[PATCH 1/2] evm: building without EVM enabled fixes

[PATCH 1/2] evm: building without EVM enabled fixes

[Mimi Zohar]

- Missing 'inline' on evm_inode_setattr() definition.
Introduced by commit 817b54aa45db ("evm: add evm_inode_setattr to prevent
updating an invalid security.evm").

- Missing security_old_inode_init_security() stub function definition.
Caused by commit 9d8f13ba3f48 ("security: new security_inode_init_security
API adds function callback").

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
---
 include/linux/evm.h      |    2 +-
 include/linux/security.h |    7 +++++++
 2 files changed, 8 insertions(+), 1 deletions(-)

diff --git a/include/linux/evm.h b/include/linux/evm.h
index db5556d..62deb65 100644
--- a/include/linux/evm.h
+++ b/include/linux/evm.h
@@ -45,7 +45,7 @@ static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
 }
 #endif
 
-static int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
+static inline int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
 {
 	return 0;
 }
diff --git a/include/linux/security.h b/include/linux/security.h
index 1c528b1..f399cf1 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -2048,6 +2048,13 @@ static inline int security_inode_init_security(struct inode *inode,
 	return -EOPNOTSUPP;
 }
 
+int security_old_inode_init_security(struct inode *inode, struct inode *dir,
+				     const struct qstr *qstr, char **name,
+				     void **value, size_t *len)
+{
+	return -EOPNOTSUPP;
+}
+
 static inline int security_inode_create(struct inode *dir,
 					 struct dentry *dentry,
 					 int mode)
-- 
1.7.3.4

[PATCH 2/2] evm: fix evm_inode_init_security return code

[Mimi Zohar]

evm_inode_init_security() should return 0, when EVM is not enabled.
(Returning an error is a remnant of evm_inode_post_init_security.)

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
---
 include/linux/evm.h               |    2 +-
 security/integrity/evm/evm_main.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/evm.h b/include/linux/evm.h
index 62deb65..ea603c9 100644
--- a/include/linux/evm.h
+++ b/include/linux/evm.h
@@ -85,7 +85,7 @@ static inline int evm_inode_init_security(struct inode *inode,
 					  const struct xattr *xattr_array,
 					  struct xattr *evm)
 {
-	return -EOPNOTSUPP;
+	return 0;
 }
 
 #endif /* CONFIG_EVM_H */
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 8fc5b5d..f0127e5 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -324,7 +324,7 @@ int evm_inode_init_security(struct inode *inode,
 	int rc;
 
 	if (!evm_initialized || !evm_protected_xattr(lsm_xattr->name))
-		return -EOPNOTSUPP;
+		return 0;
 
 	xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
 	if (!xattr_data)
-- 
1.7.3.4

Re: [PATCH 2/2] evm: fix evm_inode_init_security return code

[James Morris]

Both applied, still seeing this problem:

http://marc.info/?l=linux-kernel&m=131293882430148&w=2



-- 
James Morris
<jmorris@namei.org>

Re: [PATCH 1/2] evm: building without EVM enabled fixes

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 2070 bytes --]

Hi Mimi,

On Thu, 11 Aug 2011 00:22:51 -0400 Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>
> - Missing 'inline' on evm_inode_setattr() definition.
> Introduced by commit 817b54aa45db ("evm: add evm_inode_setattr to prevent
> updating an invalid security.evm").
> 
> - Missing security_old_inode_init_security() stub function definition.
> Caused by commit 9d8f13ba3f48 ("security: new security_inode_init_security
> API adds function callback").
> 
> Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
> Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
> ---
>  include/linux/evm.h      |    2 +-
>  include/linux/security.h |    7 +++++++
>  2 files changed, 8 insertions(+), 1 deletions(-)
> 
> diff --git a/include/linux/evm.h b/include/linux/evm.h
> index db5556d..62deb65 100644
> --- a/include/linux/evm.h
> +++ b/include/linux/evm.h
> @@ -45,7 +45,7 @@ static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
>  }
>  #endif
>  
> -static int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
> +static inline int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
>  {
>  	return 0;
>  }
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 1c528b1..f399cf1 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -2048,6 +2048,13 @@ static inline int security_inode_init_security(struct inode *inode,
>  	return -EOPNOTSUPP;
>  }
>  
> +int security_old_inode_init_security(struct inode *inode, struct inode *dir,
> +				     const struct qstr *qstr, char **name,
> +				     void **value, size_t *len)
> +{
> +	return -EOPNOTSUPP;
> +}
> +

These stub functions *must* be "staic inline" (see my build report on
linux-next) just like the one you fixed above.

Good plan:  if you introduce a function whose existance (or behaviour)
depends on a CONFIG option, then build test with and without that CONFIG
option set.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 490 bytes --]

Re: [PATCH 1/2] evm: building without EVM enabled fixes

[Mimi Zohar]

On Fri, 2011-08-12 at 12:52 +1000, Stephen Rothwell wrote:
> Hi Mimi,
> 
> On Thu, 11 Aug 2011 00:22:51 -0400 Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> >
> > - Missing 'inline' on evm_inode_setattr() definition.
> > Introduced by commit 817b54aa45db ("evm: add evm_inode_setattr to prevent
> > updating an invalid security.evm").
> > 
> > - Missing security_old_inode_init_security() stub function definition.
> > Caused by commit 9d8f13ba3f48 ("security: new security_inode_init_security
> > API adds function callback").
> > 
> > Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
> > Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
> > ---
> >  include/linux/evm.h      |    2 +-
> >  include/linux/security.h |    7 +++++++
> >  2 files changed, 8 insertions(+), 1 deletions(-)
> > 
> > diff --git a/include/linux/evm.h b/include/linux/evm.h
> > index db5556d..62deb65 100644
> > --- a/include/linux/evm.h
> > +++ b/include/linux/evm.h
> > @@ -45,7 +45,7 @@ static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
> >  }
> >  #endif
> >  
> > -static int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
> > +static inline int evm_inode_setattr(struct dentry *dentry, struct iattr *attr)
> >  {
> >  	return 0;
> >  }
> > diff --git a/include/linux/security.h b/include/linux/security.h
> > index 1c528b1..f399cf1 100644
> > --- a/include/linux/security.h
> > +++ b/include/linux/security.h
> > @@ -2048,6 +2048,13 @@ static inline int security_inode_init_security(struct inode *inode,
> >  	return -EOPNOTSUPP;
> >  }
> >  
> > +int security_old_inode_init_security(struct inode *inode, struct inode *dir,
> > +				     const struct qstr *qstr, char **name,
> > +				     void **value, size_t *len)
> > +{
> > +	return -EOPNOTSUPP;
> > +}
> > +
> 
> These stub functions *must* be "staic inline" (see my build report on
> linux-next) just like the one you fixed above.
> 
> Good plan:  if you introduce a function whose existance (or behaviour)
> depends on a CONFIG option, then build test with and without that CONFIG
> option set.

I really did rebuild and test without EVM enabled.  sigh, it would have
helped to also configure the filesystems which use the stub function.

Mimi