diff options
| author | Coiby Xu <coxu@redhat.com> | 2025-09-30 10:26:56 +0800 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2026-03-05 11:39:39 -0500 |
| commit | 0ec959cf4b5a609d7f27bf84064ef5372e30ab80 (patch) | |
| tree | a748f2f6a7f99bf1ae9519bad42f30025df3d2fb /include/linux | |
| parent | a2e507afd9a25e333b7a58082f5db8c4de2bd12d (diff) | |
evm: fix security.evm for a file with IMA signature
When both IMA and EVM fix modes are enabled, accessing a file with IMA
signature but missing EVM HMAC won't cause security.evm to be fixed.
Add a function evm_fix_hmac which will be explicitly called to fix EVM
HMAC for this case.
Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/evm.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/include/linux/evm.h b/include/linux/evm.h index ddece4a6b25d..913f4573b203 100644 --- a/include/linux/evm.h +++ b/include/linux/evm.h @@ -18,6 +18,8 @@ extern enum integrity_status evm_verifyxattr(struct dentry *dentry, const char *xattr_name, void *xattr_value, size_t xattr_value_len); +int evm_fix_hmac(struct dentry *dentry, const char *xattr_name, + const char *xattr_value, size_t xattr_value_len); int evm_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, struct xattr *xattrs, int *xattr_count); @@ -51,6 +53,12 @@ static inline enum integrity_status evm_verifyxattr(struct dentry *dentry, { return INTEGRITY_UNKNOWN; } + +static inline int evm_fix_hmac(struct dentry *dentry, const char *xattr_name, + const char *xattr_value, size_t xattr_value_len) +{ + return -EOPNOTSUPP; +} #endif static inline int evm_inode_init_security(struct inode *inode, struct inode *dir, |