evm: replace HMAC version with attribute mask

Using HMAC version limits the posibility to arbitrarily add new
attributes such as SMACK64EXEC to the hmac calculation.

This patch replaces hmac version with attribute mask.
Desired attributes can be enabled with configuration parameter.
It allows to build kernels which works with previously labeled
filesystems.

Currently supported attribute is 'fsuuid' which is equivalent of
the former version 2.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig
index d35b4915b00d4722e76464baba6b272ce86332f0..0df4f7a2f1e9dba7ecfbb3bd5a5fd7532a08ea53 100644 (file)
--- a/security/integrity/evm/Kconfig
+++ b/security/integrity/evm/Kconfig
@@ -12,15 +12,24 @@ config EVM
 
          If you are unsure how to answer this question, answer N.
 
-config EVM_HMAC_VERSION
-       int "EVM HMAC version"
+if EVM
+
+menu "EVM options"
+
+config EVM_ATTR_FSUUID
+       bool "FSUUID (version 2)"
+       default y
        depends on EVM
-       default 2
        help
-         This options adds EVM HMAC version support.
-         1 - original version
-         2 - add per filesystem unique identifier (UUID) (default)
+         Include filesystem UUID for HMAC calculation.
+
+         Default value is 'selected', which is former version 2.
+         if 'not selected', it is former version 1
 
-         WARNING: changing the HMAC calculation method or adding 
+         WARNING: changing the HMAC calculation method or adding
          additional info to the calculation, requires existing EVM
-         labeled file systems to be relabeled.  
+         labeled file systems to be relabeled.
+
+endmenu
+
+endif

diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h
index 37c88ddb3cfe459e88822742e3cd25b15fb6f992..88bfe77efa1cf10ccdcb5bb50e6e949f05f017bf 100644 (file)
--- a/security/integrity/evm/evm.h
+++ b/security/integrity/evm/evm.h
@@ -24,7 +24,10 @@
 extern int evm_initialized;
 extern char *evm_hmac;
 extern char *evm_hash;
-extern int evm_hmac_version;
+
+#define EVM_ATTR_FSUUID                0x0001
+
+extern int evm_hmac_attrs;
 
 extern struct crypto_shash *hmac_tfm;
 extern struct crypto_shash *hash_tfm;

diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 6b540f1822e0b43c175466615ff78db50b0df0f5..5e9687f02e1b14e56e56d3a303afbef23ea79dca 100644 (file)
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -112,7 +112,7 @@ static void hmac_add_misc(struct shash_desc *desc, struct inode *inode,
        hmac_misc.gid = from_kgid(&init_user_ns, inode->i_gid);
        hmac_misc.mode = inode->i_mode;
        crypto_shash_update(desc, (const u8 *)&hmac_misc, sizeof(hmac_misc));
-       if (evm_hmac_version > 1)
+       if (evm_hmac_attrs & EVM_ATTR_FSUUID)
                crypto_shash_update(desc, inode->i_sb->s_uuid,
                                    sizeof(inode->i_sb->s_uuid));
        crypto_shash_final(desc, digest);

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 6e0bd933b6a9a8a815f5d57c147f1d18dfbfec36..1dc09190a94801f5e3268719ebb57c9310ebb8e7 100644 (file)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -32,7 +32,7 @@ static char *integrity_status_msg[] = {
 };
 char *evm_hmac = "hmac(sha1)";
 char *evm_hash = "sha1";
-int evm_hmac_version = CONFIG_EVM_HMAC_VERSION;
+int evm_hmac_attrs;
 
 char *evm_config_xattrnames[] = {
 #ifdef CONFIG_SECURITY_SELINUX
@@ -57,6 +57,14 @@ static int __init evm_set_fixmode(char *str)
 }
 __setup("evm=", evm_set_fixmode);
 
+static void __init evm_init_config(void)
+{
+#ifdef CONFIG_EVM_ATTR_FSUUID
+       evm_hmac_attrs |= EVM_ATTR_FSUUID;
+#endif
+       pr_info("HMAC attrs: 0x%x\n", evm_hmac_attrs);
+}
+
 static int evm_find_protected_xattrs(struct dentry *dentry)
 {
        struct inode *inode = dentry->d_inode;
@@ -432,6 +440,8 @@ static int __init init_evm(void)
 {
        int error;
 
+       evm_init_config();
+
        error = evm_init_secfs();
        if (error < 0) {
                pr_info("Error registering secfs\n");