ima: fix blocking of security.ima xattrs of unsupported algorithms

[ Upstream commit 5926586f291b53cb8a0c9631fc19489be1186e2d ]

Limit validating the hash algorithm to just security.ima xattr, not
the security.evm xattr or any of the protected EVM security xattrs,
nor posix acls.

Fixes: 50f742dd9147 ("IMA: block writes of the security.ima xattr with unsupported algorithms")
Reported-by: Christian Brauner <brauner@kernel.org>
Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index ed04bb7c751200ac1b2a7872f152654f6cbdf89c..08b49bd1e8caf7b904f282c8f0bfd273f325cc7c 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -644,22 +644,26 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
        const struct evm_ima_xattr_data *xvalue = xattr_value;
        int digsig = 0;
        int result;
+       int err;
 
        result = ima_protect_xattr(dentry, xattr_name, xattr_value,
                                   xattr_value_len);
        if (result == 1) {
                if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
                        return -EINVAL;
+
+               err = validate_hash_algo(dentry, xvalue, xattr_value_len);
+               if (err)
+                       return err;
+
                digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
        } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
                digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
        }
        if (result == 1 || evm_revalidate_status(xattr_name)) {
-               result = validate_hash_algo(dentry, xvalue, xattr_value_len);
-               if (result)
-                       return result;
-
                ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
+               if (result == 1)
+                       result = 0;
        }
        return result;
 }