From e2f7dbcf2dc570cfc90a7b77407d9ab3afb60d28 Mon Sep 17 00:00:00 2001 From: Seth Forshee Date: Thu, 15 Dec 2016 11:03:08 -0600 Subject: [PATCH] UBUNTU: SAUCE: (namespace) evm: Don't update hmacs in user ns mounts The kernel should not calculate new hmacs for mounts done by non-root users. Update evm_calc_hmac_or_hash() to refuse to calculate new hmacs for mounts for non-init user namespaces. Signed-off-by: Seth Forshee --- security/integrity/evm/evm_crypto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c index 1d32cd20009a..9c9b799a8740 100644 --- a/security/integrity/evm/evm_crypto.c +++ b/security/integrity/evm/evm_crypto.c @@ -190,7 +190,8 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry, int error; int size; - if (!(inode->i_opflags & IOP_XATTR)) + if (!(inode->i_opflags & IOP_XATTR) || + inode->i_sb->s_user_ns != &init_user_ns) return -EOPNOTSUPP; desc = init_desc(type); -- 2.39.2