UBUNTU: SAUCE: (namespace) evm: Don't update hmacs in user ns mounts

The kernel should not calculate new hmacs for mounts done by
non-root users. Update evm_calc_hmac_or_hash() to refuse to
calculate new hmacs for mounts for non-init user namespaces.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 1d32cd20009a3bd35cf77bc11027354c00eb8812..9c9b799a8740f84f432d6cb41d117f5abd2957fb 100644 (file)
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -190,7 +190,8 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
        int error;
        int size;
 
-       if (!(inode->i_opflags & IOP_XATTR))
+       if (!(inode->i_opflags & IOP_XATTR) ||
+           inode->i_sb->s_user_ns != &init_user_ns)
                return -EOPNOTSUPP;
 
        desc = init_desc(type);