Pull integrity updates from Mimi Zohar: "Just two bug fixes" * tag 'integrity-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: efi: Correct Macmini DMI match in uefi cert quirk ima: fix blocking of security.ima xattrs of unsupported algorithms
Unified · Split
| @@ -750,22 +750,26 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, · 749 unmodified lines | ||
| 750 | 750 | const struct evm_ima_xattr_data *xvalue = xattr_value; |
| 751 | 751 | int digsig = 0; |
| 752 | 752 | int result; |
| 753 | + int err; | |
| 753 | 754 | |
| 754 | 755 | result = ima_protect_xattr(dentry, xattr_name, xattr_value, |
| 755 | 756 | xattr_value_len); |
| 756 | 757 | if (result == 1) { |
| 757 | 758 | if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST)) |
| 758 | 759 | return -EINVAL; |
| 760 | + | |
| 761 | + err = validate_hash_algo(dentry, xvalue, xattr_value_len); | |
| 762 | + if (err) | |
| 763 | + return err; | |
| 764 | + | |
| 759 | 765 | digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG); |
| 760 | 766 | } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) { |
| 761 | 767 | digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG); |
| 762 | 768 | } |
| 763 | 769 | if (result == 1 || evm_revalidate_status(xattr_name)) { |
| 764 | − result = validate_hash_algo(dentry, xvalue, xattr_value_len); | |
| 765 | − if (result) | |
| 766 | − return result; | |
| 767 | − | |
| 768 | 770 | ima_reset_appraise_flags(d_backing_inode(dentry), digsig); |
| 771 | + if (result == 1) | |
| 772 | + result = 0; | |
| 769 | 773 | } |
| 770 | 774 | return result; |
| 771 | 775 | } |
| @@ -31,7 +31,7 @@ static const struct dmi_system_id uefi_skip_cert[] = { · 30 unmodified lines | ||
| 31 | 31 | { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") }, |
| 32 | 32 | { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") }, |
| 33 | 33 | { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") }, |
| 34 | − { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacMini8,1") }, | |
| 34 | + { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") }, | |
| 35 | 35 | { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") }, |
| 36 | 36 | { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") }, |
| 37 | 37 | { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") }, |