History

Merge tag 'integrity-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull integrity updates from Mimi Zohar: "Just two bug fixes" * tag 'integrity-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: efi: Correct Macmini DMI match in uefi cert quirk ima: fix blocking of security.ima xattrs of unsupported algorithms

Linus Torvalds committed 4 years ago

Commit eafb1212 parents 74a0f84 bab715b2 files · +9 −5Browse files

Unified · Split

2 files
  1. security/integrity/ima/ima_appraise.c +8 −4
  2. security/integrity/platform_certs/load_uefi.c +1 −1
security/integrity/ima/ima_appraise.c+8−4
@@ -750,22 +750,26 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, · 749 unmodified lines
750 const struct evm_ima_xattr_data *xvalue = xattr_value;750 const struct evm_ima_xattr_data *xvalue = xattr_value;
751 int digsig = 0;751 int digsig = 0;
752 int result;752 int result;
753 int err;
753 754
754 result = ima_protect_xattr(dentry, xattr_name, xattr_value,755 result = ima_protect_xattr(dentry, xattr_name, xattr_value,
755 xattr_value_len);756 xattr_value_len);
756 if (result == 1) {757 if (result == 1) {
757 if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))758 if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
758 return -EINVAL;759 return -EINVAL;
760
761 err = validate_hash_algo(dentry, xvalue, xattr_value_len);
762 if (err)
763 return err;
764
759 digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);765 digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
760 } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {766 } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
761 digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);767 digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
762 }768 }
763 if (result == 1 || evm_revalidate_status(xattr_name)) {769 if (result == 1 || evm_revalidate_status(xattr_name)) {
764 result = validate_hash_algo(dentry, xvalue, xattr_value_len);
765 if (result)
766 return result;
767
768 ima_reset_appraise_flags(d_backing_inode(dentry), digsig);770 ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
771 if (result == 1)
772 result = 0;
769 }773 }
770 return result;774 return result;
771}775}
security/integrity/platform_certs/load_uefi.c+1−1
@@ -31,7 +31,7 @@ static const struct dmi_system_id uefi_skip_cert[] = { · 30 unmodified lines
31 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },31 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
32 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },32 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
33 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },33 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
34 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacMini8,1") },34 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
35 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },35 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
36 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },36 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
37 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },37 { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },