From patchwork Fri Sep 10 18:47:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruno Meneguele X-Patchwork-Id: 12485817 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9958CC433EF for ; Fri, 10 Sep 2021 18:47:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 75AD161251 for ; Fri, 10 Sep 2021 18:47:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229476AbhIJSsa (ORCPT ); Fri, 10 Sep 2021 14:48:30 -0400 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:22889 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230260AbhIJSs3 (ORCPT ); Fri, 10 Sep 2021 14:48:29 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1631299638; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=DdlexkiBMfQvRGRGyKca4TqG+y1BP6buNKJeKC46s8g=; b=GVGGSoQ9P2vg9+iAmGd3/cjfCg7amRNbd7DpOGXKaQ5LPTH1I/+mQh2kGHTG5wgWKwwOoB sQm6ZSFiI5JRP5960DTA5XRhYF9emlBY2p7P6RVdoy9kMObpLypB3b3i17v4yh2/5EFrCm 1OsSyWR41c0O1ks3MHyl1FU3qPovkf0= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-289-QWCV-mMmM-eBpShfhw1KAA-1; Fri, 10 Sep 2021 14:47:14 -0400 X-MC-Unique: QWCV-mMmM-eBpShfhw1KAA-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 92DED801A92; Fri, 10 Sep 2021 18:47:13 +0000 (UTC) Received: from localhost (unknown [10.22.33.86]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4E32119C79; Fri, 10 Sep 2021 18:47:10 +0000 (UTC) From: Bruno Meneguele To: zohar@linux.ibm.com, Simon.THOBY@viveris.fr, kgold@linux.ibm.com Cc: linux-integrity@vger.kernel.org, Bruno Meneguele Subject: [PATCH v7 ima-evm-utils 1/2] set default hash algorithm in configuration time Date: Fri, 10 Sep 2021 15:47:00 -0300 Message-Id: <20210910184701.386163-2-bmeneg@redhat.com> In-Reply-To: <20210910184701.386163-1-bmeneg@redhat.com> References: <20210910184701.386163-1-bmeneg@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The default hash algorithm for evmctl is today hardcoded in the libimaevm.c file. To facilitate package maintainers across different distributions to set their own default hash algorithm this, patch adds the --with-default-hash= option to the configuration script. The chosen algorithm will then be checked by its available in the kernel, otherwise IMA won't be able to verify files hashed by the user. For that, the kernel header hash_info.h used as the source of supported hashes. In case the hash_info.h header is not present, the configuration script warns about it, but uses whatever the user specified in the option. Signed-off-by: Bruno Meneguele --- Changelog: v6 - make user input lower case regardless and rebase code README | 2 +- configure.ac | 2 ++ m4/default-hash-algo.m4 | 36 ++++++++++++++++++++++++++++++++++++ src/evmctl.c | 4 ++-- src/imaevm.h | 4 ++++ src/libimaevm.c | 2 +- 6 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 m4/default-hash-algo.m4 diff --git a/README b/README index 1cc027f6e0ba..15fc3bba24e0 100644 --- a/README +++ b/README @@ -41,7 +41,7 @@ COMMANDS OPTIONS ------- - -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512 + -a, --hashalgo sha1, sha224, sha256, sha384, sha512 -s, --imasig make IMA signature -d, --imahash make IMA hash -f, --sigfile store IMA signature in .sig file instead of xattr diff --git a/configure.ac b/configure.ac index a2d91b3db202..aff6fdfb26b4 100644 --- a/configure.ac +++ b/configure.ac @@ -62,6 +62,7 @@ else fi EVMCTL_MANPAGE_DOCBOOK_XSL +AX_DEFAULT_HASH_ALGO([$KERNEL_HEADERS]) # for gcov #CFLAGS="$CFLAGS -Wall -fprofile-arcs -ftest-coverage" @@ -81,6 +82,7 @@ echo echo echo "Configuration:" echo " debug: $pkg_cv_enable_debug" +echo " default-hash: $HASH_ALGO" echo " openssl-conf: $enable_openssl_conf" echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4 new file mode 100644 index 000000000000..b6164a57d11f --- /dev/null +++ b/m4/default-hash-algo.m4 @@ -0,0 +1,36 @@ +dnl Copyright (c) 2021 Bruno Meneguele +dnl Check hash algorithm availability in the kernel +dnl +dnl $1 - $KERNEL_HEADERS + +AC_DEFUN([AX_DEFAULT_HASH_ALGO], [ + HASH_INFO_HEADER="$1/include/uapi/linux/hash_info.h" + + AC_ARG_WITH([default_hash], + AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]), + [HASH_ALGO=$withval], + [HASH_ALGO=sha1]) + + AC_PROG_SED() + HASH_ALGO="$(echo $HASH_ALGO | $SED 's/\(.*\)/\L\1\E/')" + + AC_CHECK_HEADER([$HASH_INFO_HEADER], + [HAVE_HASH_INFO_HEADER=yes], + [AC_MSG_WARN([$HASH_INFO_HEADER not found.])]) + + if test "x$HAVE_HASH_INFO_HEADER" = "x"; then + AC_MSG_RESULT([using $HASH_ALGO algorithm as default hash algorith]) + AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm]) + else + AC_PROG_GREP() + $SED -n 's/HASH_ALGO_\(.*\),/\L\1\E/p' $HASH_INFO_HEADER | $GREP -w $HASH_ALGO > /dev/null + have_hash=$? + + if test $have_hash -ne 0; then + AC_MSG_ERROR([$HASH_ALGO algorithm specified, but not provided by the kernel], 1) + else + AC_MSG_NOTICE([using $HASH_ALGO as default hash algorithm]) + AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm]) + fi + fi +]) diff --git a/src/evmctl.c b/src/evmctl.c index 9d661d7f24a4..4d66610409ed 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2500,7 +2500,7 @@ static void usage(void) printf( "\n" - " -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512, streebog256, streebog512\n" + " -a, --hashalgo sha1, sha224, sha256, sha384, sha512, streebog256, streebog512 (default: %s)\n" " -s, --imasig make IMA signature\n" " -d, --imahash make IMA hash\n" " -f, --sigfile store IMA signature in .sig file instead of xattr\n" @@ -2537,7 +2537,7 @@ static void usage(void) "\n" "Environment variables:\n\n" "EVMCTL_KEY_PASSWORD : Private key password to use; do not use --pass option\n" - "\n"); + "\n", DEFAULT_HASH_ALGO); } struct command cmds[] = { diff --git a/src/imaevm.h b/src/imaevm.h index 491f136c105f..cc3dfd2e9163 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -74,6 +74,10 @@ #define log_err(fmt, args...) do_log(LOG_ERR, fmt, ##args) #define log_errno(fmt, args...) do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno) +#ifndef DEFAULT_HASH_ALGO +#define DEFAULT_HASH_ALGO "sha1" +#endif + #define DATA_SIZE 4096 #define SHA1_HASH_LEN 20 diff --git a/src/libimaevm.c b/src/libimaevm.c index 8e9615796153..2555e58a873b 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -88,7 +88,7 @@ static const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = { struct libimaevm_params imaevm_params = { .verbose = LOG_INFO, .x509 = 1, - .hash_algo = "sha1", + .hash_algo = DEFAULT_HASH_ALGO, }; static void __attribute__ ((constructor)) libinit(void); From patchwork Fri Sep 10 18:47:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bruno Meneguele X-Patchwork-Id: 12485819 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 850ABC433F5 for ; Fri, 10 Sep 2021 18:47:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 64B066124E for ; Fri, 10 Sep 2021 18:47:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230260AbhIJSsf (ORCPT ); Fri, 10 Sep 2021 14:48:35 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]:42795 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231932AbhIJSse (ORCPT ); Fri, 10 Sep 2021 14:48:34 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1631299642; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=V52c2PH38OndfG+MLqkkMGZ4Hcc5ilgezUhK4fpL5CI=; b=Ho+c3NmSE+x85WM9AGlWUrPYaQeav29tDeg6aOZQbzujP2anCIocfP9AslzSjESKq5tPI0 bVboaKKCNTYQ4lsgonrhUBuYufpGLh6y4rHo+5oGfLah3lns7uuHsfEqDnQQWn+8jD4P0I 2EgBwWjiVXBUerw82cwYv2Ri28X78J4= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-114-DR33u-E4Prele3jcWXT0rQ-1; Fri, 10 Sep 2021 14:47:19 -0400 X-MC-Unique: DR33u-E4Prele3jcWXT0rQ-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id A4EAE84A5E5; Fri, 10 Sep 2021 18:47:18 +0000 (UTC) Received: from localhost (unknown [10.22.33.86]) by smtp.corp.redhat.com (Postfix) with ESMTP id AC31C5D9C6; Fri, 10 Sep 2021 18:47:14 +0000 (UTC) From: Bruno Meneguele To: zohar@linux.ibm.com, Simon.THOBY@viveris.fr, kgold@linux.ibm.com Cc: linux-integrity@vger.kernel.org, Bruno Meneguele Subject: [PATCH v7 ima-evm-utils 2/2] make SHA-256 the default hash algorithm Date: Fri, 10 Sep 2021 15:47:01 -0300 Message-Id: <20210910184701.386163-3-bmeneg@redhat.com> In-Reply-To: <20210910184701.386163-1-bmeneg@redhat.com> References: <20210910184701.386163-1-bmeneg@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The SHA-1 algorithm is considered a weak hash algorithm and there has been some movement within certain distros to drop its support completely or at least drop it from the default behavior. ima-evm-utils uses it as the default algorithm in case the user doesn't explicitly ask for another through the --with-default-hash configuration time option or --hashalgo/-a runtime option. With that, make SHA-256 the default hash algorithm instead. Signed-off-by: Bruno Meneguele --- m4/default-hash-algo.m4 | 2 +- src/imaevm.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4 index b6164a57d11f..92390fd43b6e 100644 --- a/m4/default-hash-algo.m4 +++ b/m4/default-hash-algo.m4 @@ -9,7 +9,7 @@ AC_DEFUN([AX_DEFAULT_HASH_ALGO], [ AC_ARG_WITH([default_hash], AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]), [HASH_ALGO=$withval], - [HASH_ALGO=sha1]) + [HASH_ALGO=sha256]) AC_PROG_SED() HASH_ALGO="$(echo $HASH_ALGO | $SED 's/\(.*\)/\L\1\E/')" diff --git a/src/imaevm.h b/src/imaevm.h index cc3dfd2e9163..ba7b23907669 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -75,7 +75,7 @@ #define log_errno(fmt, args...) do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno) #ifndef DEFAULT_HASH_ALGO -#define DEFAULT_HASH_ALGO "sha1" +#define DEFAULT_HASH_ALGO "sha256" #endif #define DATA_SIZE 4096