Skip to content

GitLab

Switch branch/tag
History Find file
Clone
evm: prohibit userspace writing 'security.evm' HMAC value
Mimi Zohar authored 
commit 2fb1c9a4

 upstream.

Calculating the 'security.evm' HMAC value requires access to the
EVM encrypted key.  Only the kernel should have access to it.  This
patch prevents userspace tools(eg. setfattr, cp --preserve=xattr)
from setting/modifying the 'security.evm' HMAC value directly.
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
bb7f9e5c
Name Last commit Last update
..
apparmor new helper: file_inode(file)
integrity evm: prohibit userspace writing 'security.evm' HMAC value
keys aio: don't include aio.h in sched.h
selinux selinux: correctly label /proc inodes in use before the policy is loaded
smack Smack: include magic.h in smackfs.c
tomoyo Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
yama yama: Better permission check for ptraceme
Kconfig KEYS: Move the key config into security/keys/Kconfig
Makefile security: Yama LSM
capability.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
commoncap.c kill f_vfsmnt
device_cgroup.c devcg: remove parent_cgroup.
inode.c securityfs: fix object creation races
lsm_audit.c LSM: BUILD_BUG_ON if the common_audit_data union ever grows
min_addr.c mmap_min_addr check CAP_SYS_RAWIO only for write
security.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security