Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756515AbdLVOca (ORCPT ); Fri, 22 Dec 2017 09:32:30 -0500 Received: from mail-wm0-f67.google.com ([74.125.82.67]:42023 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756215AbdLVObc (ORCPT ); Fri, 22 Dec 2017 09:31:32 -0500 X-Google-Smtp-Source: ACJfBotGqwS+GEONMWass59PwgH5dapWeA8CQZFdHB5HLK5yhApTgO0D0+ij8jkPimxGR+A+f0GQ4Q== From: Dongsu Park To: linux-kernel@vger.kernel.org Cc: containers@lists.linux-foundation.org, Alban Crequy , "Eric W . Biederman" , Miklos Szeredi , Seth Forshee , Sargun Dhillon , Dongsu Park , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, James Morris , Mimi Zohar , "Serge E. Hallyn" Subject: [PATCH 11/11] evm: Don't update hmacs in user ns mounts Date: Fri, 22 Dec 2017 15:32:35 +0100 Message-Id: <1f2233a1a028f1eb1e9bea7d06efa6d34e69e752.1512041070.git.dongsu@kinvolk.io> X-Mailer: git-send-email 2.13.6 In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1168 Lines: 34 From: Seth Forshee The kernel should not calculate new hmacs for mounts done by non-root users. Update evm_calc_hmac_or_hash() to refuse to calculate new hmacs for mounts for non-init user namespaces. Cc: linux-integrity@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: James Morris Cc: Mimi Zohar Cc: "Serge E. Hallyn" Signed-off-by: Seth Forshee Signed-off-by: Dongsu Park --- security/integrity/evm/evm_crypto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c index bcd64baf..729f4545 100644 --- a/security/integrity/evm/evm_crypto.c +++ b/security/integrity/evm/evm_crypto.c @@ -190,7 +190,8 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry, int error; int size; - if (!(inode->i_opflags & IOP_XATTR)) + if (!(inode->i_opflags & IOP_XATTR) || + inode->i_sb->s_user_ns != &init_user_ns) return -EOPNOTSUPP; desc = init_desc(type); -- 2.13.6