ima_collect_modsig() supplies the file contents to the parsed PKCS#7 message as detached data. If the message already contains embedded data, pkcs7_supply_detached_data() returns -EINVAL, but IMA ignores the error. ima_modsig_verify() then verifies the embedded data instead of the file being appraised. This could bypass the crypto check if one supplies data with an already known valid signature.
Patch 1 fixes the verification path by discarding a modsig if detached data cannot be supplied. Patch 2 keeps the exact pkcs7_supply_detached_data() error for a separate failed-modsig audit record. This part has been split out on request from Mimi Zohar so that the verification fix can be backported without this audit change. --- Changes in v3: - Split the verification fix from the audit change. Changes in v2: - If detached data cannot be supplied, discard the modsig but continue hashing and xattr appraisal. - Keep signatures without exported digests; leave d-modsig empty. - Audit failure to supply detached data separately, even with O_DIRECT. v1: https://lore.kernel.org/all/[email protected]/ v2: https://lore.kernel.org/all/[email protected]/ Jérémy Jean (2): ima: discard modsig when detached data cannot be supplied ima: audit failure to supply detached data for modsig Documentation/security/IMA-templates.rst | 3 ++- security/integrity/ima/ima.h | 9 ++++---- security/integrity/ima/ima_api.c | 28 ++++++++++++++++------- security/integrity/ima/ima_main.c | 2 +- security/integrity/ima/ima_modsig.c | 16 +++++++++---- security/integrity/ima/ima_template_lib.c | 4 ++-- 6 files changed, 41 insertions(+), 21 deletions(-) -- 2.47.3
