REDHAT-BUG-667912
First published: Fri Jan 07 2011(Updated: )
If security_filter_rule_init() doesn't return a rule, then not everything is as fine as the return code implies. This bug only occurs when the LSM (eg. SELinux) is disabled at runtime. Adding an empty LSM rule causes ima_match_rules() to always succeed, ignoring any remaining rules. default IMA TCB policy: # PROC_SUPER_MAGIC dont_measure fsmagic=0x9fa0 # SYSFS_MAGIC dont_measure fsmagic=0x62656572 # DEBUGFS_MAGIC dont_measure fsmagic=0x64626720 # TMPFS_MAGIC dont_measure fsmagic=0x01021994 # SECURITYFS_MAGIC dont_measure fsmagic=0x73636673 < LSM specific rule > dont_measure obj_type=var_log_t measure func=BPRM_CHECK measure func=FILE_MMAP mask=MAY_EXEC measure func=FILE_CHECK mask=MAY_READ uid=0 Thus without the patch, with the boot parameters 'tcb selinux=0', adding the above 'dont_measure obj_type=var_log_t' rule to the default IMA TCB measurement policy, would result in nothing being measured. The patch prevents the default TCB policy from being replaced. Upstream commit: <a href="http://git.kernel.org/linus/867c20265459d30a01b021a9c1e81fb4c5832aa9">http://git.kernel.org/linus/867c20265459d30a01b021a9c1e81fb4c5832aa9</a> Introduced in 2.6.30-rc1 4af4662f
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=2.6.30-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-667912?
The severity of REDHAT-BUG-667912 is considered important due to potential security implications when LSM is disabled.
How does REDHAT-BUG-667912 affect system security?
REDHAT-BUG-667912 can lead to the improper implementation of security rules, potentially allowing unauthorized access.
How can I mitigate REDHAT-BUG-667912?
To mitigate REDHAT-BUG-667912, ensure that LSM is enabled during runtime to properly enforce security policies.
What systems are affected by REDHAT-BUG-667912?
REDHAT-BUG-667912 affects systems running Linux Kernel versions 2.6.30-rc1 and later, with LSM disabled.
Is there a patch available for REDHAT-BUG-667912?
Yes, users should check for updates or patches provided by Red Hat to address REDHAT-BUG-667912.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0006
- agent/source
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux kernel
- canonical/linux kernel