richardphibel / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
Florian Festi 288f17
Based on
Florian Festi 288f17
Florian Festi 288f17
From 7db2efa95d859cebda2b095ffdffac42812bd6d9 Mon Sep 17 00:00:00 2001
Florian Festi 288f17
From: Darren Kenny <darren.kenny@oracle.com>
Florian Festi 288f17
Date: Tue, 22 Feb 2022 16:57:00 +0000
Florian Festi 288f17
Subject: [PATCH] ima: Install on filesystems without xattr support without
Florian Festi 288f17
 failing
Florian Festi 288f17
Florian Festi 288f17
If an RPM contains IMA signed digests and rpm-plugin-ima is installed,
Florian Festi 288f17
then any attempt to install to a filesystem that doesn't support
Florian Festi 288f17
extended attributes will cause the RPM installation to fail.
Florian Festi 288f17
Florian Festi 288f17
This can be seen, for example, if installing a file /boot, which is
Florian Festi 288f17
usually a vFAT filesystem.
Florian Festi 288f17
Florian Festi 288f17
The rpm-plugin for selinux fixed this some time back, and that same
Florian Festi 288f17
logic can be applied to IMA too - where, if a failure to set an extended
Florian Festi 288f17
attribute results in an errno that is set to EOPNOTSUPP, then this
Florian Festi 288f17
should not cause a complete failure, but should instead just be logged
Florian Festi 288f17
at a debug level.
Florian Festi 288f17
Florian Festi 288f17
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
Florian Festi 288f17
Florian Festi 288f17
--- rpm-4.16.1.3/plugins/ima.c.orig	2023-05-02 18:19:25.095992859 +0200
Florian Festi 288f17
+++ rpm-4.16.1.3/plugins/ima.c	2023-05-02 18:21:46.032941008 +0200
Florian Festi 288f17
@@ -69,10 +69,13 @@
Florian Festi 288f17
 	fsig = rpmfiFSignature(fi, &len;;
Florian Festi 288f17
 	if (fsig && (check_zero_hdr(fsig, len) == 0)) {
Florian Festi 288f17
 	    if (lsetxattr(path, XATTR_NAME_IMA, fsig, len, 0) < 0) {
Florian Festi 288f17
-	        rpmlog(RPMLOG_ERR,
Florian Festi 288f17
+		int is_err = errno != EOPNOTSUPP; 
Florian Festi 288f17
+	        rpmlog(is_err?RPMLOG_ERR:RPMLOG_DEBUG,
Florian Festi 288f17
 			"ima: could not apply signature on '%s': %s\n",
Florian Festi 288f17
 			path, strerror(errno));
Florian Festi 288f17
-	        rc = RPMRC_FAIL;
Florian Festi 288f17
+		if (is_err) {
Florian Festi 288f17
+		    rc = RPMRC_FAIL;
Florian Festi 288f17
+		}
Florian Festi 288f17
 	    }
Florian Festi 288f17
 	}
Florian Festi 288f17