Roberto Sassu 9acc89d31f evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded ... EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to temporarily disable metadata verification until all xattrs/attrs necessary to verify an EVM portable signature are copied to the file. This flag is cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is calculated on unverified xattrs/attrs. Currently EVM unnecessarily denies setting this flag if EVM is initialized with a public key, which is not a concern as it cannot be used to trust xattrs/attrs updates. This patch removes this limitation. Fixes: ae1ba1676b ("EVM: Allow userland to permit modification of EVM-protected metadata") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.16.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>		2021-05-21 12:47:08 -04:00
..
evm	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded	2021-05-21 12:47:08 -04:00
ima	evm: Load EVM key in ima_load_x509() to avoid appraisal	2021-05-21 12:47:04 -04:00
platform_certs	integrity: Load mokx variables into the blacklist keyring	2021-03-11 16:34:48 +00:00
digsig_asymmetric.c	ima: Support EC keys for signature verification	2021-03-26 19:41:59 +11:00
digsig.c	ima: enable loading of build time generated key on .ima keyring	2021-04-09 10:40:20 -04:00
iint.c	evm: Load EVM key in ima_load_x509() to avoid appraisal	2021-05-21 12:47:04 -04:00
integrity_audit.c	integrity: Use current_uid() in integrity_audit_message()	2020-08-31 17:46:50 -04:00
integrity.h	crypto: sha - split sha.h into sha1.h and sha2.h	2020-11-20 14:45:33 +11:00
Kconfig	powerpc: Load firmware trusted keys/hashes into kernel keyring	2019-11-13 00:33:23 +11:00
Makefile	powerpc: Load firmware trusted keys/hashes into kernel keyring	2019-11-13 00:33:23 +11:00