| Message ID | 20240104190558.3674008-6-zohar@linux.ibm.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Address non concurrency-safe libimaevm global variables | expand |
On 1/4/24 14:05, Mimi Zohar wrote: > Update the static verify_ima() function definition to include > "public_keys". > > Replace calling init_public_keys() with the imaevm_init_public_keys() > version. Similarly replace ima_verify_signature() with the > ima_verify_signature2() version. > > Free the local public keys list. > > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> > --- > src/evmctl.c | 29 +++++++++++++++++++---------- > 1 file changed, 19 insertions(+), 10 deletions(-) > > diff --git a/src/evmctl.c b/src/evmctl.c > index 2710a27cb305..5d84a41a0762 100644 > --- a/src/evmctl.c > +++ b/src/evmctl.c > @@ -972,7 +972,7 @@ static int cmd_verify_evm(struct command *cmd) > return err; > } > > -static int verify_ima(const char *file) > +static int verify_ima(struct public_key_entry *public_keys, const char *file) > { > unsigned char sig[MAX_SIGNATURE_SIZE]; > int len; > @@ -999,34 +999,43 @@ static int verify_ima(const char *file) > } > } > > - return ima_verify_signature(file, sig, len, NULL, 0); > + return ima_verify_signature2(public_keys, file, sig, len, NULL, 0); > } > > static int cmd_verify_ima(struct command *cmd) > { > + struct public_key_entry *public_keys = NULL; > char *file = g_argv[optind++]; > int err, fails = 0; > > - if (imaevm_params.x509) { > - if (imaevm_params.keyfile) /* Support multiple public keys */ > - init_public_keys(imaevm_params.keyfile); > - else /* assume read pubkey from x509 cert */ > - init_public_keys("/etc/keys/x509_evm.der"); > - } > - > if (!file) { > log_err("Parameters missing\n"); > print_usage(cmd); > return -1; > } > > + if (imaevm_params.x509) { > + if (imaevm_params.keyfile) /* Support multiple public keys */ > + err = imaevm_init_public_keys(imaevm_params.keyfile, > + &public_keys); > + else /* assume read pubkey from x509 cert */ > + err = imaevm_init_public_keys("/etc/keys/x509_evm.der", > + &public_keys); > + if (err < 0) { > + log_info("Failed loading public keys"); > + return err; > + } > + } > + > do { > - err = verify_ima(file); > + err = verify_ima(public_keys, file); > if (err) > fails++; > if (!err && imaevm_params.verbose >= LOG_INFO) > log_info("%s: verification is OK\n", file); > } while ((file = g_argv[optind++])); > + > + imaevm_free_public_keys(public_keys); > return fails > 0; > } >
diff --git a/src/evmctl.c b/src/evmctl.c index 2710a27cb305..5d84a41a0762 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -972,7 +972,7 @@ static int cmd_verify_evm(struct command *cmd) return err; } -static int verify_ima(const char *file) +static int verify_ima(struct public_key_entry *public_keys, const char *file) { unsigned char sig[MAX_SIGNATURE_SIZE]; int len; @@ -999,34 +999,43 @@ static int verify_ima(const char *file) } } - return ima_verify_signature(file, sig, len, NULL, 0); + return ima_verify_signature2(public_keys, file, sig, len, NULL, 0); } static int cmd_verify_ima(struct command *cmd) { + struct public_key_entry *public_keys = NULL; char *file = g_argv[optind++]; int err, fails = 0; - if (imaevm_params.x509) { - if (imaevm_params.keyfile) /* Support multiple public keys */ - init_public_keys(imaevm_params.keyfile); - else /* assume read pubkey from x509 cert */ - init_public_keys("/etc/keys/x509_evm.der"); - } - if (!file) { log_err("Parameters missing\n"); print_usage(cmd); return -1; } + if (imaevm_params.x509) { + if (imaevm_params.keyfile) /* Support multiple public keys */ + err = imaevm_init_public_keys(imaevm_params.keyfile, + &public_keys); + else /* assume read pubkey from x509 cert */ + err = imaevm_init_public_keys("/etc/keys/x509_evm.der", + &public_keys); + if (err < 0) { + log_info("Failed loading public keys"); + return err; + } + } + do { - err = verify_ima(file); + err = verify_ima(public_keys, file); if (err) fails++; if (!err && imaevm_params.verbose >= LOG_INFO) log_info("%s: verification is OK\n", file); } while ((file = g_argv[optind++])); + + imaevm_free_public_keys(public_keys); return fails > 0; }
Update the static verify_ima() function definition to include "public_keys". Replace calling init_public_keys() with the imaevm_init_public_keys() version. Similarly replace ima_verify_signature() with the ima_verify_signature2() version. Free the local public keys list. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- src/evmctl.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)