THOBY Simon 8ecd39cb61 IMA: prevent SETXATTR_CHECK policy rules with unavailable algorithms ... SETXATTR_CHECK policy rules assume that any algorithm listed in the 'appraise_algos' flag must be accepted when performing setxattr() on the security.ima xattr. However nothing checks that they are available in the current kernel. A userland application could hash a file with a digest that the kernel wouldn't be able to verify. However, if SETXATTR_CHECK is not in use, the kernel already forbids that xattr write. Verify that algorithms listed in appraise_algos are available to the current kernel and reject the policy update otherwise. This will fix the inconsistency between SETXATTR_CHECK and non-SETXATTR_CHECK behaviors. That filtering is only performed in ima_parse_appraise_algos() when updating policies so that we do not have to pay the price of allocating a hash object every time validate_hash_algo() is called in ima_inode_setxattr(). Signed-off-by: THOBY Simon <Simon.THOBY@viveris.fr> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>		2021-08-16 17:35:35 -04:00
..
ima_api.c	IMA: add support to restrict the hash algorithms used for file appraisal	2021-08-16 17:30:41 -04:00
ima_appraise.c	IMA: introduce a new policy option func=SETXATTR_CHECK	2021-08-16 17:35:35 -04:00
ima_asymmetric_keys.c	ima: Add digest and digest_len params to the functions to measure a buffer	2021-07-23 09:27:02 -04:00
ima_crypto.c	ima/evm: Fix type mismatch	2021-06-08 16:29:10 -04:00
ima_efi.c	ima: generalize x86/EFI arch glue for other EFI architectures	2020-11-06 07:40:42 +01:00
ima_fs.c	ima/evm: Fix type mismatch	2021-06-08 16:29:10 -04:00
ima_init.c	ima: Add digest and digest_len params to the functions to measure a buffer	2021-07-23 09:27:02 -04:00
ima_kexec.c	ima: Fix warning: no previous prototype for function 'ima_add_kexec_buffer'	2021-06-11 11:27:03 -04:00
ima_main.c	IMA: introduce a new policy option func=SETXATTR_CHECK	2021-08-16 17:35:35 -04:00
ima_modsig.c	ima: Move comprehensive rule validation checks out of the token parser	2020-07-20 13:28:15 -04:00
ima_mok.c	IMA: remove -Wmissing-prototypes warning	2021-07-23 08:05:06 -04:00
ima_policy.c	IMA: prevent SETXATTR_CHECK policy rules with unavailable algorithms	2021-08-16 17:35:35 -04:00
ima_queue_keys.c	ima: Add digest and digest_len params to the functions to measure a buffer	2021-07-23 09:27:02 -04:00
ima_queue.c	IMA: support for duplicate measurement records	2021-06-11 12:54:13 -04:00
ima_template_lib.c	ima: Fix fall-through warning for Clang	2021-06-08 23:33:48 -04:00
ima_template_lib.h	ima: Define new template fields xattrnames, xattrlengths and xattrvalues	2021-06-02 18:56:13 -04:00
ima_template.c	ima: Set correct casting types	2021-06-08 16:29:10 -04:00
ima.h	IMA: introduce a new policy option func=SETXATTR_CHECK	2021-08-16 17:35:35 -04:00
Kconfig	IMA: remove the dependency on CRYPTO_MD5	2021-08-16 17:29:10 -04:00
Makefile	ima: generalize x86/EFI arch glue for other EFI architectures	2020-11-06 07:40:42 +01:00