Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Roberto Sassu 53124265fc evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded ... commit 9acc89d31f upstream. EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to temporarily disable metadata verification until all xattrs/attrs necessary to verify an EVM portable signature are copied to the file. This flag is cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is calculated on unverified xattrs/attrs. Currently EVM unnecessarily denies setting this flag if EVM is initialized with a public key, which is not a concern as it cannot be used to trust xattrs/attrs updates. This patch removes this limitation. Fixes: ae1ba1676b ("EVM: Allow userland to permit modification of EVM-protected metadata") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.16.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2021-07-14 16:55:46 +02:00
..
evm	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded	2021-07-14 16:55:46 +02:00
ima	ima: Fix the error code for restoring the PCR value	2021-05-14 09:50:30 +02:00
platform_certs	integrity: Load mokx variables into the blacklist keyring	2021-06-30 08:47:30 -04:00
digsig.c	fs/kernel_file_read: Add "offset" arg for partial reads	2020-10-05 13:37:04 +02:00
digsig_asymmetric.c	integrity-v5.10	2020-10-15 15:58:18 -07:00
iint.c	integrity: double check iint_cache was initialized	2021-03-30 14:31:55 +02:00
integrity.h	integrity: Add errno field in audit message	2020-07-16 21:48:11 -04:00
integrity_audit.c	integrity: Use current_uid() in integrity_audit_message()	2020-08-31 17:46:50 -04:00
Kconfig	powerpc: Load firmware trusted keys/hashes into kernel keyring	2019-11-13 00:33:23 +11:00
Makefile	powerpc: Load firmware trusted keys/hashes into kernel keyring	2019-11-13 00:33:23 +11:00