Roberto Sassu d7dfaf13d2 evm: Execute evm_inode_init_security() only when an HMAC key is loaded ... commit 9eea290429 upstream. evm_inode_init_security() requires an HMAC key to calculate the HMAC on initial xattrs provided by LSMs. However, it checks generically whether a key has been loaded, including also public keys, which is not correct as public keys are not suitable to calculate the HMAC. Originally, support for signature verification was introduced to verify a possibly immutable initial ram disk, when no new files are created, and to switch to HMAC for the root filesystem. By that time, an HMAC key should have been loaded and usable to calculate HMACs for new files. More recently support for requiring an HMAC key was removed from the kernel, so that signature verification can be used alone. Since this is a legitimate use case, evm_inode_init_security() should not return an error when no HMAC key has been loaded. This patch fixes this problem by replacing the evm_key_loaded() check with a check of the EVM_INIT_HMAC flag in evm_initialized. Fixes: 26ddabfe96 ("evm: enable EVM when X509 certificate is loaded") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.5.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-07-14 16:53:08 +02:00
..
apparmor	apparmor: ensure that dfa state tables have entries	2020-07-22 09:33:05 +02:00
integrity	evm: Execute evm_inode_init_security() only when an HMAC key is loaded	2021-07-14 16:53:08 +02:00
keys	KEYS: trusted: Fix migratable=1 failing	2021-03-04 10:26:44 +01:00
loadpin	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
lockdown	lockdown: Allow unprivileged users to see lockdown status	2020-06-22 09:30:53 +02:00
safesetid	LSM: SafeSetID: Stop releasing uninitialized ruleset	2019-09-17 11:27:05 -07:00
selinux	selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling	2020-12-30 11:51:05 +01:00
smack	smackfs: restrict bytes count in smackfs write functions	2021-03-07 12:20:42 +01:00
tomoyo	tomoyo: Use atomic_t for statistics counter	2020-02-05 21:22:41 +00:00
yama	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
commoncap.c	security: commoncap: fix -Wstringop-overread warning	2021-05-11 14:04:16 +02:00
device_cgroup.c	device_cgroup: Fix RCU list debugging warning	2020-10-01 13:18:13 +02:00
inode.c	Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-07-19 10:42:02 -07:00
Kconfig	Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-09-28 08:14:15 -07:00
Kconfig.hardening	meminit fix	2019-07-28 12:33:15 -07:00
lsm_audit.c	dump_common_audit_data(): fix racy accesses to ->d_name	2021-01-19 18:26:16 +01:00
Makefile	security: Add a static lockdown policy LSM	2019-08-19 21:54:15 -07:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-09-28 08:14:15 -07:00