evm: posix acls modify i_mode

The posix xattr acls are 'system' prefixed, which normally would not
affect security.evm.  An interesting side affect of writing posix xattr
acls is their modifying of the i_mode, which is included in security.evm.

This patch updates security.evm when posix xattr acls are written.

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>

diff --git a/include/linux/evm.h b/include/linux/evm.h
index ea603c9e775df3426b28afc4ca3c76f726914ce0..9fc13a760928aa7d47e44ccdc2f178a5525d92a9 100644 (file)
--- a/include/linux/evm.h
+++ b/include/linux/evm.h
@@ -33,6 +33,14 @@ extern void evm_inode_post_removexattr(struct dentry *dentry,
 extern int evm_inode_init_security(struct inode *inode,
                                   const struct xattr *xattr_array,
                                   struct xattr *evm);
+#ifdef CONFIG_FS_POSIX_ACL
+extern int posix_xattr_acl(const char *xattrname);
+#else
+static inline int posix_xattr_acl(const char *xattrname)
+{
+       return 0;
+}
+#endif
 #else
 #ifdef CONFIG_INTEGRITY
 static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,

diff --git a/include/linux/xattr.h b/include/linux/xattr.h
index b20cb965c3226b7cecab5a4e9629abec64ec2984..e5d122031542f5e3628d5a3bbbd044f0f36f51a3 100644 (file)
--- a/include/linux/xattr.h
+++ b/include/linux/xattr.h
@@ -52,6 +52,11 @@
 #define XATTR_CAPS_SUFFIX "capability"
 #define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX
 
+#define XATTR_POSIX_ACL_ACCESS  "posix_acl_access"
+#define XATTR_NAME_POSIX_ACL_ACCESS XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_ACCESS
+#define XATTR_POSIX_ACL_DEFAULT  "posix_acl_default"
+#define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
+
 #ifdef  __KERNEL__
 
 #include <linux/types.h>

diff --git a/security/integrity/evm/Makefile b/security/integrity/evm/Makefile
index 0787d262b9e3b930d2d2a872a12cf9e665e041ce..7393c415a0667209e7833c3ab02637e36146291a 100644 (file)
--- a/security/integrity/evm/Makefile
+++ b/security/integrity/evm/Makefile
@@ -4,3 +4,4 @@
 obj-$(CONFIG_EVM) += evm.o
 
 evm-y := evm_main.o evm_crypto.o evm_secfs.o
+evm-$(CONFIG_FS_POSIX_ACL) += evm_posix_acl.o

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 7d4247535f9ee978b2dfd7be191ebe676e1e39cd..73c008d047c726e53e987db8b2b2b9337b9b5f08 100644 (file)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -177,7 +177,14 @@ static enum integrity_status evm_verify_current_integrity(struct dentry *dentry)
 /*
  * evm_protect_xattr - protect the EVM extended attribute
  *
- * Prevent security.evm from being modified or removed.
+ * Prevent security.evm from being modified or removed without the
+ * necessary permissions or when the existing value is invalid.
+ *
+ * The posix xattr acls are 'system' prefixed, which normally would not
+ * affect security.evm.  An interesting side affect of writing posix xattr
+ * acls is their modifying of the i_mode, which is included in security.evm.
+ * For posix xattr acls only, permit security.evm, even if it currently
+ * doesn't exist, to be updated.
  */
 static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
                             const void *xattr_value, size_t xattr_value_len)
@@ -187,9 +194,15 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
        if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
                if (!capable(CAP_SYS_ADMIN))
                        return -EPERM;
-       } else if (!evm_protected_xattr(xattr_name))
-               return 0;
-
+       } else if (!evm_protected_xattr(xattr_name)) {
+               if (!posix_xattr_acl(xattr_name))
+                       return 0;
+               evm_status = evm_verify_current_integrity(dentry);
+               if ((evm_status == INTEGRITY_PASS) ||
+                       (evm_status == INTEGRITY_NOLABEL))
+                       return 0;
+               return -EPERM;
+       }
        evm_status = evm_verify_current_integrity(dentry);
        return evm_status == INTEGRITY_PASS ? 0 : -EPERM;
 }
@@ -240,7 +253,8 @@ int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name)
 void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name,
                             const void *xattr_value, size_t xattr_value_len)
 {
-       if (!evm_initialized || !evm_protected_xattr(xattr_name))
+       if (!evm_initialized || (!evm_protected_xattr(xattr_name)
+                                && !posix_xattr_acl(xattr_name)))
                return;
 
        evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);

diff --git a/security/integrity/evm/evm_posix_acl.c b/security/integrity/evm/evm_posix_acl.c
new file mode 100644 (file)
index 0000000..b1753e9
--- /dev/null
+++ b/security/integrity/evm/evm_posix_acl.c
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2011 IBM Corporation
+ *
+ * Author:
+ * Mimi Zohar <zohar@us.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ */
+
+#include <linux/module.h>
+#include <linux/xattr.h>
+
+int posix_xattr_acl(char *xattr)
+{
+       int xattr_len = strlen(xattr);
+
+       if ((strlen(XATTR_NAME_POSIX_ACL_ACCESS) == xattr_len)
+            && (strncmp(XATTR_NAME_POSIX_ACL_ACCESS, xattr, xattr_len) == 0))
+               return 1;
+       if ((strlen(XATTR_NAME_POSIX_ACL_DEFAULT) == xattr_len)
+            && (strncmp(XATTR_NAME_POSIX_ACL_DEFAULT, xattr, xattr_len) == 0))
+               return 1;
+       return 0;
+}