Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr[EOL][EOL]Currently when both IMA and EVM are in fix mode, the IMA signature will[EOL]be reset to IMA hash if a program first stores IMA signature in[EOL]security.ima and then writes/removes some other security xattr for the[EOL]file.[EOL][EOL]For example, on Fedora, after booting the kernel with "ima_appraise=fix[EOL]evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima,[EOL]installing/reinstalling a package will not make good reference IMA[EOL]signature generated. Instead IMA hash is generated,[EOL][EOL]    # getfattr -m - -d -e hex /usr/bin/bash[EOL]    # file: usr/bin/bash[EOL]    security.ima=0x0404...[EOL][EOL]This happens because when setting security.selinux, the IMA_DIGSIG flag[EOL]that had been set early was cleared. As a result, IMA hash is generated[EOL]when the file is closed.[EOL][EOL]Similarly, IMA signature can be cleared on file close after removing[EOL]security xattr like security.evm or setting/removing ACL.[EOL][EOL]Prevent replacing the IMA file signature with a file hash, by preventing[EOL]the IMA_DIGSIG flag from being reset.[EOL][EOL]Here's a minimal C reproducer which sets security.selinux as the last[EOL]step which can also replaced by removing security.evm or setting ACL,[EOL][EOL]    #include <stdio.h>[EOL]    #include <sys/xattr.h>[EOL]    #include <fcntl.h>[EOL]    #include <unistd.h>[EOL]    #include <string.h>[EOL]    #include <stdlib.h>[EOL][EOL]    int main() {[EOL]        const char* file_path = "/usr/sbin/test_binary";[EOL]        const char* hex_string = "030204d33204490066306402304";[EOL]        int length = strlen(hex_string);[EOL]        char* ima_attr_value;[EOL]        int fd;[EOL][EOL]        fd = open(file_path, O_WRONLY (O_CREAT|O_EXCL, 0644);[EOL)        if (fd == -1) {[EOL]            perror("Error opening file");[EOL]            return 1;[EOL]        }[EOL][EOL]        ima_attr_value = (char*)malloc(length / 2 );[EOL]        for (int i = 0, j = 0; i < length; i += 2, j++) {[EOL]            sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]);[EOL]        }[EOL][EOL]        if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) {[EOL]            perror("Error setting extended attribute");[EOL]            close(fd);[EOL]            return 1;[EOL]        }[EOL][EOL]        const char* selinux_value= "system_u:object_r:bin_t:s0";[EOL]        if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) {[EOL]            perror("Error setting extended attribute");[EOL]            close(fd);[EOL]            return 1;[EOL]        }[EOL][EOL]        close(fd);[EOL][EOL]        return 0;[EOL]    }