATCHv3 2/6] evm: load x509 certificate from the kernel Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
  [PATCHv3 6/6] evm: reset EVM status when file attributes changes Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
  [PATCHv3 4/6] evm: provide a function to set EVM key from the kernel Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
    Re: [PATCHv3 4/6] evm: provide a function to set EVM key from the  kernel Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-10-23 20:40 +0200
      Re: [PATCHv3 4/6] evm: provide a function to set EVM key from the kernel Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-26 20:20 +0100
  [PATCHv3 5/6] evm: define EVM key max and min sizes Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
  [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted' keyring Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
    Re: [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted'  keyring Petko Manolov <petkan@mip-labs.com> - 2015-10-23 15:10 +0200
      RE: [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted'  keyring Dmitry Kasatkin <dmitry.kasatkin@huawei.com> - 2015-10-23 15:50 +0200
      Re: [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted'  keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-10-23 21:20 +0200
        Re: [PATCHv3 1/6] integrity: define '.evm' as a builtin 'trusted'  keyring Petko Manolov <petkan@mip-labs.com> - 2015-10-24 11:40 +0200
  [PATCHv3 3/6] evm: enable EVM when X509 certificate is loaded Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-22 21:00 +0200
    Re: [PATCHv3 3/6] evm: enable EVM when X509 certificate is loaded Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-10-23 20:40 +0200
      Re: [PATCHv3 3/6] evm: enable EVM when X509 certificate is loaded Dmitry Kasatkin <dmitry.kasatkin@gmail.com> - 2015-10-26 20:20 +0100

csiph-web