From nobody Sun Feb 8 11:09:26 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34D821A727; Tue, 19 Dec 2023 13:49:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="jrSsh/9H" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJCoXKJ008082; Tue, 19 Dec 2023 13:49:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=zZbjaoTjlPkJFXiQHD8SI3UTG7YuYOK40SKblWX/KhY=; b=jrSsh/9HrSwa1+b0R4nBUxaTa2JhLrx8zFWnu/Ygrfy0mJb9A3I3hXBTDp8RcZmnQmP/ lWNA0Yx9ps+tAsEX5OpzbY6gERhtZeBdHcfOpFkoJx6s3ST61mGAltOxcC4QpL276BWn kB2YC+8Ey8OOCajEDLGPdSVKiw+v6UJINvU2M0dzy/RUbF+DcSQFnP2GjafKiXAv3e8F a8fBl8hxvpG/aLRDkHSK+pBjedljoqBcYUjqhmixntt9Lq07UhIOumYvvuz//mvofWuo Okg2tEVzYF4jpS/UcINUOG3848iunMacvsaNF57dheajSiqO105uJOSTToX11yJ5f+Rn +g== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3ayj2ceg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 13:49:35 +0000 Received: from m0356517.ppops.net (m0356517.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 3BJDKL4Q007383; Tue, 19 Dec 2023 13:49:34 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3ayj2cdn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 13:49:34 +0000 Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJDM8uo010900; Tue, 19 Dec 2023 13:49:33 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3v1q7nfy7p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 13:49:33 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 3BJDnVrn10748516 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 19 Dec 2023 13:49:31 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 036322004B; Tue, 19 Dec 2023 13:49:31 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8644820040; Tue, 19 Dec 2023 13:49:28 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.61.183.131]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 19 Dec 2023 13:49:28 +0000 (GMT) From: Mimi Zohar To: linux-unionfs@vger.kernel.org Cc: Mimi Zohar , linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, Amir Goldstein , Christian Brauner , Seth Forshee , Roberto Sassu Subject: [PATCH 1/2] evm: don't copy up 'security.evm' xattr Date: Tue, 19 Dec 2023 08:49:00 -0500 Message-Id: <20231219134901.96300-2-zohar@linux.ibm.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20231219134901.96300-1-zohar@linux.ibm.com> References: <20231219134901.96300-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 9u4vQM_WsVdwHQBtpzy2p2ScOXEspfY0 X-Proofpoint-GUID: 2h3nsbQ7kqlQ3tmC7PO76szmAyrwvT3N X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.997,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-12-19_08,2023-12-14_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 mlxlogscore=811 bulkscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 spamscore=0 mlxscore=0 impostorscore=0 suspectscore=0 priorityscore=1501 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2312190103 Content-Type: text/plain; charset="utf-8" The security.evm HMAC and the original file signatures contain filesystem specific data. As a result, the HMAC and signature are not the same on the stacked and backing filesystems. Don't copy up 'security.evm'. Signed-off-by: Mimi Zohar Reviewed-by: Amir Goldstein --- include/linux/evm.h | 6 ++++++ security/integrity/evm/evm_main.c | 7 +++++++ security/security.c | 4 ++++ 3 files changed, 17 insertions(+) diff --git a/include/linux/evm.h b/include/linux/evm.h index 01fc495a83e2..36ec884320d9 100644 --- a/include/linux/evm.h +++ b/include/linux/evm.h @@ -31,6 +31,7 @@ extern void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name, const void *xattr_value, size_t xattr_value_len); +extern int evm_inode_copy_up_xattr(const char *name); extern int evm_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry, const