linux.git/security/integrity/evm, branch v3.2-rc2

evm: permit mode bits to be updated

2011-09-14T19:24:52+00:00

Before permitting 'security.evm' to be updated, 'security.evm' must
exist and be valid.  In the case that there are no existing EVM protected
xattrs, it is safe for posix acls to update the mode bits.

To differentiate between no 'security.evm' xattr and no xattrs used to
calculate 'security.evm', this patch defines INTEGRITY_NOXATTR.

Signed-off-by: Mimi Zohar

evm: posix acls modify i_mode

2011-09-14T19:24:51+00:00

The posix xattr acls are 'system' prefixed, which normally would not
affect security.evm.  An interesting side affect of writing posix xattr
acls is their modifying of the i_mode, which is included in security.evm.

This patch updates security.evm when posix xattr acls are written.

Signed-off-by: Mimi Zohar

evm: limit verifying current security.evm integrity

2011-09-14T19:24:51+00:00

evm_protect_xattr unnecessarily validates the current security.evm
integrity, before updating non-evm protected extended attributes
and other file metadata. This patch limits validating the current
security.evm integrity to evm protected metadata.

Signed-off-by: Mimi Zohar

evm: remove TCG_TPM dependency

2011-09-14T19:24:49+00:00

All tristates selected by EVM(boolean) are forced to be builtin, except
in the TCG_TPM(tristate) dependency case. Arnaud Lacombe summarizes the
Kconfig bug as, "So it would seem direct dependency state influence the
state of reverse dependencies.."  For a detailed explanation, refer to
Arnaud Lacombe's posting http://lkml.org/lkml/2011/8/23/498.

With the "encrypted-keys: remove trusted-keys dependency" patch, EVM
can now be built without a dependency on TCG_TPM.  The trusted-keys
dependency requires trusted-keys to either be builtin or not selected.
This dependency will prevent the boolean/tristate mismatch from
occuring.

Reported-by: Stephen Rothwell ,
             Randy Dunlap 
Signed-off-by: Mimi Zohar

evm: add Kconfig TCG_TPM dependency

2011-08-18T02:58:12+00:00

Although the EVM encrypted-key should be encrypted/decrypted using a
trusted-key, a user-defined key could be used instead. When using a user-
defined key, a TCG_TPM dependency should not be required.  Unfortunately,
the encrypted-key code needs to be refactored a bit in order to remove
this dependency.

This patch adds the TCG_TPM dependency.

Reported-by: Stephen Rothwell ,
	     Randy Dunlap 
Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris

evm: fix evm_inode_init_security return code

2011-08-11T07:42:41+00:00

evm_inode_init_security() should return 0, when EVM is not enabled.
(Returning an error is a remnant of evm_inode_post_init_security.)

Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris

EVM: ensure trusted and encypted key symbols are available to EVM

2011-08-09T01:33:36+00:00

Select trusted and encrypted keys if EVM is selected, to ensure
the requisite symbols are available.  Otherwise, these can be
selected as modules while EVM is static, leading to a kernel
build failure.

Signed-off-by: James Morris

evm: add evm_inode_setattr to prevent updating an invalid security.evm

2011-07-18T16:29:50+00:00

Permit changing of security.evm only when valid, unless in fixmode.

Reported-by: Roberto Sassu 
Signed-off-by: Mimi Zohar

evm: permit only valid security.evm xattrs to be updated

2011-07-18T16:29:49+00:00

In addition to requiring CAP_SYS_ADMIN permission to modify/delete
security.evm, prohibit invalid security.evm xattrs from changing,
unless in fixmode. This patch prevents inadvertent 'fixing' of
security.evm to reflect offline modifications.

Changelog v7:
- rename boot paramater 'evm_mode' to 'evm'

Reported-by: Roberto Sassu 
Signed-off-by: Mimi Zohar

evm: replace hmac_status with evm_status

2011-07-18T16:29:48+00:00

We will use digital signatures in addtion to hmac.

Signed-off-by: Dmitry Kasatkin 
Signed-off-by: Mimi Zohar