1. 06 2月, 2013 1 次提交
    • D
      evm: add file system uuid to EVM hmac · 74de6684
      Dmitry Kasatkin 提交于
      EVM uses the same key for all file systems to calculate the HMAC,
      making it possible to paste inodes from one file system on to another
      one, without EVM being able to detect it.  To prevent such an attack,
      it is necessary to make the EVM HMAC file system specific.
      
      This patch uses the file system UUID, a file system unique identifier,
      to bind the EVM HMAC to the file system. The value inode->i_sb->s_uuid
      is used for the HMAC hash calculation, instead of using it for deriving
      the file system specific key.  Initializing the key for every inode HMAC
      calculation is a bit more expensive operation than adding the uuid to
      the HMAC hash.
      
      Changing the HMAC calculation method or adding additional info to the
      calculation, requires existing EVM labeled file systems to be relabeled.
      This patch adds a Kconfig HMAC version option for backwards compatability.
      
      Changelog v1:
      - squash "hmac version setting"
      Changelog v0:
      - add missing Kconfig depends (Mimi)
      Signed-off-by: NDmitry Kasatkin <dmitry.kasatkin@intel.com>
      Signed-off-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      74de6684
  2. 05 2月, 2013 24 次提交
  3. 01 2月, 2013 2 次提交
  4. 23 1月, 2013 4 次提交
  5. 17 1月, 2013 9 次提交