char *xattr_name); extern void evm_inode_post_removexattr(struct dentry *dentry, @@ -117,6 +118,11 @@ static inline void evm_inode_post_setxattr(struct dent= ry *dentry, return; } =20 +static inline int evm_inode_copy_up_xattr(const char *name) +{ + return 0; +} + static inline int evm_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry, const char *xattr_name) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm= _main.c index 894570fe39bc..02adba635b02 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -863,6 +863,13 @@ void evm_inode_post_setattr(struct dentry *dentry, int= ia_valid) evm_update_evmxattr(dentry, NULL, NULL, 0); } =20 +int evm_inode_copy_up_xattr(const char *name) +{ + if (strcmp(name, XATTR_NAME_EVM) =3D=3D 0) + return 1; /* Discard */ + return -EOPNOTSUPP; +} + /* * evm_inode_init_security - initializes security.evm HMAC value */ diff --git a/security/security.c b/security/security.c index dcb3e7014f9b..a02e78c45007 100644 --- a/security/security.c +++ b/security/security.c @@ -2539,6 +2539,10 @@ int security_inode_copy_up_xattr(const char *name) return rc; } =20 + rc =3D evm_inode_copy_up_xattr(name); + if (rc !=3D LSM_RET_DEFAULT(inode_copy_up_xattr)) + return rc; + return LSM_RET_DEFAULT(inode_copy_up_xattr); } EXPORT_SYMBOL(security_inode_copy_up_xattr); --=20 2.39.3 From nobody Sun Feb 8 11:09:26 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EAB851BDF3; Tue, 19 Dec 2023 13:49:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Be6SlkjU" Received: from pps.filterd (m0353723.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJBhEDk011557; Tue, 19 Dec 2023 13:49:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=NPjpiQqB/XwG2kL1albQJVZXEm834TnGuqtZmfnSItE=; b=Be6SlkjUf5kODr8yxPcDnOOC93iT9yZsPnrMaZyLTdBB4wzAhr5c109DFvNb5EGy6Spk 23tXQyY7Dsz66jfF6IRtKFdNoVrtIlveb3XZ2cyc1sziaDgLZNHWptBtYAbyUOHZl7JO SO/xN34Sk7RwS26uSrEVo89mEhTUuMukLFd3aC+pYQ/FoAeeOONkjzAhQ/2l5P+YMOWr mVIJmXVrIdS4qTJrc/tYOqV6qYGpeGi3AYoFkUkCr9euCKd5grYyOKZRywSwfjqMWlXn WH3rhuGYkvUzS0ngfZtYGe3s3uZmDyXMJP7tsxUpd5VvX5xJ+bB4vJnHXtd5gAUoza/C jw== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3ahwk6tc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 13:49:36 +0000 Received: from m0353723.ppops.net (m0353723.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 3BJDAhpO008831; Tue, 19 Dec 2023 13:49:35 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3v3ahwk6t4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 13:49:35 +0000 Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 3BJC759L029712; Tue, 19 Dec 2023 13:49:35 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 3v1p7sg7kp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 19 Dec 2023 13:49:34 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 3BJDnXd945023970 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 19 Dec 2023 13:49:33 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4503320043; Tue, 19 Dec 2023 13:49:33 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6415A2004B; Tue, 19 Dec 2023 13:49:31 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.61.183.131]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 19 Dec 2023 13:49:31 +0000 (GMT) From: Mimi Zohar To: linux-unionfs@vger.kernel.org Cc: Mimi Zohar , linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, Amir Goldstein , Christian Brauner , Seth Forshee , Roberto Sassu Subject: [PATCH 2/2] evm: add support to disable EVM on unsupported filesystems Date: Tue, 19 Dec 2023 08:49:01 -0500 Message-Id: <20231219134901.96300-3-zohar@linux.ibm.