From patchwork Tue Apr 17 22:56:00 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 10347023 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EFB9F60365 for ; Tue, 17 Apr 2018 22:56:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E9C4C2785D for ; Tue, 17 Apr 2018 22:56:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DBB5F27F8C; Tue, 17 Apr 2018 22:56:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 816C82785D for ; Tue, 17 Apr 2018 22:56:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751980AbeDQW4L (ORCPT ); Tue, 17 Apr 2018 18:56:11 -0400 Received: from mail-yw0-f201.google.com ([209.85.161.201]:48062 "EHLO mail-yw0-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751879AbeDQW4L (ORCPT ); Tue, 17 Apr 2018 18:56:11 -0400 Received: by mail-yw0-f201.google.com with SMTP id i204so13455907ywb.14 for ; Tue, 17 Apr 2018 15:56:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:message-id:subject:from:to:cc; bh=bk+YCevJKswyFP9uk4a9Fgs9ZIIRK1nLAqfDmvDfzUI=; b=ncqb1xuSacy9NsniKdqkxWiV+lx+Lv3aIx8kN1WCsZ4CAbNuzAT8gWJ3Kshj08rhbv Cj7Ty6J9PD9QaMVZQFsGTXeo1nCRR6FRMQ1cArMF0jTsKVGCb7d6m93tN8Y9Uj0NOQed o6R4VeAqvxETEv52cOePF30GT2iHwRPxoZj6qK79K4DW3b9Z0PIHeTld2Ch2YnDfDFc9 30J3rereU7LUvU2XqIOnPwDE7rE1ZONkixwE4rHXyGO1iDYEpChkuqhpRxxoRLQdIaw+ Obwm+z6jIUO+7pdwzvYKc1vNOktD8knmKFLmGpl619LjnhykplHd6fwJAAm4eR/wOQMc 0piw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:message-id:subject:from:to:cc; bh=bk+YCevJKswyFP9uk4a9Fgs9ZIIRK1nLAqfDmvDfzUI=; b=YfkDnT9WdRE+0KxHWUWD6YAg9RkWV7ru9dK7nqrcT910ApdXdBKQpURA4jLnpC7uuu kQJ7yIElsp6ooltFKmn3CcUCgPnCLf9J7t8B6GC9QH2NAAAIAbH1eRC1zYMVg76Z6HUc +Ixl1hikTUBzxFYEZ/70zjeja86flkGQOU25Anbx7h3xW7T0qvauaCRcguO4Afofyg4b QqpD2e3W4AlWyUlyr/jQ60cMvDAQsQI4BjVGKIKFCI7nKIM5Sb5VlKXw5Tr7IxN1skXK zZd61e2IlbBa1vCDHyi2dlesvx8jTQiEInWuw3aPg7pur7L90yccLZzzxHsnKfB2Vxid Z3qw== X-Gm-Message-State: ALQs6tBEqXwLK7y5AaNGceqdVE9JkP/Wdanzujb1fUXaGFctKQNjh1WM NL/rUnCpvHtQoU3b35KLolvEEyzdfN/njJ2DW3AEXFXOABFGNDaA7hcTWohNwIEnCS1g9twVkVy 5A5u93Yhd4eoOedFU70LMExCFSEHFga7sdpk= X-Google-Smtp-Source: AIpwx495eTkqXvYdu6motjZOaOcYRTanuqIn7gtOFjtA10rJcKQhU9cmi+IK9JxqBDxawDazpbFfGazN86Xbd4cd05uTkA== MIME-Version: 1.0 X-Received: by 10.129.155.133 with SMTP id s127mr1177048ywg.53.1524005770502; Tue, 17 Apr 2018 15:56:10 -0700 (PDT) Date: Tue, 17 Apr 2018 15:56:00 -0700 Message-Id: <20180417225601.6965-1-mjg59@google.com> X-Mailer: git-send-email 2.17.0.484.g0c8726318c-goog Subject: [USER] [PATCH 1/2] Remove hardcoding of SHA1 in EVM signatures From: Matthew Garrett To: linux-integrity@vger.kernel.org Cc: zohar@linux.vnet.ibm.com, Matthew Garrett Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP EVM signatures are always being generated with SHA1 even if the -a argument has been provided to evmctl. Fix this so the provided hash algorithm is used instead. Signed-off-by: Matthew Garrett --- src/evmctl.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 2ffee78..43d261f 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -313,6 +313,7 @@ err: static int calc_evm_hash(const char *file, unsigned char *hash) { + const EVP_MD *md; struct stat st; int err; uint32_t generation = 0; @@ -374,7 +375,13 @@ static int calc_evm_hash(const char *file, unsigned char *hash) return -1; } - err = EVP_DigestInit(pctx, EVP_sha1()); + md = EVP_get_digestbyname(params.hash_algo); + if (!md) { + log_err("EVP_get_digestbyname() failed\n"); + return 1; + } + + err = EVP_DigestInit(pctx, md); if (!err) { log_err("EVP_DigestInit() failed\n"); return 1; @@ -498,7 +505,7 @@ static int sign_evm(const char *file, const char *key) if (len <= 1) return len; - len = sign_hash("sha1", hash, len, key, NULL, sig + 1); + len = sign_hash(params.hash_algo, hash, len, key, NULL, sig + 1); if (len <= 1) return len; @@ -967,6 +974,7 @@ static int cmd_setxattr_ima(struct command *cmd) static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash) { + const EVP_MD *md; struct stat st; int err = -1; uint32_t generation = 0; @@ -1033,7 +1041,13 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h goto out; } - err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL); + md = EVP_get_digestbyname(params.hash_algo); + if (!md) { + log_err("EVP_get_digestbyname() failed\n"); + goto out; + } + + err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL); if (err) { log_err("HMAC_Init() failed\n"); goto out;