ipe: also reject policy updates with the same version
Currently IPE accepts an update that has the same version as the policy being updated, but it doesn't make it a no-op nor it checks that the old and new policyes are the same. So it is possible to change the content of a policy, without changing its version. This is very confusing from userspace when managing policies. Instead change the update logic to reject updates that have the same version with ESTALE, as that is much clearer and intuitive behaviour. Signed-off-by: Luca Boccassi <bluca@debian.org> Reviewed-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Fan Wu <wufan@kernel.org>
This commit is contained in:
parent
579941899d
commit
5ceecb301e
@ -266,7 +266,7 @@ in the kernel. This file is write-only and accepts a PKCS#7 signed
|
|||||||
policy. Two checks will always be performed on this policy: First, the
|
policy. Two checks will always be performed on this policy: First, the
|
||||||
``policy_names`` must match with the updated version and the existing
|
``policy_names`` must match with the updated version and the existing
|
||||||
version. Second the updated policy must have a policy version greater than
|
version. Second the updated policy must have a policy version greater than
|
||||||
or equal to the currently-running version. This is to prevent rollback attacks.
|
the currently-running version. This is to prevent rollback attacks.
|
||||||
|
|
||||||
The ``delete`` file is used to remove a policy that is no longer needed.
|
The ``delete`` file is used to remove a policy that is no longer needed.
|
||||||
This file is write-only and accepts a value of ``1`` to delete the policy.
|
This file is write-only and accepts a value of ``1`` to delete the policy.
|
||||||
|
@ -106,7 +106,7 @@ int ipe_update_policy(struct inode *root, const char *text, size_t textlen,
|
|||||||
goto err;
|
goto err;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (ver_to_u64(old) > ver_to_u64(new)) {
|
if (ver_to_u64(old) >= ver_to_u64(new)) {
|
||||||
rc = -ESTALE;
|
rc = -ESTALE;
|
||||||
goto err;
|
goto err;
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user