[ima-evm-utils,v3,00/13] Address non concurrency-safe libimaevm global variables

Message

Mimi Zohar Jan. 4, 2024, 7:05 p.m. UTC

The libimaevm global variables are not concurrency-safe.  Instead of
relying on global variables, define new functions with these variables
as parameters, update static functions definitions with these variables,
and deprecate existing functions.  The change is limited to public keys,
hash algorithm, and key password.

To avoid library incompatability, make the existing functions wrappers
for the new function versions and deprecate existing functions.

The deprecated function warnings can be disabled by specifying
'-Wno-deprecated-declarations'.  Allow suppressing just the libimevm
warnings by enabling IMAEVM_SUPPRESS_DEPRECATED.

e.g. configure CFLAGS="-DIMAEVM_SUPPRESS_DEPRECATED"

Changelog v3:
Addressed Stefan Berger's comments:
- Forward declare "struct public_key_entry" in order to replace
  "void *public_key" usage.
- Move the "__attribute__((deprecated))" from the functions to the function
  definitions.
- Allow suppressing just the libimevm deprecated warngings by defining
  and enabling "-DIMAEVM_SUPPRESS_DEPRECATED".
- Add "Reviewed-by" tags.

Changelog v2:
Addressed Stefan Berger's comments:
- Prefix the new library functions to avoid namespace pollution.
- Define internal library function 'public_keys' as struct
  public_key_entry, not void.
- Prefix new static global variables with 'g_'.
- Annotate deprecated functions with "__attribute__(deprecated)".
- init_public_keys() function was defined as void. The new
  imaevm_init_public_keys() function is defined as an int. Check the
  return value.
- Update sign_{ima,evm} function definitions to include the hash
  algorithm as a paramater.
- Added Stefan's "Reviewed-by" tag.

Mimi Zohar (13):
  Rename "public_keys" to "g_public_keys"
  Free public keys list
  Update library function definitions to include a "public_keys"
    parameter
  Update imaevm_verify_hash() definition to include "hash_algo"
    parameter
  Update cmd_verify_ima() to define and use a local list of public keys
  Update cmd_verify_evm to define and use a local list of public keys
  Update ima_measurements to define and use a local list of public keys
  Define library ima_calc_hash2() function with a hash algorithm
    parameter
  Use a local hash algorithm variable when verifying file signatures
  Update EVM signature verification to use a local hash algorithm
    variable
  Use a file specific hash algorithm variable for signing files
  Update sign_hash_v*() definition to include the key password
  Define and use a file specific "keypass" variable

 src/evmctl.c    | 136 +++++++++++++++++++++++++++-----------------
 src/imaevm.h    |  29 ++++++++--
 src/libimaevm.c | 148 +++++++++++++++++++++++++++++++++++-------------
 3 files changed, 218 insertions(+), 95 deletions(-)