archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 03:44:45 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()

Browse source 
Commit 8e5d9f916a ("smack: deduplicate xattr setting in
smack_inode_init_security()") introduced xattr_dupval() to simplify setting
the xattrs to be provided by the SMACK LSM on inode creation, in the
smack_inode_init_security().

Unfortunately, moving lsm_get_xattr_slot() caused the SMACK64TRANSMUTE
xattr be added in the array of new xattrs before SMACK64. This causes the
HMAC of xattrs calculated by evm_init_hmac() for new files to diverge from
the one calculated by both evm_calc_hmac_or_hash() and evmctl.

evm_init_hmac() calculates the HMAC of the xattrs of new files based on the
order LSMs provide them, while evm_calc_hmac_or_hash() and evmctl calculate
the HMAC based on an ordered xattrs list.

Fix the issue by making evm_init_hmac() calculate the HMAC of new files
based on the ordered xattrs list too.

Fixes: 8e5d9f916a ("smack: deduplicate xattr setting in smack_inode_init_security()")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Roberto Sassu 2026-01-20 15:53:41 +01:00 • committed by Mimi Zohar
parent 377cae9851
commit 0496fc9cdc
1 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
security/integrity/evm/evm_crypto.c
View file

@ -401,6 +401,7 @@ int evm_init_hmac(struct inode *inode, const struct xattr *xattrs,
{
struct shash_desc *desc;
const struct xattr *xattr;
struct xattr_list *xattr_entry;
desc = init_desc(EVM_XATTR_HMAC, HASH_ALGO_SHA1);
if (IS_ERR(desc)) {
@ -408,11 +409,16 @@ int evm_init_hmac(struct inode *inode, const struct xattr *xattrs,
return PTR_ERR(desc);
}
for (xattr = xattrs; xattr->name; xattr++) {
if (!evm_protected_xattr(xattr->name))
continue;
list_for_each_entry_lockless(xattr_entry, &evm_config_xattrnames,
list) {
for (xattr = xattrs; xattr->name; xattr++) {
if (strcmp(xattr_entry->name +
XATTR_SECURITY_PREFIX_LEN, xattr->name) != 0)
continue;
crypto_shash_update(desc, xattr->value, xattr->value_len);
crypto_shash_update(desc, xattr->value,
xattr->value_len);
}
}
hmac_add_misc(desc, inode, EVM_XATTR_HMAC, hmac_val);