Skip to content

Commit 678074f

Browse files
committed
Merge tag 'integrity-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
Pull integrity updates from Mimi Zohar: "Just a couple of changes: crypto code cleanup and a IMA xattr bug fix" * tag 'integrity-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr lib/digsig: Use SHA-1 library instead of crypto_shash integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS
2 parents 6a74422 + 88b4cbc commit 678074f

File tree

4 files changed

+26
-47
lines changed

4 files changed

+26
-47
lines changed

lib/Kconfig

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -477,8 +477,7 @@ config MPILIB
477477
config SIGNATURE
478478
tristate
479479
depends on KEYS
480-
select CRYPTO
481-
select CRYPTO_SHA1
480+
select CRYPTO_LIB_SHA1
482481
select MPILIB
483482
help
484483
Digital signature verification. Currently only RSA is supported.

lib/digsig.c

Lines changed: 6 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,11 @@
1818
#include <linux/module.h>
1919
#include <linux/slab.h>
2020
#include <linux/key.h>
21-
#include <linux/crypto.h>
22-
#include <crypto/hash.h>
2321
#include <crypto/sha1.h>
2422
#include <keys/user-type.h>
2523
#include <linux/mpi.h>
2624
#include <linux/digsig.h>
2725

28-
static struct crypto_shash *shash;
29-
3026
static const char *pkcs_1_v1_5_decode_emsa(const unsigned char *msg,
3127
unsigned long msglen,
3228
unsigned long modulus_bitlen,
@@ -198,12 +194,12 @@ static int digsig_verify_rsa(struct key *key,
198194
int digsig_verify(struct key *keyring, const char *sig, int siglen,
199195
const char *data, int datalen)
200196
{
201-
int err = -ENOMEM;
202197
struct signature_hdr *sh = (struct signature_hdr *)sig;
203-
struct shash_desc *desc = NULL;
198+
struct sha1_ctx ctx;
204199
unsigned char hash[SHA1_DIGEST_SIZE];
205200
struct key *key;
206201
char name[20];
202+
int err;
207203

208204
if (siglen < sizeof(*sh) + 2)
209205
return -EINVAL;
@@ -230,49 +226,19 @@ int digsig_verify(struct key *keyring, const char *sig, int siglen,
230226
return PTR_ERR(key);
231227
}
232228

233-
desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash),
234-
GFP_KERNEL);
235-
if (!desc)
236-
goto err;
237-
238-
desc->tfm = shash;
239-
240-
crypto_shash_init(desc);
241-
crypto_shash_update(desc, data, datalen);
242-
crypto_shash_update(desc, sig, sizeof(*sh));
243-
crypto_shash_final(desc, hash);
244-
245-
kfree(desc);
229+
sha1_init(&ctx);
230+
sha1_update(&ctx, data, datalen);
231+
sha1_update(&ctx, sig, sizeof(*sh));
232+
sha1_final(&ctx, hash);
246233

247234
/* pass signature mpis address */
248235
err = digsig_verify_rsa(key, sig + sizeof(*sh), siglen - sizeof(*sh),
249236
hash, sizeof(hash));
250237

251-
err:
252238
key_put(key);
253239

254240
return err ? -EINVAL : 0;
255241
}
256242
EXPORT_SYMBOL_GPL(digsig_verify);
257243

258-
static int __init digsig_init(void)
259-
{
260-
shash = crypto_alloc_shash("sha1", 0, 0);
261-
if (IS_ERR(shash)) {
262-
pr_err("shash allocation failed\n");
263-
return PTR_ERR(shash);
264-
}
265-
266-
return 0;
267-
268-
}
269-
270-
static void __exit digsig_cleanup(void)
271-
{
272-
crypto_free_shash(shash);
273-
}
274-
275-
module_init(digsig_init);
276-
module_exit(digsig_cleanup);
277-
278244
MODULE_LICENSE("GPL");

security/integrity/Kconfig

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ config INTEGRITY_ASYMMETRIC_KEYS
3636
default n
3737
select ASYMMETRIC_KEY_TYPE
3838
select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
39+
select CRYPTO
3940
select CRYPTO_RSA
4041
select X509_CERTIFICATE_PARSER
4142
help

security/integrity/ima/ima_appraise.c

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -694,6 +694,15 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
694694
return 0;
695695
}
696696

697+
/*
698+
* ima_reset_appraise_flags - reset ima_iint_cache flags
699+
*
700+
* @digsig: whether to clear/set IMA_DIGSIG flag, tristate values
701+
* 0: clear IMA_DIGSIG
702+
* 1: set IMA_DIGSIG
703+
* -1: don't change IMA_DIGSIG
704+
*
705+
*/
697706
static void ima_reset_appraise_flags(struct inode *inode, int digsig)
698707
{
699708
struct ima_iint_cache *iint;
@@ -706,9 +715,9 @@ static void ima_reset_appraise_flags(struct inode *inode, int digsig)
706715
return;
707716
iint->measured_pcrs = 0;
708717
set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags);
709-
if (digsig)
718+
if (digsig == 1)
710719
set_bit(IMA_DIGSIG, &iint->atomic_flags);
711-
else
720+
else if (digsig == 0)
712721
clear_bit(IMA_DIGSIG, &iint->atomic_flags);
713722
}
714723

@@ -794,6 +803,8 @@ static int ima_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
794803
digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
795804
} else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
796805
digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
806+
} else {
807+
digsig = -1;
797808
}
798809
if (result == 1 || evm_revalidate_status(xattr_name)) {
799810
ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
@@ -807,19 +818,21 @@ static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
807818
const char *acl_name, struct posix_acl *kacl)
808819
{
809820
if (evm_revalidate_status(acl_name))
810-
ima_reset_appraise_flags(d_backing_inode(dentry), 0);
821+
ima_reset_appraise_flags(d_backing_inode(dentry), -1);
811822

812823
return 0;
813824
}
814825

815826
static int ima_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,
816827
const char *xattr_name)
817828
{
818-
int result;
829+
int result, digsig = -1;
819830

820831
result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
821832
if (result == 1 || evm_revalidate_status(xattr_name)) {
822-
ima_reset_appraise_flags(d_backing_inode(dentry), 0);
833+
if (!strcmp(xattr_name, XATTR_NAME_IMA))
834+
digsig = 0;
835+
ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
823836
if (result == 1)
824837
result = 0;
825838
}

0 commit comments

Comments
 (0)