From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:58687 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752280AbbG3TxO (ORCPT ); Thu, 30 Jul 2015 15:53:14 -0400 Subject: Patch "evm: labeling pseudo filesystems exception" has been added to the 3.14-stable tree To: zohar@linux.vnet.ibm.com, gregkh@linuxfoundation.org Cc: , From: Date: Thu, 30 Jul 2015 12:53:13 -0700 Message-ID: <143828599340221@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled evm: labeling pseudo filesystems exception to the 3.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: evm-labeling-pseudo-filesystems-exception.patch and it can be found in the queue-3.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 5101a1850bb7ccbf107929dee9af0cd2f400940f Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Tue, 21 Apr 2015 13:59:31 -0400 Subject: evm: labeling pseudo filesystems exception From: Mimi Zohar commit 5101a1850bb7ccbf107929dee9af0cd2f400940f upstream. To prevent offline stripping of existing file xattrs and relabeling of them at runtime, EVM allows only newly created files to be labeled. As pseudo filesystems are not persistent, stripping of xattrs is not a concern. Some LSMs defer file labeling on pseudo filesystems. This patch permits the labeling of existing files on pseudo files systems. Signed-off-by: Mimi Zohar Signed-off-by: Greg Kroah-Hartman --- security/integrity/evm/evm_main.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -275,6 +275,17 @@ static int evm_protect_xattr(struct dent iint = integrity_iint_find(dentry->d_inode); if (iint && (iint->flags & IMA_NEW_FILE)) return 0; + + /* exception for pseudo filesystems */ + if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC + || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC) + return 0; + + integrity_audit_msg(AUDIT_INTEGRITY_METADATA, + dentry->d_inode, dentry->d_name.name, + "update_metadata", + integrity_status_msg[evm_status], + -EPERM, 0); } out: if (evm_status != INTEGRITY_PASS) Patches currently in stable-queue which might be from zohar@linux.vnet.ibm.com are queue-3.14/evm-labeling-pseudo-filesystems-exception.patch queue-3.14/ima-fix-ima_show_template_data_ascii.patch