3.4-stable patches

added patches:
	evm-prohibit-userspace-writing-security.evm-hmac-value.patch

diff --git a/queue-3.4/evm-prohibit-userspace-writing-security.evm-hmac-value.patch b/queue-3.4/evm-prohibit-userspace-writing-security.evm-hmac-value.patch
new file mode 100644 (file)
index 0000000..27c2bb1
--- /dev/null
+++ b/queue-3.4/evm-prohibit-userspace-writing-security.evm-hmac-value.patch
@@ -0,0 +1,46 @@
+From 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 Mon Sep 17 00:00:00 2001
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Date: Sun, 11 May 2014 00:05:23 -0400
+Subject: evm: prohibit userspace writing 'security.evm' HMAC value
+
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+
+commit 2fb1c9a4f2dbc2f0bd2431c7fa64d0b5483864e4 upstream.
+
+Calculating the 'security.evm' HMAC value requires access to the
+EVM encrypted key.  Only the kernel should have access to it.  This
+patch prevents userspace tools(eg. setfattr, cp --preserve=xattr)
+from setting/modifying the 'security.evm' HMAC value directly.
+
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/integrity/evm/evm_main.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -271,12 +271,20 @@ static int evm_protect_xattr(struct dent
+  * @xattr_value: pointer to the new extended attribute value
+  * @xattr_value_len: pointer to the new extended attribute value length
+  *
+- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
+- * the current value is valid.
++ * Before allowing the 'security.evm' protected xattr to be updated,
++ * verify the existing value is valid.  As only the kernel should have
++ * access to the EVM encrypted key needed to calculate the HMAC, prevent
++ * userspace from writing HMAC value.  Writing 'security.evm' requires
++ * requires CAP_SYS_ADMIN privileges.
+  */
+ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
+                      const void *xattr_value, size_t xattr_value_len)
+ {
++      const struct evm_ima_xattr_data *xattr_data = xattr_value;
++
++      if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
++          && (xattr_data->type == EVM_XATTR_HMAC))
++              return -EPERM;
+       return evm_protect_xattr(dentry, xattr_name, xattr_value,
+                                xattr_value_len);
+ }

diff --git a/queue-3.4/series b/queue-3.4/series
index a2a1404f6047a5e23802cb28cd6fdea8ba5a1051..3ae5bb37ec28e2f9bb15a3f36d0adb5fe58012b4 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -1 +1,2 @@
 iscsi-target-reject-mutual-authentication-with-reflected-chap_c.patch
+evm-prohibit-userspace-writing-security.evm-hmac-value.patch