[PATCH v3 0/2] ima: reject modsig when detached data cannot be supplied

[Jérémy Jean]

ima_collect_modsig() supplies the file contents to the parsed PKCS#7
message as detached data. If the message already contains embedded data,
pkcs7_supply_detached_data() returns -EINVAL, but IMA ignores the error.
ima_modsig_verify() then verifies the embedded data instead of the file
being appraised. This could bypass the crypto check if one supplies data
with an already known valid signature.

Patch 1 fixes the verification path by discarding a modsig if detached
data cannot be supplied.

Patch 2 keeps the exact pkcs7_supply_detached_data() error for a
separate failed-modsig audit record. This part has been split out on
request from Mimi Zohar so that the verification fix can be backported
without this audit change.

---
Changes in v3:
- Split the verification fix from the audit change.

Changes in v2:
- If detached data cannot be supplied, discard the modsig but continue
  hashing and xattr appraisal.
- Keep signatures without exported digests; leave d-modsig empty.
- Audit failure to supply detached data separately, even with O_DIRECT.

v1: https://lore.kernel.org/all/20260822082434.489470-2-Jeremy.Jean@oss.cyber.gouv.fr/
v2: https://lore.kernel.org/all/20260924085516.3111521-2-Jeremy.Jean@oss.cyber.gouv.fr/

Jérémy Jean (2):
  ima: discard modsig when detached data cannot be supplied
  ima: audit failure to supply detached data for modsig

 Documentation/security/IMA-templates.rst  |  3 ++-
 security/integrity/ima/ima.h              |  9 ++++----
 security/integrity/ima/ima_api.c          | 28 ++++++++++++++++-------
 security/integrity/ima/ima_main.c         |  2 +-
 security/integrity/ima/ima_modsig.c       | 16 +++++++++----
 security/integrity/ima/ima_template_lib.c |  4 ++--
 6 files changed, 41 insertions(+), 21 deletions(-)

-- 
2.47.3