• Randy Dunlap's avatar
    EVM: fix the evm= __setup handler return value · f2544f5e
    Randy Dunlap authored
    __setup() handlers should return 1 if the parameter is handled.
    Returning 0 causes the entire string to be added to init's
    environment strings (limited to 32 strings), unnecessarily polluting it.
    
    Using the documented string "evm=fix" causes an Unknown parameter message:
      Unknown kernel command line parameters
      "BOOT_IMAGE=/boot/bzImage-517rc5 evm=fix", will be passed to user space.
    
    and that string is added to init's environment string space:
      Run /sbin/init as init process
        with arguments:
         /sbin/init
        with environment:
         HOME=/
         TERM=linux
         BOOT_IMAGE=/boot/bzImage-517rc5
         evm=fix
    
    With this change, using "evm=fix" acts as expected and an invalid
    option ("evm=evm") causes a warning to be printed:
      evm: invalid "evm" mode
    but init's environment is not polluted with this string, as expected.
    
    Fixes: 7102ebcd ("evm: permit only valid security.evm xattrs to be updated")
    Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
    Reported-by: default avatarIgor Zhbanov <i.zhbanov@omprussia.ru>
    Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
    Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    f2544f5e
evm_main.c 24 KB