IMA: block writes of the security.ima xattr with unsupported algorithms
authorTHOBY Simon <Simon.THOBY@viveris.fr>
Mon, 16 Aug 2021 08:10:59 +0000 (08:10 +0000)
committerMimi Zohar <zohar@linux.ibm.com>
Mon, 16 Aug 2021 21:30:41 +0000 (17:30 -0400)
commit50f742dd91474e7f4954bf88d094eede59783883
tree1e166fbbcf7811a2c9a9f67d330139345b1b872e
parent8510505d55e194d3f6c9644c9f9d12c4f6b0395a
IMA: block writes of the security.ima xattr with unsupported algorithms

By default, writes to the extended attributes security.ima will be
allowed even if the hash algorithm used for the xattr is not compiled
in the kernel (which does not make sense because the kernel would not
be able to appraise that file as it lacks support for validating the
hash).

Prevent and audit writes to the security.ima xattr if the hash algorithm
used in the new value is not available in the current kernel.

Signed-off-by: THOBY Simon <Simon.THOBY@viveris.fr>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
security/integrity/ima/ima.h
security/integrity/ima/ima_appraise.c