| Message ID | 20220222214518.9316-1-rdunlap@infradead.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | EVM: fix the evm= __setup handler return value | expand |
On Tue, 2022-02-22 at 13:45 -0800, Randy Dunlap wrote: > __setup() handlers should return 1 if the parameter is handled. > Returning 0 causes the entire string to be added to init's > environment strings (limited to 32 strings), unnecessarily polluting it. > > Using the documented string "evm=fix" causes an Unknown parameter message: > Unknown kernel command line parameters > "BOOT_IMAGE=/boot/bzImage-517rc5 evm=fix", will be passed to user space. > > and that string is added to init's environment string space: > Run /sbin/init as init process > with arguments: > /sbin/init > with environment: > HOME=/ > TERM=linux > BOOT_IMAGE=/boot/bzImage-517rc5 > evm=fix > > With this change, using "evm=fix" acts as expected and an invalid > option ("evm=evm") causes a warning to be printed: > evm: invalid "evm" mode > but init's environment is not polluted with this string, as expected. > > Fixes: 7102ebcd65c1 ("evm: permit only valid security.evm xattrs to be updated") > Signed-off-by: Randy Dunlap <rdunlap@infradead.org> > Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru> > Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Thanks, Randy, Igor. The patch is queued in #next-integrity-testing. Mimi
--- lnx-517-rc5.orig/security/integrity/evm/evm_main.c +++ lnx-517-rc5/security/integrity/evm/evm_main.c @@ -86,7 +86,7 @@ static int __init evm_set_fixmode(char * else pr_err("invalid \"%s\" mode", str); - return 0; + return 1; } __setup("evm=", evm_set_fixmode);
__setup() handlers should return 1 if the parameter is handled. Returning 0 causes the entire string to be added to init's environment strings (limited to 32 strings), unnecessarily polluting it. Using the documented string "evm=fix" causes an Unknown parameter message: Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5 evm=fix", will be passed to user space. and that string is added to init's environment string space: Run /sbin/init as init process with arguments: /sbin/init with environment: HOME=/ TERM=linux BOOT_IMAGE=/boot/bzImage-517rc5 evm=fix With this change, using "evm=fix" acts as expected and an invalid option ("evm=evm") causes a warning to be printed: evm: invalid "evm" mode but init's environment is not polluted with this string, as expected. Fixes: 7102ebcd65c1 ("evm: permit only valid security.evm xattrs to be updated") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru> Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: Mimi Zohar <zohar@us.ibm.com> Cc: linux-integrity@vger.kernel.org Cc: James Morris <jmorris@namei.org> Cc: "Serge E. Hallyn" <serge@hallyn.com> --- security/integrity/evm/evm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)