From nobody Tue Sep 16 23:06:52 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B4EDC10F1B for ; Wed, 28 Dec 2022 03:06:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229840AbiL1DGA (ORCPT ); Tue, 27 Dec 2022 22:06:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229722AbiL1DFy (ORCPT ); Tue, 27 Dec 2022 22:05:54 -0500 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EC41A102A; Tue, 27 Dec 2022 19:05:51 -0800 (PST) Received: from dggpeml500023.china.huawei.com (unknown [172.30.72.54]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4Nhbw10XnQzRqLt; Wed, 28 Dec 2022 11:04:17 +0800 (CST) Received: from ubuntu1804.huawei.com (10.67.174.58) by dggpeml500023.china.huawei.com (7.185.36.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Wed, 28 Dec 2022 11:05:38 +0800 From: Xiu Jianfeng To: , , , , CC: , , Subject: [PATCH -next] evm: Use __vfs_setxattr() to update security.evm Date: Wed, 28 Dec 2022 11:02:48 +0800 Message-ID: <20221228030248.94285-1-xiujianfeng@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.67.174.58] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpeml500023.china.huawei.com (7.185.36.114) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Currently it uses __vfs_setxattr_noperm() to update "security.evm", however there are two lsm hooks(inode_post_setxattr and inode_setsecurity) being called inside this function, which don't make any sense for xattr "security.evm", because the handlers of these two hooks, such as selinux and smack, only care about their own xattr. On the other hand, there is a literally rather than actually cyclical callchain as follows: security_inode_post_setxattr ->evm_inode_post_setxattr ->evm_update_evmxattr ->__vfs_setxattr_noperm ->security_inode_post_setxattr So use __vfs_setxattr() to update "security.evm". Signed-off-by: Xiu Jianfeng --- security/integrity/evm/evm_crypto.c | 7 +++---- security/integrity/ima/ima_appraise.c | 8 ++++---- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/e= vm_crypto.c index fa5ff13fa8c9..d8275dfa49ef 100644 --- a/security/integrity/evm/evm_crypto.c +++ b/security/integrity/evm/evm_crypto.c @@ -376,10 +376,9 @@ int evm_update_evmxattr(struct dentry *dentry, const c= har *xattr_name, xattr_value_len, &data); if (rc =3D=3D 0) { data.hdr.xattr.sha1.type =3D EVM_XATTR_HMAC; - rc =3D __vfs_setxattr_noperm(&init_user_ns, dentry, - XATTR_NAME_EVM, - &data.hdr.xattr.data[1], - SHA1_DIGEST_SIZE + 1, 0); + rc =3D __vfs_setxattr(&init_user_ns, dentry, d_inode(dentry), + XATTR_NAME_EVM, &data.hdr.xattr.data[1], + SHA1_DIGEST_SIZE + 1, 0); } else if (rc =3D=3D -ENODATA && (inode->i_opflags & IOP_XATTR)) { rc =3D __vfs_removexattr(&init_user_ns, dentry, XATTR_NAME_EVM); } diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima= /ima_appraise.c index ee6f7e237f2e..d2de9dc6c345 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -98,10 +98,10 @@ static int ima_fix_xattr(struct dentry *dentry, iint->ima_hash->xattr.ng.type =3D IMA_XATTR_DIGEST_NG; iint->ima_hash->xattr.ng.algo =3D algo; } - rc =3D __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_IMA, - &iint->ima_hash->xattr.data[offset], - (sizeof(iint->ima_hash->xattr) - offset) + - iint->ima_hash->length, 0); + rc =3D __vfs_setxattr(&init_user_ns, dentry, d_inode(dentry), + XATTR_NAME_IMA, &iint->ima_hash->xattr.data[offset], + (sizeof(iint->ima_hash->xattr) - offset) + + iint->ima_hash->length, 0); return rc; } =20 --=20 2.17.1