Skip to contentSkip to conversation

evm: return the real setxattr/removexattr failure status for inode without xattr support

PATCH New Mikhail Kurinnoi 1 participant 1 message Nov 3, 2017

Subsystems (4)
Security (LSM) Keys-trusted Integrity measurement architecture (IMA) Extended Verification Module (EVM)
lore
Share & tools
lore

Mikhail Kurinnoi

author
#0 lore raw

PATCH 1/1 evm: return the real setxattr/removexattr failure status for inode without xattr support

This patch provide changes in order to return the real setxattr/removexattr failure status for inode without xattr support.

Signed-off-by Mikhail Kurinnoi <[email protected]>
 security/integrity/evm/evm_main.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)
security/integrity/evm/evm_main.c +10 -8
index 9826c02e2db8..ca412d65a416 100644
@@ -294,8 +294,7 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
 		if (!posix_xattr_acl(xattr_name))
 			return 0;
 		evm_status = evm_verify_current_integrity(dentry);
-		if ((evm_status == INTEGRITY_PASS) ||
-		    (evm_status == INTEGRITY_NOXATTRS))
+		if (evm_status == INTEGRITY_NOXATTRS)
 			return 0;
 		goto out;
 	}

@@ -319,12 +318,15 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
 				    -EPERM, 0);
 	}
 out:
-	if (evm_status != INTEGRITY_PASS)
-		integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
-				    dentry->d_name.name, "appraise_metadata",
-				    integrity_status_msg[evm_status],
-				    -EPERM, 0);
-	return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
+	if ((evm_status == INTEGRITY_PASS) ||
+	    (evm_status == INTEGRITY_UNKNOWN))
+		return 0;
+
+	integrity_audit_msg(AUDIT_INTEGRITY_METADATA, d_backing_inode(dentry),
+			    dentry->d_name.name, "appraise_metadata",
+			    integrity_status_msg[evm_status],
+			    -EPERM, 0);
+	return -EPERM;
 }
 
 /**