Roberto Sassu 74e9d920f2 evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded ... commit 9acc89d31f0c94c8e573ed61f3e4340bbd526d0c upstream. EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to temporarily disable metadata verification until all xattrs/attrs necessary to verify an EVM portable signature are copied to the file. This flag is cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is calculated on unverified xattrs/attrs. Currently EVM unnecessarily denies setting this flag if EVM is initialized with a public key, which is not a concern as it cannot be used to trust xattrs/attrs updates. This patch removes this limitation. Fixes: ae1ba1676b ("EVM: Allow userland to permit modification of EVM-protected metadata") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.16.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-07-14 16:53:08 +02:00
..
apparmor
integrity	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded	2021-07-14 16:53:08 +02:00
keys	KEYS: trusted: Fix migratable=1 failing	2021-03-04 10:26:44 +01:00
loadpin
lockdown
safesetid
selinux	selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling	2020-12-30 11:51:05 +01:00
smack	smackfs: restrict bytes count in smackfs write functions	2021-03-07 12:20:42 +01:00
tomoyo
yama
commoncap.c	security: commoncap: fix -Wstringop-overread warning	2021-05-11 14:04:16 +02:00
device_cgroup.c	device_cgroup: Fix RCU list debugging warning	2020-10-01 13:18:13 +02:00
inode.c
Kconfig
Kconfig.hardening
lsm_audit.c	dump_common_audit_data(): fix racy accesses to ->d_name	2021-01-19 18:26:16 +01:00
Makefile
min_addr.c
security.c