Commit c2baec7f authored by Dmitry Kasatkin's avatar Dmitry Kasatkin Committed by Mimi Zohar

evm: skip replacing EVM signature with HMAC on read-only filesystem

If filesystem is mounted read-only or file is immutable, updating
xattr will fail. This is a usual case during early boot until
filesystem is remount read-write. This patch verifies conditions
to skip unnecessary attempt to calculate HMAC and set xattr.

Changes in v2:
* indention changed according to Lindent (requested by Mimi)
Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent d16a8585
...@@ -162,9 +162,14 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, ...@@ -162,9 +162,14 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
(const char *)xattr_data, xattr_len, (const char *)xattr_data, xattr_len,
calc.digest, sizeof(calc.digest)); calc.digest, sizeof(calc.digest));
if (!rc) { if (!rc) {
/* we probably want to replace rsa with hmac here */ /* Replace RSA with HMAC if not mounted readonly and
evm_update_evmxattr(dentry, xattr_name, xattr_value, * not immutable
xattr_value_len); */
if (!IS_RDONLY(dentry->d_inode) &&
!IS_IMMUTABLE(dentry->d_inode))
evm_update_evmxattr(dentry, xattr_name,
xattr_value,
xattr_value_len);
} }
break; break;
default: default:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment