Hi Roberto,

On Wed, 2021-04-07 at 12:52 +0200, Roberto Sassu wrote:

EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to temporarily disable metadata verification until all xattrs/attrs necessary to verify an EVM portable signature are copied to the file. This flag is cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is calculated on unverified xattrs/attrs.

Currently EVM unnecessarily denies setting this flag if EVM is initialized with a public key, which is not a concern as it cannot be used to trust xattrs/attrs updates. This patch removes this limitation.

Cc: stable@vger.kernel.org # 4.16.x Fixes: ae1ba1676b88e ("EVM: Allow userland to permit modification of EVM-protected metadata") Signed-off-by: Roberto Sassu roberto.sassu@huawei.com

---

Documentation/ABI/testing/evm | 5 +++-- security/integrity/evm/evm_secfs.c | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm index 3c477ba48a31..eb6d70fd6fa2 100644 --- a/Documentation/ABI/testing/evm +++ b/Documentation/ABI/testing/evm @@ -49,8 +49,9 @@ Description: modification of EVM-protected metadata and disable all further modification of policy

• Note that once a key has been loaded, it will no longer be
  

• possible to enable metadata modification.
  

• Note that once an HMAC key has been loaded, it will no longer
  

• be possible to enable metadata modification and, if it is
  

• already enabled, it will be disabled.
  

Until key loading has been signaled EVM can not create or validate the 'security.evm' xattr, but returns diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c index bbc85637e18b..197a4b83e534 100644 --- a/security/integrity/evm/evm_secfs.c +++ b/security/integrity/evm/evm_secfs.c @@ -81,10 +81,10 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf, return -EINVAL; /* Don't allow a request to freshly enable metadata writes if

• * keys are loaded.
  

• * an HMAC key is loaded.
  

  */ if ((i & EVM_ALLOW_METADATA_WRITES) &&

•    ((evm_initialized & EVM_KEY_MASK) != 0) &&
  

•    ((evm_initialized & EVM_INIT_HMAC) != 0) &&
   !(evm_initialized & EVM_ALLOW_METADATA_WRITES))
  

  return -EPERM;

The comment "freshly enable" is confusing. Perhaps the original intent was to enable flags before loading any keys. So the comment and code were kind of in sync. With this change, enabling metadata writes may be triggered after loading an x509 certificate. Unless someone comments, I don't have problems with this change.

Once metadata writes are enabled, the only way of disabling them is by loading and enabling an HMAC key. With this change "freshly enable" only refers to after an HMAC key is loaded, when the setup completion flag is not set. The code can be simplified by just checking if an HMAC key is loaded.

thanks,

Mimi