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20231219134901.96300-1-zohar@linux.ibm.com> References: <20231219134901.96300-1-zohar@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: r9Lni6yzcpPQwkP24dn2sm7-qa8qBnGT X-Proofpoint-ORIG-GUID: c1n8usABbRrfBGRCvFWMf_kvc_FtTNuA X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.997,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-12-19_08,2023-12-14_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 suspectscore=0 lowpriorityscore=0 bulkscore=0 clxscore=1015 spamscore=0 phishscore=0 mlxscore=0 impostorscore=0 mlxlogscore=633 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2312190103 Content-Type: text/plain; charset="utf-8" Don't verify, write, remove or update 'security.evm' on unsupported filesystems. Temporarily define overlayfs as an unsupported filesystem until a complete solution is developed. Signed-off-by: Mimi Zohar --- security/integrity/evm/evm_main.c | 35 ++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm= _main.c index 02adba635b02..aa6d32a07d20 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -151,6 +151,17 @@ static int evm_find_protected_xattrs(struct dentry *de= ntry) return count; } =20 +static int is_unsupported_fs(struct dentry *dentry) +{ + struct inode *inode =3D d_backing_inode(dentry); + + if (strcmp(inode->i_sb->s_type->name, "overlay") =3D=3D 0) { + pr_info_once("overlayfs not supported\n"); + return 1; + } + return 0; +} + /* * evm_verify_hmac - calculate and compare the HMAC with the EVM xattr * @@ -181,6 +192,9 @@ static enum integrity_status evm_verify_hmac(struct den= try *dentry, iint->evm_status =3D=3D INTEGRITY_PASS_IMMUTABLE)) return iint->evm_status; =20 + if (is_unsupported_fs(dentry)) + return INTEGRITY_UNKNOWN; + /* if status is not PASS, try to check again - against -ENOMEM */ =20 /* first need to know the sig type */ @@ -408,6 +422,9 @@ enum integrity_status evm_verifyxattr(struct dentry *de= ntry, if (!evm_key_loaded() || !evm_protected_xattr(xattr_name)) return INTEGRITY_UNKNOWN; =20 + if (is_unsupported_fs(dentry)) + return INTEGRITY_UNKNOWN; + if (!iint) { iint =3D integrity_iint_find(d_backing_inode(dentry)); if (!iint) @@ -491,15 +508,21 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, if (strcmp(xattr_name, XATTR_NAME_EVM) =3D=3D 0) { if (!capable(CAP_SYS_ADMIN)) return -EPERM; + if (is_unsupported_fs(dentry)) + return -EPERM; } else if (!evm_protected_xattr(xattr_name)) { if (!posix_xattr_acl(xattr_name)) return 0; + if (is_unsupported_fs(dentry)) + return 0; + evm_status =3D evm_verify_current_integrity(dentry); if ((evm_status =3D=3D INTEGRITY_PASS) || (evm_status =3D=3D INTEGRITY_NOXATTRS)) return 0; goto out; - } + } else if (is_unsupported_fs(dentry)) + return 0; =20 evm_status =3D evm_verify_current_integrity(dentry); if (evm_status =3D=3D INTEGRITY_NOXATTRS) { @@ -750,6 +773,9 @@ void evm_inode_post_setxattr(struct dentry *dentry, con= st char *xattr_name, if (!(evm_initialized & EVM_INIT_HMAC)) return; =20 + if (is_unsupported_fs(dentry)) + return; + evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len); } =20 @@ -814,8 +840,12 @@ int evm_inode_setattr(struct mnt_idmap *idmap, struct = dentry *dentry, if (evm_initialized & EVM_ALLOW_METADATA_WRITES) return 0; =20 + if (is_unsupported_fs(dentry)) + return 0; + if (!(ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID))) return 0; + evm_status =3D evm_verify_current_integrity(dentry); /* * Writing attrs is safe for portable signatures, as portable signatures @@ -859,6 +889,9 @@ void evm_inode_post_setattr(struct dentry *dentry, int = ia_valid) if (!(evm_initialized & EVM_INIT_HMAC)) return; =20 + if (is_unsupported_fs(dentry)) + return; + if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID)) evm_update_evmxattr(dentry, NULL, NULL, 0); } --=20 2.39.3