linux-toradex.git/security/integrity/evm, branch v4.17

evm: check for remount ro in progress before writing

2018-03-25T11:26:31+00:00

EVM might update the evm xattr while the VFS performs a remount to
readonly mode. This is not properly checked for, additionally check
the s_readonly_remount superblock flag before writing.

The bug can for example be observed with UBIFS. UBIFS checks the free
space on the device before and after a remount. With EVM enabled the
free space sometimes differs between both checks.

Signed-off-by: Sascha Hauer 
Signed-off-by: Mimi Zohar

evm: Constify *integrity_status_msg[]

2018-03-23T10:31:37+00:00

There is no gain from doing this except for some self-documenting.

Signed-off-by: Hernán Gonzalez 
Signed-off-by: Mimi Zohar

evm: Move evm_hmac and evm_hash from evm_main.c to evm_crypto.c

2018-03-23T10:31:37+00:00

These variables are not used where they are was defined.  There is no
point in declaring them there as extern.  Move and constify them, saving
2 bytes.

Function                                     old     new   delta
init_desc                                    273     271      -2
Total: Before=2112094, After=2112092, chg -0.00%

Signed-off-by: Hernán Gonzalez 
Tested-by: Fengguang Wu 
Signed-off-by: Mimi Zohar

EVM: Add support for portable signature format

2017-12-11T22:20:39+00:00

The EVM signature includes the inode number and (optionally) the
filesystem UUID, making it impractical to ship EVM signatures in
packages. This patch adds a new portable format intended to allow
distributions to include EVM signatures. It is identical to the existing
format but hardcodes the inode and generation numbers to 0 and does not
include the filesystem UUID even if the kernel is configured to do so.

Removing the inode means that the metadata and signature from one file
could be copied to another file without invalidating it. This is avoided
by ensuring that an IMA xattr is present during EVM validation.

Portable signatures are intended to be immutable - ie, they will never
be transformed into HMACs.

Based on earlier work by Dmitry Kasatkin and Mikhail Kurinnoi.

Signed-off-by: Matthew Garrett 
Cc: Dmitry Kasatkin 
Cc: Mikhail Kurinnoi 
Signed-off-by: Mimi Zohar

EVM: Allow userland to permit modification of EVM-protected metadata

2017-12-11T19:27:31+00:00

When EVM is enabled it forbids modification of metadata protected by
EVM unless there is already a valid EVM signature. If any modification
is made, the kernel will then generate a new EVM HMAC. However, this
does not map well on use cases which use only asymmetric EVM signatures,
as in this scenario the kernel is unable to generate new signatures.

This patch extends the /sys/kernel/security/evm interface to allow
userland to request that modification of these xattrs be permitted. This
is only permitted if no keys have already been loaded. In this
configuration, modifying the metadata will invalidate the EVM appraisal
on the file in question. This allows packaging systems to write out new
files, set the relevant extended attributes and then move them into
place.

There's also some refactoring of the use of evm_initialized in order to
avoid heading down codepaths that assume there's a key available.

Signed-off-by: Matthew Garrett 
Signed-off-by: Mimi Zohar

EVM: Only complain about a missing HMAC key once

2017-11-08T20:16:36+00:00

A system can validate EVM digital signatures without requiring an HMAC
key, but every EVM validation will generate a kernel error. Change this
so we only generate an error once.

Signed-off-by: Matthew Garrett 
Signed-off-by: Mimi Zohar

EVM: Allow userspace to signal an RSA key has been loaded

2017-11-08T20:16:36+00:00

EVM will only perform validation once a key has been loaded. This key
may either be a symmetric trusted key (for HMAC validation and creation)
or the public half of an asymmetric key (for digital signature
validation). The /sys/kernel/security/evm interface allows userland to
signal that a symmetric key has been loaded, but does not allow userland
to signal that an asymmetric public key has been loaded.

This patch extends the interface to permit userspace to pass a bitmask
of loaded key types. It also allows userspace to block loading of a
symmetric key in order to avoid a compromised system from being able to
load an additional key type later.

Signed-off-by: Matthew Garrett 
Signed-off-by: Mimi Zohar

EVM: Include security.apparmor in EVM measurements

2017-11-08T20:16:36+00:00

Apparmor will be gaining support for security.apparmor labels, and it
would be helpful to include these in EVM validation now so appropriate
signatures can be generated even before full support is merged.

Signed-off-by: Matthew Garrett 
Acked-by: John Johansen 
Signed-off-by: Mimi Zohar

fs: switch ->s_uuid to uuid_t

2017-06-05T14:59:12+00:00

For some file systems we still memcpy into it, but in various places this
already allows us to use the proper uuid helpers.  More to come..

Signed-off-by: Christoph Hellwig 
Reviewed-by: Amir Goldstein 
Acked-by: Mimi Zohar  (Changes to IMA/EVM)
Reviewed-by: Andy Shevchenko

sched/headers: Prepare to remove the include from

2017-03-02T07:42:40+00:00

Update files that depend on the magic.h inclusion.

Acked-by: Linus Torvalds 
Cc: Mike Galbraith 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar