Skip to contentSkip to conversation

evm: Don't update hmacs in user ns mounts

PATCH In review Eric W. Biederman 2 participants 2 messages May 2, 2018 – May 3, 2018

Subsystems (4)
Security (LSM) Keys-trusted Integrity measurement architecture (IMA) Extended Verification Module (EVM)
lore
Share & tools
lore

Eric W. Biederman

author
#0 lore raw

PATCH 1/1 evm: Don't update hmacs in user ns mounts

From: Seth Forshee <[email protected]>
Date: Fri, 22 Dec 2017 15:32:35 +0100

The kernel should not calculate new hmacs for mounts done by non-root users. Update evm_calc_hmac_or_hash() to refuse to calculate new hmacs for mounts for non-init user namespaces.

Cc linux-integrity at vger.kernel.org
Cc linux-security-module at vger.kernel.org
Cc linux-kernel at vger.kernel.org
Cc James Morris <[email protected]>
Cc Mimi Zohar <[email protected]>
Cc "Serge E. Hallyn" <[email protected]>
Signed-off-by Seth Forshee <[email protected]>
Signed-off-by Dongsu Park <[email protected]>
Signed-off-by Eric W. Biederman <[email protected]>

---

Mimi this patch has been floating around for a while and it appears to be the only piece missing from the vfs to make unprivileged mounts safe (at least semantically). Do you want to merge this through your integrity tree or should merge this through my userns tree?

 security/integrity/evm/evm_crypto.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
security/integrity/evm/evm_crypto.c +2 -1
index a46fba322340..facf9cdd577d 100644
@@ -200,7 +200,8 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
 	int size;
 	bool ima_present = false;
 
-	if (!(inode->i_opflags & IOP_XATTR))
+	if (!(inode->i_opflags & IOP_XATTR) ||
+	    inode->i_sb->s_user_ns != &init_user_ns)
 		return -EOPNOTSUPP;
 
 	desc = init_desc(type);
Signature · 6 lines
2.14.1

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
#1 lore raw
Quoted 16 lines · Eric W. Biederman

From: Seth Forshee <[email protected]>
Date: Fri, 22 Dec 2017 15:32:35 +0100

The kernel should not calculate new hmacs for mounts done by non-root users. Update evm_calc_hmac_or_hash() to refuse to calculate new hmacs for mounts for non-init user namespaces.

Cc linux-integrity at vger.kernel.org
Cc linux-security-module at vger.kernel.org
Cc linux-kernel at vger.kernel.org
Cc James Morris <[email protected]>
Cc Mimi Zohar <[email protected]>
Cc "Serge E. Hallyn" <[email protected]>
Signed-off-by Seth Forshee <[email protected]>
Signed-off-by Dongsu Park <[email protected]>
Signed-off-by Eric W. Biederman <[email protected]>
Quoted 6 lines

---

Mimi this patch has been floating around for a while and it appears to be the only piece missing from the vfs to make unprivileged mounts safe (at least semantically). Do you want to merge this through your integrity tree or should merge this through my userns tree?

Matthew's EVM patches don't conflict with this change, so either way is fine.

Mimi

Quoted 10 lines
 security/integrity/evm/evm_crypto.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
security/integrity/evm/evm_crypto.c +0 -0
index a46fba322340..facf9cdd577d 100644

security/integrity/evm/evm_crypto.c static int evm_calc_hmac_or_hash(struct dentry *dentry, · line 207

Quoted 9 lines
security/integrity/evm/evm_crypto.c +2 -1
@@ -200,7 +200,8 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
 	int size;
 	bool ima_present = false;
 
-	if (!(inode->i_opflags & IOP_XATTR))
+	if (!(inode->i_opflags & IOP_XATTR) ||
+	    inode->i_sb->s_user_ns != &init_user_ns)
 		return -EOPNOTSUPP;
 
 	desc = init_desc(type);

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html