RE: [PATCH v3 06/11] evm: Ignore INTEGRITY_NOLABEL if no HMAC key is loaded

2020-12-04 Thread Roberto Sassu
> From: Mimi Zohar [mailto:zo...@linux.ibm.com] > Sent: Friday, December 4, 2020 2:05 PM > On Fri, 2020-12-04 at 08:05 +, Roberto Sassu wrote: > > > From: Mimi Zohar [mailto:zo...@linux.ibm.com] > > > Sent: Thursday, December 3, 2020 9:43 PM > > > Hi Roberto, > > > > > > On Wed, 2020-11-11 at 1

Re: [PATCH v3 06/11] evm: Ignore INTEGRITY_NOLABEL if no HMAC key is loaded

2020-12-04 Thread Mimi Zohar
On Fri, 2020-12-04 at 08:05 +, Roberto Sassu wrote: > > From: Mimi Zohar [mailto:zo...@linux.ibm.com] > > Sent: Thursday, December 3, 2020 9:43 PM > > Hi Roberto, > > > > On Wed, 2020-11-11 at 10:22 +0100, Roberto Sassu wrote: > > > When a file is being created, LSMs can set the initial label

RE: [PATCH v3 06/11] evm: Ignore INTEGRITY_NOLABEL if no HMAC key is loaded

2020-12-04 Thread Roberto Sassu
> From: Mimi Zohar [mailto:zo...@linux.ibm.com] > Sent: Thursday, December 3, 2020 9:43 PM > Hi Roberto, > > On Wed, 2020-11-11 at 10:22 +0100, Roberto Sassu wrote: > > When a file is being created, LSMs can set the initial label with the > > inode_init_security hook. If no HMAC key is loaded, the

Re: [PATCH v3 06/11] evm: Ignore INTEGRITY_NOLABEL if no HMAC key is loaded

2020-12-03 Thread Mimi Zohar
Hi Roberto, On Wed, 2020-11-11 at 10:22 +0100, Roberto Sassu wrote: > When a file is being created, LSMs can set the initial label with the > inode_init_security hook. If no HMAC key is loaded, the new file will have > LSM xattrs but not the HMAC. > > Unfortunately, EVM will deny any further meta