RPMFI_FLAGS_ONLY_FILENAMES doesn't prevent file signatures #2425
Comments
pmatilai
added a commit
to pmatilai/rpm
that referenced
this issue
Apr 27, 2023
Our compound masks for disabling file info bits per operation never got updated to include the two separate file signature types. This was discovered by rpm-ostree on older rpm version crashing on an IMA signature despite passing in RPMFI_FLAGS_ONLY_FILENAMES. Add the file signatures to the most obvious masks, and add a simple test as well. Fixes: rpm-software-management#2425
pmatilai
added a commit
that referenced
this issue
Apr 28, 2023
Our compound masks for disabling file info bits per operation never got updated to include the two separate file signature types. This was discovered by rpm-ostree on older rpm version crashing on an IMA signature despite passing in RPMFI_FLAGS_ONLY_FILENAMES. Add the file signatures to the most obvious masks, and add a simple test as well. Fixes: #2425
dmnks
pushed a commit
to dmnks/rpm
that referenced
this issue
Aug 1, 2023
Our compound masks for disabling file info bits per operation never got updated to include the two separate file signature types. This was discovered by rpm-ostree on older rpm version crashing on an IMA signature despite passing in RPMFI_FLAGS_ONLY_FILENAMES. Add the file signatures to the most obvious masks, and add a simple test as well. Fixes: rpm-software-management#2425 (cherry picked from commit 14aac7d)
dmnks
pushed a commit
that referenced
this issue
Aug 1, 2023
Our compound masks for disabling file info bits per operation never got updated to include the two separate file signature types. This was discovered by rpm-ostree on older rpm version crashing on an IMA signature despite passing in RPMFI_FLAGS_ONLY_FILENAMES. Add the file signatures to the most obvious masks, and add a simple test as well. Fixes: #2425 (cherry picked from commit 14aac7d)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
RPMFI_NOFILESIGNATURES and RPMFI_NOVERITYSIGNATURES should be included in the RPMFI_FLAGS_ONLY_FILENAMES mask but are not, so eg
rpmfiNew (ts, h, RPMTAG_BASENAMES, RPMFI_FLAGS_ONLY_FILENAMES)ends up loading both IMA and FSVERITY signatures into the file iterator when it should not.The signatures aren't relevant for bunch of other operations too, so review the other masks too, at least RPMFI_FLAGS_FILETRIGGER should include both signature disablers and RPMFI_FLAGS_ONLY_FILENAMES would inherit it from there.
The text was updated successfully, but these errors were encountered: