linux-stable.git/security/integrity, branch v3.16.78

ima: fix showing large 'violations' or 'runtime_measurements_count'

2019-02-11T17:53:30+00:00

commit 1e4c8dafbb6bf72fb5eca035b861e39c5896c2b7 upstream.

The 12 character temporary buffer is not necessarily long enough to hold
a 'long' value.  Increase it.

Signed-off-by: Eric Biggers 
Signed-off-by: Mimi Zohar 
Signed-off-by: Ben Hutchings

ima: relax requiring a file signature for new files with zero length

2018-06-16T21:21:43+00:00

commit b7e27bc1d42e8e0cc58b602b529c25cd0071b336 upstream.

Custom policies can require file signatures based on LSM labels.  These
files are normally created and only afterwards labeled, requiring them
to be signed.

Instead of requiring file signatures based on LSM labels, entire
filesystems could require file signatures.  In this case, we need the
ability of writing new files without requiring file signatures.

The definition of a "new" file was originally defined as any file with
a length of zero.  Subsequent patches redefined a "new" file to be based
on the FILE_CREATE open flag.  By combining the open flag with a file
size of zero, this patch relaxes the file signature requirement.

Fixes: 1ac202e978e1 ima: accept previously set IMA_NEW_FILE
Signed-off-by: Mimi Zohar 
Signed-off-by: Ben Hutchings

ima: fix hash algorithm initialization

2018-02-13T18:42:19+00:00

commit ebe7c0a7be92bbd34c6ff5b55810546a0ee05bee upstream.

The hash_setup function always sets the hash_setup_done flag, even
when the hash algorithm is invalid.  This prevents the default hash
algorithm defined as CONFIG_IMA_DEFAULT_HASH from being used.

This patch sets hash_setup_done flag only for valid hash algorithms.

Fixes: e7a2ad7eb6f4 "ima: enable support for larger default filedata hash
	algorithms"
Signed-off-by: Boshi Wang 
Signed-off-by: Mimi Zohar 
Signed-off-by: Ben Hutchings

ima: accept previously set IMA_NEW_FILE

2017-08-26T01:14:23+00:00

commit 1ac202e978e18f045006d75bd549612620c6ec3a upstream.

Modifying the attributes of a file makes ima_inode_post_setattr reset
the IMA cache flags. So if the file, which has just been created,
is opened a second time before the first file descriptor is closed,
verification fails since the security.ima xattr has not been written
yet. We therefore have to look at the IMA_NEW_FILE even if the file
already existed.

With this patch there should no longer be an error when cat tries to
open testfile:

$ rm -f testfile
$ ( echo test >&3 ; touch testfile ; cat testfile ) 3>testfile

A file being new is no reason to accept that it is missing a digital
signature demanded by the policy.

Signed-off-by: Daniel Glöckner 
Signed-off-by: Mimi Zohar 
Signed-off-by: Ben Hutchings

ima: pass 'opened' flag to identify newly created files

2017-08-26T01:14:23+00:00

commit 3034a146820c26fe6da66a45f6340fe87fe0983a upstream.

Empty files and missing xattrs do not guarantee that a file was
just created.  This patch passes FILE_CREATED flag to IMA to
reliably identify new files.

Signed-off-by: Dmitry Kasatkin 
Signed-off-by: Mimi Zohar 
[bwh: Backported to 3.16: drop change to ima_fw_from_file()]
Signed-off-by: Ben Hutchings

EVM: Use crypto_memneq() for digest comparisons

2016-02-16T10:55:28+00:00

commit 613317bd212c585c20796c10afe5daaa95d4b0a1 upstream.

This patch fixes vulnerability CVE-2016-2085.  The problem exists
because the vm_verify_hmac() function includes a use of memcmp().
Unfortunately, this allows timing side channel attacks; specifically
a MAC forgery complexity drop from 2^128 to 2^12.  This patch changes
the memcmp() to the cryptographically safe crypto_memneq().

Reported-by: Xiaofei Rex Guo 
Signed-off-by: Ryan Ware 
Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris 
Cc: Moritz Muehlenhoff 
Signed-off-by: Luis Henriques

ima: extend "mask" policy matching support

2015-08-27T14:06:54+00:00

commit 4351c294b8c1028077280f761e158d167b592974 upstream.

The current "mask" policy option matches files opened as MAY_READ,
MAY_WRITE, MAY_APPEND or MAY_EXEC.  This patch extends the "mask"
option to match files opened containing one of these modes.  For
example, "mask=^MAY_READ" would match files opened read-write.

Signed-off-by: Mimi Zohar 
Signed-off-by: Dr. Greg Wettstein 
Signed-off-by: Luis Henriques

ima: add support for new "euid" policy condition

2015-08-27T14:04:16+00:00

commit 139069eff7388407f19794384c42a534d618ccd7 upstream.

The new "euid" policy condition measures files with the specified
effective uid (euid).  In addition, for CAP_SETUID files it measures
files with the specified uid or suid.

Changelog:
- fixed checkpatch.pl warnings
- fixed avc denied {setuid} messages - based on Roberto's feedback

Signed-off-by: Mimi Zohar 
Signed-off-by: Dr. Greg Wettstein 
Signed-off-by: Luis Henriques

evm: labeling pseudo filesystems exception

2015-08-11T08:57:28+00:00

commit 5101a1850bb7ccbf107929dee9af0cd2f400940f upstream.

To prevent offline stripping of existing file xattrs and relabeling of
them at runtime, EVM allows only newly created files to be labeled.  As
pseudo filesystems are not persistent, stripping of xattrs is not a
concern.

Some LSMs defer file labeling on pseudo filesystems.  This patch
permits the labeling of existing files on pseudo files systems.

Signed-off-by: Mimi Zohar 
[ luis: backported to 3.16:
  - added magic.h header file ]
Signed-off-by: Luis Henriques

ima: fix ima_show_template_data_ascii()

2015-07-15T09:00:38+00:00

commit 45b26133b97871896b8c5241d59f4ff7839db7b2 upstream.

This patch fixes a bug introduced in "4d7aeee ima: define new template
ima-ng and template fields d-ng and n-ng".

Changelog:
- change int to uint32 (Roberto Sassu's suggestion)

Signed-off-by: Mimi Zohar 
Signed-off-by: Roberto Sassu 
Signed-off-by: Luis Henriques