@@ -1625,7 +1625,7 @@ static int lookup_template_name_entry(char *template_name)
return 0;
}
-void ima_ng_show(struct template_entry *entry)
+static void ima_ng_show(void *public_keys, struct template_entry *entry)
{
uint8_t *fieldp = entry->template;
uint32_t field_len;
@@ -1751,10 +1751,12 @@ void ima_ng_show(struct template_entry *entry)
* the measurement list or calculate the hash.
*/
if (verify_list_sig)
- err = ima_verify_signature(path, sig, sig_len,
- digest, digest_len);
+ err = ima_verify_signature2(public_keys, path,
+ sig, sig_len,
+ digest, digest_len);
else
- err = ima_verify_signature(path, sig, sig_len, NULL, 0);
+ err = ima_verify_signature2(public_keys, path,
+ sig, sig_len, NULL, 0);
if (!err && imaevm_params.verbose > LOG_INFO)
log_info("%s: verification is OK\n", path);
@@ -2234,6 +2236,7 @@ static int ima_measurement(const char *file)
int first_record = 1;
unsigned int pseudo_padded_banks_mask, pseudo_banks_mask;
unsigned long entry_num = 0;
+ void *public_keys = NULL;
int c;
struct template_entry entry = { .template = NULL };
@@ -2263,10 +2266,16 @@ static int ima_measurement(const char *file)
}
if (imaevm_params.keyfile) /* Support multiple public keys */
- init_public_keys(imaevm_params.keyfile);
+ err = imaevm_init_public_keys(imaevm_params.keyfile,
+ &public_keys);
else /* assume read pubkey from x509 cert */
- init_public_keys("/etc/keys/x509_evm.der");
- if (errno)
+ err = imaevm_init_public_keys("/etc/keys/x509_evm.der",
+ &public_keys);
+ /*
+ * Without public keys, cannot validate signatures, but can
+ * still calculate and verify the measurement list against TPM PCRs.
+ */
+ if (errno || err < 0)
log_errno_reset(LOG_DEBUG,
"Failure in initializing public keys");
@@ -2416,7 +2425,7 @@ static int ima_measurement(const char *file)
if (is_ima_template)
ima_show(&entry);
else
- ima_ng_show(&entry);
+ ima_ng_show(public_keys, &entry);
if (!tpmbanks)
continue;
@@ -2475,6 +2484,7 @@ out_free:
free(pseudo_banks);
free(pseudo_padded_banks);
free(entry.template);
+ imaevm_free_public_keys(public_keys);
return err;
}
Replace calling init_public_keys() with the imaevm_init_public_keys() version. Similarly replace ima_verify_signature() with the ima_verify_signature2() version. Update the static ima_ng_show() function definition to include a "public_keys" parameter. Free the local public keys list. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- src/evmctl.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)