| From f5acb3dcba1ffb7f0b8cbb9dba61500eea5d610b Mon Sep 17 00:00:00 2001 |
| From: Mimi Zohar <zohar@linux.vnet.ibm.com> |
| Date: Wed, 2 Nov 2016 09:14:16 -0400 |
| Subject: Revert "ima: limit file hash setting by user to fix and log modes" |
| |
| From: Mimi Zohar <zohar@linux.vnet.ibm.com> |
| |
| commit f5acb3dcba1ffb7f0b8cbb9dba61500eea5d610b upstream. |
| |
| Userspace applications have been modified to write security xattrs, |
| but they are not context aware. In the case of security.ima, the |
| security xattr can be either a file hash or a file signature. |
| Permitting writing one, but not the other requires the application to |
| be context aware. |
| |
| In addition, userspace applications might write files to a staging |
| area, which might not be in policy, and then change some file metadata |
| (eg. owner) making it in policy. As a result, these files are not |
| labeled properly. |
| |
| This reverts commit c68ed80c97d9720f51ef31fe91560fdd1e121533, which |
| prevents writing file hashes as security.ima xattrs. |
| |
| Requested-by: Patrick Ohly <patrick.ohly@intel.com> |
| Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> |
| Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> |
| Cc: Mike Rapoport <rppt@linux.vnet.ibm.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| security/integrity/ima/ima_appraise.c | 8 ++------ |
| 1 file changed, 2 insertions(+), 6 deletions(-) |
| |
| --- a/security/integrity/ima/ima_appraise.c |
| +++ b/security/integrity/ima/ima_appraise.c |
| @@ -383,14 +383,10 @@ int ima_inode_setxattr(struct dentry *de |
| result = ima_protect_xattr(dentry, xattr_name, xattr_value, |
| xattr_value_len); |
| if (result == 1) { |
| - bool digsig; |
| - |
| if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST)) |
| return -EINVAL; |
| - digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG); |
| - if (!digsig && (ima_appraise & IMA_APPRAISE_ENFORCE)) |
| - return -EPERM; |
| - ima_reset_appraise_flags(d_backing_inode(dentry), digsig); |
| + ima_reset_appraise_flags(d_backing_inode(dentry), |
| + (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0); |
| result = 0; |
| } |
| return result; |