[v5,ima-evm-utils,2/2] make SHA-256 the default hash algorithm

Commit Message

Bruno Meneguele Sept. 2, 2021, 7:24 p.m. UTC

The SHA-1 algorithm is considered a weak hash algorithm and there has been
some movement within certain distros to drop its support completely or at
least drop it from the default behavior. ima-evm-utils uses it as the
default algorithm in case the user doesn't explicitly ask for another
through the --with-default-hash configuration time option or --hashalgo/-a
runtime option. With that, make SHA-256 the default hash algorithm instead.

Signed-off-by: Bruno Meneguele <[e-mail]>
---
 m4/default-hash-algo.m4 | 2 +-
 src/imaevm.h            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Patch

diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4
index 9a8b2ff34cfc..70d00b007fa1 100644
--- a/m4/default-hash-algo.m4
+++ b/m4/default-hash-algo.m4
@@ -9,7 +9,7 @@  AC_DEFUN([AX_DEFAULT_HASH_ALGO], [
 	AC_ARG_WITH([default_hash],
 		AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]),
 		[HASH_ALGO=$withval],
-		[HASH_ALGO=sha1])
+		[HASH_ALGO=sha256])
 
 	AC_CHECK_HEADER([$HASH_INFO_HEADER],
 		[HAVE_HASH_INFO_HEADER=yes],
diff --git a/src/imaevm.h b/src/imaevm.h
index cc3dfd2e9163..ba7b23907669 100644
--- a/src/imaevm.h
+++ b/src/imaevm.h
@@ -75,7 +75,7 @@ 
 #define log_errno(fmt, args...)		do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno)
 
 #ifndef DEFAULT_HASH_ALGO
-#define DEFAULT_HASH_ALGO "sha1"
+#define DEFAULT_HASH_ALGO "sha256"
 #endif
 
 #define	DATA_SIZE	4096