linux-kernel - [PATCH v1 2/3] evm: skip integrity verification for newly created files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <5e9ede3ece0eb19bf5468826ea05aed5d8207cf1.1405078844.git.d.kasatkin@samsung.com>
Date:	Fri, 11 Jul 2014 14:47:00 +0300
From:	Dmitry Kasatkin <d.kasatkin@...sung.com>
To:	zohar@...ux.vnet.ibm.com, linux-ima-devel@...ts.sourceforge.net,
	linux-security-module@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, viro@...iv.linux.org.uk,
	linux-fsdevel@...r.kernel.org, dmitry.kasatkin@...il.com,
	Dmitry Kasatkin <d.kasatkin@...sung.com>
Subject: [PATCH v1 2/3] evm: skip integrity verification for newly created files

Newly created files do not get initial security.ima until close.
Setting xattr value before close fails because EVM fails to verify
integrity due to missing xattrs. Following is the example when it
happens:
  fd = open("foo", O_CREAT | O_WRONLY, 0644);
  setxattr("foo", "security.SMACK64", value, sizeof(value), 0);
  close(fd);

This patch skips integrity verification if IMA_NEW_FILE flag is set.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@...sung.com>
---
 security/integrity/evm/evm_main.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 3bcb80d..682e640 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -248,10 +248,14 @@ EXPORT_SYMBOL_GPL(evm_verifyxattr);
 static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
 {
 	struct inode *inode = dentry->d_inode;
+	struct integrity_iint_cache *iint;
 
 	if (!evm_initialized || !S_ISREG(inode->i_mode) || evm_fixmode)
 		return 0;
-	return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
+	iint = integrity_iint_find(inode);
+	if (iint && (iint->flags & IMA_NEW_FILE))
+		return 0;
+	return evm_verify_hmac(dentry, NULL, NULL, 0, iint);
 }
 
 /*
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/