Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux...

[firefly-linux-kernel-4.4.55.git] / security / integrity / evm / evm_main.c

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index c5ee1a7c5e8a0a361a8fb21de3ee236faba3804a..f589c9a05da29f6bf40cfd903858ee1569791c41 100644 (file)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -162,9 +162,14 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
                                        (const char *)xattr_data, xattr_len,
                                        calc.digest, sizeof(calc.digest));
                if (!rc) {
-                       /* we probably want to replace rsa with hmac here */
-                       evm_update_evmxattr(dentry, xattr_name, xattr_value,
-                                  xattr_value_len);
+                       /* Replace RSA with HMAC if not mounted readonly and
+                        * not immutable
+                        */
+                       if (!IS_RDONLY(dentry->d_inode) &&
+                           !IS_IMMUTABLE(dentry->d_inode))
+                               evm_update_evmxattr(dentry, xattr_name,
+                                                   xattr_value,
+                                                   xattr_value_len);
                }
                break;
        default: