From patchwork Fri Sep 2 16:28:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964400 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D04B5C001B5 for ; Fri, 2 Sep 2022 16:29:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236060AbiIBQ3F (ORCPT ); Fri, 2 Sep 2022 12:29:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44012 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236397AbiIBQ3E (ORCPT ); Fri, 2 Sep 2022 12:29:04 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1923DABA1 for ; Fri, 2 Sep 2022 09:28:58 -0700 (PDT) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282GS0Ee009197; Fri, 2 Sep 2022 16:28:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=jembsahyVt8BStfk6GqIR48niDiqjpxX6bKc7iQ7zrs=; b=r69MKBPsF8lgMKWJ8DGdLifNbarJUctvHDRb+n4KSqBV8llwQSoDaKxmHmiqc8ZwCRcC t/X0+S4G13QLx/NCYwvDMFBHONg53B76RC0kKn9H+Wv1NLrBzKm2scn54TcVjbm+QGxq Lzf+zgdIXyFip3OGRgvhUXizQTj0IFs/tX4zbR5sTz9C/v2HyUjXouMWciy5mfCaDk4r N9yEqL7d6ubgNqqMhxf5UYwy/mDuR5aajFfYD2zKVb+8BVAMAZJIvlET5cmkYznAQ1d9 DdUSZCSX8+ZaYJdasGYPIPE2OgNuGmROvfNwoCRPEqFWg2UbIH3NNLlMtUlSyJih7/Z7 Pw== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbnck80ua-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:53 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G96YN017952; Fri, 2 Sep 2022 16:28:51 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma06fra.de.ibm.com with ESMTP id 3j7ahhx5hn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:51 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GSmMc15925630 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:28:48 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0B9765204E; Fri, 2 Sep 2022 16:28:48 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id 8ADA652051; Fri, 2 Sep 2022 16:28:46 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 01/11] travis: use the distro OpenSSL version on jammy Date: Fri, 2 Sep 2022 12:28:26 -0400 Message-Id: <20220902162836.554839-2-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 7AiIxYIbul0Nxhuf8hRcO1hETyaSNHiB X-Proofpoint-ORIG-GUID: 7AiIxYIbul0Nxhuf8hRcO1hETyaSNHiB X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_04,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 mlxscore=0 impostorscore=0 mlxlogscore=991 spamscore=0 suspectscore=0 lowpriorityscore=0 phishscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020078 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Use the distro OpenSSL version on jammy, which is newer than OpenSSL 3-beta. Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 5741116e418a..b18c871be200 100644 --- a/.travis.yml +++ b/.travis.yml @@ -40,7 +40,7 @@ matrix: compiler: gcc - os: linux - env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=ubuntu:jammy TSS=ibmtss compiler: gcc - os: linux From patchwork Fri Sep 2 16:28:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964401 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FFACECAAD5 for ; Fri, 2 Sep 2022 16:29:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235698AbiIBQ3G (ORCPT ); Fri, 2 Sep 2022 12:29:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44048 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235657AbiIBQ3F (ORCPT ); Fri, 2 Sep 2022 12:29:05 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9BB13DABBC for ; Fri, 2 Sep 2022 09:28:59 -0700 (PDT) Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282G12tF031022; Fri, 2 Sep 2022 16:28:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=TQcyyTF48z5cUYqJ4+Py8BCPqtYiPwHcGac9ZWrdcw4=; b=X9TRnDIJ/+2IKwFj17S/keVmgxaGxZrWNOIDSxQNCZGfIUIkmi5O9edSkzClPsZcMbD8 /DceMoJkeau3TH3JHMcCgIX73dwhiIyzsj41WGHDAIwCWytTHLz4ttaY0uIP6dffio/K VeD+SJDpx0VODcgTnjVGe4xWAg7G0Piq1Ek/EdTo96g/bcMUM8+yGMN8gCLx2enCgK2G uIO/VHAMsEya/J5bDzUlZqKGf7ZS2UuhemCEKpmaZ4SdGPw/RQ0Ucwv2669hGXwz8C5C DEzwvxWUZ9M4aQSI/g4WQGPfIyVwxPuJGOJd+/wphrvTWAXLKX3kVn+zD9r4eY0vMv4c bA== Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbmyx0xs2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:55 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G8YfN019266; Fri, 2 Sep 2022 16:28:52 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma05fra.de.ibm.com with ESMTP id 3j7aw8x5k1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:52 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GSnT635258720 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:28:49 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9BD7152050; Fri, 2 Sep 2022 16:28:49 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id 6495B5204F; Fri, 2 Sep 2022 16:28:48 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 02/11] travis: update dist=focal Date: Fri, 2 Sep 2022 12:28:27 -0400 Message-Id: <20220902162836.554839-3-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: R5ro3mNtI8pvlSfCSXK69-SdL0balD8v X-Proofpoint-ORIG-GUID: R5ro3mNtI8pvlSfCSXK69-SdL0balD8v X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_03,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 mlxlogscore=976 mlxscore=0 bulkscore=0 phishscore=0 malwarescore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020075 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Although Github Actions is available on Github Enterprise Server 3.x single server edition, as well as the unpaid version, it is not available in Github Enterprise Server 3.x cluster edition[1]. Continue to support travis. [1] https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#github-packages Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index b18c871be200..cc76c0adb312 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,6 @@ # Copyright (c) 2017-2021 Petr Vorel -dist: bionic +dist: focal language: C services: - docker From patchwork Fri Sep 2 16:28:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964403 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5DBBC001B5 for ; Fri, 2 Sep 2022 16:29:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236397AbiIBQ3J (ORCPT ); Fri, 2 Sep 2022 12:29:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44092 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235657AbiIBQ3H (ORCPT ); Fri, 2 Sep 2022 12:29:07 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C81FDDB076 for ; Fri, 2 Sep 2022 09:28:59 -0700 (PDT) Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282FTBPH028281; Fri, 2 Sep 2022 16:28:56 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=97ey7KZn+OAZRHrHvGlZPORcciAJ4tYoTtU1J+6T4+0=; b=M/u91k++xXUpVj+zP8tUflfGf16/boB/hkDHaSj7SsooqGmIkVEbAJll8NMyDLoBgM+7 iWTuSIkozJuvvxDXj+oRNVFbGwTMmFvlC50fPF31S74UbWyxJEhMVAmb80eWEs13gm+B jvSeaCusLbpjo67jDc2nrbdhokSgeW9ETPhc3Ocn8hX6k9CSOm63EJ/P/ZIKGkWwFO4W aa/jkL6I5c+0hKWnapKt+k3hzP7+YLM7LYJyPD+N1eAoJw6V0mYUpRpcLuS913YHKezA tIrGni8/O4VRXBNlYlgv4faU+LKPwYw/WTcOtVcoW0/akgnzS2GTQ24d6vvMMlmM3HVi 4w== Received: from ppma04fra.de.ibm.com (6a.4a.5195.ip4.static.sl-reverse.com [149.81.74.106]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbmh01y4t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:55 +0000 Received: from pps.filterd (ppma04fra.de.ibm.com [127.0.0.1]) by ppma04fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G8YP4007865; Fri, 2 Sep 2022 16:28:54 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma04fra.de.ibm.com with ESMTP id 3j7aw9e6be-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:54 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GTDlw39125468 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:29:13 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 121BC5204E; Fri, 2 Sep 2022 16:28:51 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id E26FD52050; Fri, 2 Sep 2022 16:28:49 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 03/11] Update configure.ac to address a couple of obsolete warnings Date: Fri, 2 Sep 2022 12:28:28 -0400 Message-Id: <20220902162836.554839-4-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: GwWa16xKz-0DYmDNw2Dfs525C9yCSSKF X-Proofpoint-ORIG-GUID: GwWa16xKz-0DYmDNw2Dfs525C9yCSSKF X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_04,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 lowpriorityscore=0 suspectscore=0 priorityscore=1501 malwarescore=0 mlxlogscore=999 clxscore=1015 impostorscore=0 spamscore=0 bulkscore=0 adultscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020075 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Remove AC_PROG_LIBTOOL and AC_HEAD_STDC. Replace AC_HELP_STRING with AS_HELP_STRING. Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar --- acinclude.m4 | 2 +- configure.ac | 4 ---- m4/manpage-docbook-xsl.m4 | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/acinclude.m4 b/acinclude.m4 index dd430d4f0565..bb962f81a9c0 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -2,7 +2,7 @@ AC_DEFUN([PKG_ARG_ENABLE], [ AC_MSG_CHECKING(whether to enable $1) - AC_ARG_ENABLE([$1], AC_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), + AC_ARG_ENABLE([$1], AS_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), [pkg_cv_enable_$1=$enableval], [AC_CACHE_VAL([pkg_cv_enable_$1], [pkg_cv_enable_$1=$2])]) if test $pkg_cv_enable_$1 = yes; then diff --git a/configure.ac b/configure.ac index 1a0f093df562..9d3b23ff8def 100644 --- a/configure.ac +++ b/configure.ac @@ -15,16 +15,12 @@ AM_PROG_CC_C_O #AC_PROG_CXX #AC_PROG_CPP AC_PROG_INSTALL -AC_PROG_LIBTOOL #AC_PROG_LN_S LT_INIT # FIXME: Replace `main' with a function in `-lpthread': #AC_CHECK_LIB([pthread], [main]) -# Checks for header files. -AC_HEADER_STDC - PKG_CHECK_MODULES(LIBCRYPTO, [libcrypto >= 0.9.8 ]) AC_SUBST(KERNEL_HEADERS) AC_CHECK_HEADER(unistd.h) diff --git a/m4/manpage-docbook-xsl.m4 b/m4/manpage-docbook-xsl.m4 index 25c8ce54b068..f2ee912ed1be 100644 --- a/m4/manpage-docbook-xsl.m4 +++ b/m4/manpage-docbook-xsl.m4 @@ -7,7 +7,7 @@ AC_DEFUN([EVMCTL_MANPAGE_DOCBOOK_XSL], [ AC_PATH_PROGS(XMLCATALOG, xmlcatalog) AC_ARG_WITH([xml-catalog], - AC_HELP_STRING([--with-xml-catalog=CATALOG], + AS_HELP_STRING([--with-xml-catalog=CATALOG], [path to xml catalog to use]),, [with_xml_catalog=/etc/xml/catalog]) XML_CATALOG_FILE="$with_xml_catalog" From patchwork Fri Sep 2 16:28:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964405 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A160AC54EE9 for ; Fri, 2 Sep 2022 16:29:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236407AbiIBQ3N (ORCPT ); Fri, 2 Sep 2022 12:29:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44214 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236286AbiIBQ3L (ORCPT ); Fri, 2 Sep 2022 12:29:11 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C50B7DB7C7 for ; Fri, 2 Sep 2022 09:29:03 -0700 (PDT) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282GMKJD001704; Fri, 2 Sep 2022 16:28:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=HVT0c3wz0a2nsQgiNQt1inRFQqH4/ZMONy6Y2IVaxBY=; b=fNsX4q95LTDHxeo1Pjhg+T+J9r24CW4AWrXUNguQGngbQD/DaiAVEH7Q2ypfbdlfIIzm Tx/l+PI/ufDoHvCzzqMNoWcbnfJrX0YfNJ6MUpcAcXcFu14zVgwu2x/l22I89Qc698PQ +sTdx/UQLZuaW9v/Pnm/bjpewyWl8ajZQlSgcE08VqWoW6h8JNCrJmMnYEBv5Wty/ggA uf0GhqDHTBYhmk12pfexeaNkOqrPb3H6t0/Fqr4QzqH7ymdYehHVq1xOJE9nxrmGNcKH tNIvXAaTsUeBo8C/aO2Gb6//vonUnmvkTYuWRCwNkIOaNMwkWZoRAjQ4/q0IdsNngRg0 AA== Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbn9xg3vs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:57 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G8Zq0019273; Fri, 2 Sep 2022 16:28:56 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma05fra.de.ibm.com with ESMTP id 3j7aw8x5k6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:56 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GSrex32506142 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:28:53 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0F39D5204F; Fri, 2 Sep 2022 16:28:53 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id 8E8D752051; Fri, 2 Sep 2022 16:28:51 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 04/11] Deprecate IMA signature version 1 Date: Fri, 2 Sep 2022 12:28:29 -0400 Message-Id: <20220902162836.554839-5-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: i64bEq_Y_YPym7qvtufPpF1BEevy5Mqs X-Proofpoint-GUID: i64bEq_Y_YPym7qvtufPpF1BEevy5Mqs X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_04,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 lowpriorityscore=0 suspectscore=0 mlxlogscore=999 phishscore=0 spamscore=0 clxscore=1015 mlxscore=0 bulkscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020078 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The original IMA file signatures were based on a SHA1 hash. Kernel support for other hash algorithms was subsequently upstreamed. Deprecate "--rsa" support. Define "--enable-sigv1" option to configure signature v1 support. Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar Reviewed-by: Stefan Berger --- configure.ac | 6 ++++++ src/Makefile.am | 10 ++++++++++ src/evmctl.c | 20 ++++++++++++++++---- src/libimaevm.c | 22 +++++++++++++++++++--- tests/sign_verify.test | 18 ++++++++++++------ 5 files changed, 63 insertions(+), 13 deletions(-) diff --git a/configure.ac b/configure.ac index 9d3b23ff8def..dc666f2bb1fa 100644 --- a/configure.ac +++ b/configure.ac @@ -49,6 +49,11 @@ AC_ARG_ENABLE([openssl_conf], AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by evmctl.]) fi], [enable_openssl_conf=yes]) +AC_ARG_ENABLE(sigv1, + AS_HELP_STRING([--enable-sigv1], [Build ima-evm-utils with signature v1 support])) + AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) + AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -83,5 +88,6 @@ echo " openssl-conf: $enable_openssl_conf" echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" +echo " sigv1: $enable_sigv1" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 396496bb439d..90c7249020cf 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -7,6 +7,10 @@ libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) libimaevm_la_LDFLAGS = -version-info 3:0:0 libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS) +if CONFIG_SIGV1 +libimaevm_la_CFLAGS = -DCONFIG_SIGV1 +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -22,6 +26,12 @@ evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) evmctl_LDFLAGS = $(LDFLAGS_READLINE) evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la +# Enable IMA signature version 1 +if CONFIG_SIGV1 +evmctl_CFLAGS = -DCONFIG_SIGV1 +endif + + # USE_PCRTSS uses the Intel TSS if USE_PCRTSS evmctl_SOURCES += pcr_tss.c diff --git a/src/evmctl.c b/src/evmctl.c index 76e2561798fa..13b0105af8c4 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -987,7 +987,6 @@ static int cmd_verify_ima(struct command *cmd) init_public_keys("/etc/keys/x509_evm.der"); } - errno = 0; if (!file) { log_err("Parameters missing\n"); print_usage(cmd); @@ -1004,6 +1003,7 @@ static int cmd_verify_ima(struct command *cmd) return fails > 0; } +#if CONFIG_SIGV1 static int cmd_convert(struct command *cmd) { char *inkey; @@ -1034,6 +1034,7 @@ static int cmd_convert(struct command *cmd) RSA_free(key); return err; } +#endif static int cmd_import(struct command *cmd) { @@ -1088,6 +1089,7 @@ static int cmd_import(struct command *cmd) calc_keyid_v2((uint32_t *)keyid, name, pkey); EVP_PKEY_free(pkey); } else { +#if CONFIG_SIGV1 RSA *key = read_pub_key(inkey, imaevm_params.x509); if (!key) @@ -1095,6 +1097,10 @@ static int cmd_import(struct command *cmd) len = key2bin(key, pub); calc_keyid_v1(keyid, name, pub, len); RSA_free(key); +#else + log_info("Importing public RSA key is not supported\n"); + return 1; +#endif } log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); @@ -2598,7 +2604,9 @@ static void usage(void) " -d, --imahash make IMA hash\n" " -f, --sigfile store IMA signature in .sig file instead of xattr\n" " --xattr-user store xattrs in user namespace (for testing purposes)\n" - " --rsa use RSA key type and signing scheme v1\n" +#if CONFIG_SIGV1 + " --rsa use RSA key type and signing scheme v1 (deprecated)\n" +#endif " -k, --key path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n" " or a pkcs11 URI\n" " --keyid n overwrite signature keyid with a 32-bit value in hex (for signing)\n" @@ -2637,8 +2645,12 @@ static void usage(void) struct command cmds[] = { {"--version", NULL, 0, ""}, {"help", cmd_help, 0, ""}, - {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring.\n"}, - {"convert", cmd_convert, 0, "key", "convert public key into the keyring.\n"}, +#if CONFIG_SIGV1 + {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring. ([--rsa] deprecated)\n"}, + {"convert", cmd_convert, 0, "key", "convert public key into the keyring. (deprecated)\n"}, +#else + {"import", cmd_import, 0, "pubkey keyring", "Import public key into the keyring.\n"}, +#endif {"sign", cmd_sign_evm, 0, "[-r] [--imahash | --imasig ] [--key key] [--pass [password] file", "Sign file metadata.\n"}, {"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"}, {"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--key key] [--pass [password] file", "Make file content signature.\n"}, diff --git a/src/libimaevm.c b/src/libimaevm.c index e4b62b4989b2..4b37bf5bd62c 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -292,6 +292,7 @@ out: return pkey; } +#if CONFIG_SIGV1 RSA *read_pub_key(const char *keyfile, int x509) { EVP_PKEY *pkey; @@ -351,6 +352,7 @@ static int verify_hash_v1(const char *file, const unsigned char *hash, int size, return 0; } +#endif /* CONFIG_SIGV1 */ struct public_key_entry { struct public_key_entry *next; @@ -686,6 +688,7 @@ int verify_hash(const char *file, const unsigned char *hash, int size, { /* Get signature type from sig header */ if (sig[1] == DIGSIG_VERSION_1) { +#if CONFIG_SIGV1 const char *key = NULL; /* Read pubkey from RSA key */ @@ -695,6 +698,10 @@ int verify_hash(const char *file, const unsigned char *hash, int size, key = imaevm_params.keyfile; return verify_hash_v1(file, hash, size, sig + 1, siglen - 1, key); +#else + log_info("Signature version 1 deprecated."); + return -1; +#endif } else if (sig[1] == DIGSIG_VERSION_2) { return verify_hash_v2(file, hash, size, sig, siglen); } else if (sig[1] == DIGSIG_VERSION_3) { @@ -742,6 +749,7 @@ int ima_verify_signature(const char *file, unsigned char *sig, int siglen, return verify_hash(file, hash, hashlen, sig, siglen); } +#if CONFIG_SIGV1 /* * Create binary key representation suitable for kernel */ @@ -800,6 +808,7 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len if (imaevm_params.verbose > LOG_INFO) log_info("keyid-v1: %s\n", str); } +#endif /* CONFIG_SIGV1 */ /* * Calculate keyid of the public_key part of EVP_PKEY @@ -990,6 +999,7 @@ err_engine: return NULL; } +#if CONFIG_SIGV1 static RSA *read_priv_key(const char *keyfile, const char *keypass) { EVP_PKEY *pkey; @@ -1100,6 +1110,7 @@ out: RSA_free(key); return len; } +#endif /* CONFIG_SIGV1 */ /* * @sig is assumed to be of (MAX_SIGNATURE_SIZE - 1) size @@ -1214,9 +1225,14 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c if (keypass) imaevm_params.keypass = keypass; - return imaevm_params.x509 ? - sign_hash_v2(hashalgo, hash, size, keyfile, sig) : - sign_hash_v1(hashalgo, hash, size, keyfile, sig); + if (imaevm_params.x509) + return sign_hash_v2(hashalgo, hash, size, keyfile, sig); +#if CONFIG_SIGV1 + else + return sign_hash_v1(hashalgo, hash, size, keyfile, sig); +#endif + log_info("Signature version 1 deprecated."); + return -1; } static void libinit() diff --git a/tests/sign_verify.test b/tests/sign_verify.test index c56290aa4932..948892759424 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -17,6 +17,7 @@ cd "$(dirname "$0")" || exit 1 PATH=../src:$PATH +SIGV1=0 source ./functions.sh _require cmp evmctl getfattr openssl xxd @@ -368,13 +369,18 @@ try_different_sigs() { ## Test v1 signatures # Signature v1 only supports sha1 and sha256 so any other should fail -expect_fail \ - check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa +if [ $SIGV1 -eq 0 ]; then + __skip() { echo "IMA signature v1 tests are skipped: not supported"; return $SKIP; } + expect_pass __skip +else + expect_fail \ + check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa -sign_verify rsa1024 sha1 0x0301 --rsa -sign_verify rsa1024 sha256 0x0301 --rsa - try_different_keys - try_different_sigs + sign_verify rsa1024 sha1 0x0301 --rsa + sign_verify rsa1024 sha256 0x0301 --rsa + try_different_keys + try_different_sigs +fi ## Test v2 signatures with RSA PKCS#1 # List of allowed hashes much greater but not all are supported. From patchwork Fri Sep 2 16:28:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964404 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A4A1C6FA82 for ; Fri, 2 Sep 2022 16:29:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236111AbiIBQ3O (ORCPT ); Fri, 2 Sep 2022 12:29:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44258 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236404AbiIBQ3N (ORCPT ); Fri, 2 Sep 2022 12:29:13 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C5C5D9D61 for ; Fri, 2 Sep 2022 09:29:05 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282GGKZa005743; Fri, 2 Sep 2022 16:29:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=aC5jSjS3TermB7ZlLZSKn86p5sCBXEW6/NSGcDZgwAQ=; b=iRn2vIH1YsQWFOKHIglkJOXCutcV1XEej101KPKTjuXl6hyKMkxtLWyQNOAn0RLO4++K CyjGlzcYrPSi7hCRkUO8WAYMRpoIi2MDAlkb1V4MXQwuoEi5Ljg0H+wI2x+PV60dWy+X A+IPXfhd0mAZvRFRnezh5178w7xtA2r7Zvy1ch30hKqY9kc15GET+1pqZxfuiCmNhKZS JUlx4u91RIxFlCnAbqqaUgx4r/6sXMX2ThV0ZLEOlID9mlWibC7oisXaGaUgF0l/sowR 66VuZ5ETnkiqUdblxPe8tr+QkDJVQMyDGFPBGemhE7BuEyNAnWUGB0MlRZCvr4gSmhGa ow== Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbn730apj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:00 +0000 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G8Bl2019937; Fri, 2 Sep 2022 16:28:57 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma02fra.de.ibm.com with ESMTP id 3j7aw8x5d2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:57 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GSs1o38535504 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:28:54 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 94FA252050; Fri, 2 Sep 2022 16:28:54 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id 68CE85204E; Fri, 2 Sep 2022 16:28:53 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 05/11] Replace the low level SHA1 calls when calculating the TPM 1.2 PCRs Date: Fri, 2 Sep 2022 12:28:30 -0400 Message-Id: <20220902162836.554839-6-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 1990rCNoOOZmz0xfkRmCZntK5Y2N8osY X-Proofpoint-ORIG-GUID: 1990rCNoOOZmz0xfkRmCZntK5Y2N8osY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_04,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 phishscore=0 mlxscore=0 suspectscore=0 impostorscore=0 malwarescore=0 lowpriorityscore=0 bulkscore=0 clxscore=1015 mlxlogscore=999 priorityscore=1501 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020078 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 emits deprecated warnings for SHA1 functions. Use the EVP_ functions when walking the TPM 1.2 binary bios measurements to calculate the TPM 1.2 PCRs. Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar Reviewed-by: Stefan Berger --- src/evmctl.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 59 insertions(+), 6 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 13b0105af8c4..641504047a36 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2295,6 +2295,11 @@ static int cmd_ima_measurement(struct command *cmd) return ima_measurement(file); } +/* + * read_binary_bios_measurements - read the TPM 1.2 event log + * + * Returns 0 on success, 1 on failure. + */ #define MAX_EVENT_DATA_SIZE 200000 static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) { @@ -2307,12 +2312,19 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } header; unsigned char data[MAX_EVENT_DATA_SIZE]; } event; + EVP_MD_CTX *mdctx; + const EVP_MD *md; + unsigned int mdlen; + int evp_err = 1; /* success */ struct stat s; FILE *fp; - SHA_CTX c; int err = 0; int len; int i; +#if OPENSSL_VERSION_NUMBER < 0x10100000 + EVP_MD_CTX ctx; + mdctx = &ctx; +#endif if (stat(file, &s) == -1) { errno = 0; @@ -2334,6 +2346,23 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) if (imaevm_params.verbose > LOG_INFO) log_info("Reading the TPM 1.2 event log %s.\n", file); + md = EVP_get_digestbyname(bank->algo_name); + if (!md) { + log_errno("Unknown message digest %s\n", bank->algo_name); + errno = 0; + fclose(fp); + return 1; + } + +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + mdctx = EVP_MD_CTX_new(); + if (!mdctx) { + log_err("EVP_MD_CTX_new failed\n"); + fclose(fp); + return 1; + } +#endif + /* Extend the pseudo TPM PCRs with the event digest */ while (fread(&event, sizeof(event.header), 1, fp) == 1) { if (imaevm_params.verbose > LOG_INFO) { @@ -2342,13 +2371,30 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } if (event.header.pcr >= NUM_PCRS) { log_err("Invalid PCR %d.\n", event.header.pcr); - err = 1; break; } - SHA1_Init(&c); - SHA1_Update(&c, bank->pcr[event.header.pcr], 20); - SHA1_Update(&c, event.header.digest, 20); - SHA1_Final(bank->pcr[event.header.pcr], &c); + + evp_err = EVP_DigestInit(mdctx, md); + if (evp_err == 0) { + log_err("EVP_DigestInit() failed\n"); + break; + } + + evp_err = EVP_DigestUpdate(mdctx, bank->pcr[event.header.pcr], 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestUpdate(mdctx, event.header.digest, 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestFinal(mdctx, bank->pcr[event.header.pcr], &mdlen); + if (evp_err == 0) { + log_err("EVP_DigestFinal() failed\n"); + break; + } if (event.header.len > MAX_EVENT_DATA_SIZE) { log_err("Event data event too long.\n"); err = 1; @@ -2357,10 +2403,17 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) len = fread(event.data, event.header.len, 1, fp); if (len != 1) { log_errno("Failed reading event data (short read)\n"); + err = 1; break; } } + + if (evp_err == 0) /* EVP_ functions return 1 on success, 0 on failure */ + err = 1; fclose(fp); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(mdctx); +#endif if (imaevm_params.verbose <= LOG_INFO) return err; From patchwork Fri Sep 2 16:28:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964406 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAB7BECAAD5 for ; Fri, 2 Sep 2022 16:29:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236452AbiIBQ3R (ORCPT ); Fri, 2 Sep 2022 12:29:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236404AbiIBQ3P (ORCPT ); Fri, 2 Sep 2022 12:29:15 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 73FBBDD4D0 for ; Fri, 2 Sep 2022 09:29:07 -0700 (PDT) Received: from pps.filterd (m0187473.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282GScBM018508; Fri, 2 Sep 2022 16:29:01 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=bnyMIXn77kr6X3xlk6Gp6ySac8fbDDZEU9NVNu7cY8g=; b=KPhhaKKAT3kvl8CfEQEAq02vZZD/t9qp44MfJAu/o9sT1EnbdWloGDwIvlS90HzFZgh6 jAF0Zpt93x3w2rNxoIkCFY5hbAzWS90vtgMcecxJYIoTTKP9O8LF07aZFcOuST3hM67b fgbbDjYAldlNkdYf5Rqg6+YymKkEF7wnond7SxnYvoGUAkmQHm/CPAi0Jd2z3Qyzz0HY 2Cj47SBcVPD5NkAl6EaD/ijOTLLjjaiHMZfBawTRq1gYS2ZFYw/ongKMTiNlLUiirsEy UD5TxQKBPRYsCWgxWGRShV3PcAb8kQsSLuyyW4rJwMyNDNF6IdLrDYjoOoST1CTR7cME +Q== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbncw00an-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:01 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G7rba024195; Fri, 2 Sep 2022 16:28:58 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma03ams.nl.ibm.com with ESMTP id 3j7aw98c9e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:28:58 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GSu4p34996510 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:28:56 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0A4E05204F; Fri, 2 Sep 2022 16:28:56 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id D80105204E; Fri, 2 Sep 2022 16:28:54 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 06/11] Replace the low level HMAC calls when calculating the EVM HMAC Date: Fri, 2 Sep 2022 12:28:31 -0400 Message-Id: <20220902162836.554839-7-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: n9Yey04HeXnlj_vp7a8tIhbuPqwUdFpp X-Proofpoint-GUID: n9Yey04HeXnlj_vp7a8tIhbuPqwUdFpp X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_04,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 malwarescore=0 mlxscore=0 spamscore=0 priorityscore=1501 impostorscore=0 suspectscore=0 mlxlogscore=999 clxscore=1015 phishscore=0 bulkscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020078 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Calculating the EVM HMAC and labeling the filesystem was originally included in ima-evm-utils for debugging purposes only. For now, instead of removing EVM HMAC support just replace the low level HMAC_ calls with EVP_ calls. The '-a, --hashalgo' specifies the IMA hash or signature algorithm. The kernel EVM HMAC is limited to SHA1. Fix ima-evm-utils by hard coding the EVM HMAC algorithm to SHA1. Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar --- src/evmctl.c | 57 +++++++++++++++++++++++++++++----------------------- 1 file changed, 32 insertions(+), 25 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 641504047a36..a9b2f1040787 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1159,12 +1159,12 @@ static int cmd_setxattr_ima(struct command *cmd) static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash) { - const EVP_MD *md; + size_t mdlen; + EVP_MD_CTX *pctx; + EVP_PKEY *pkey = NULL; struct stat st; int err = -1; uint32_t generation = 0; - HMAC_CTX *pctx; - unsigned int mdlen; char **xattrname; unsigned char xattr_value[1024]; unsigned char *key; @@ -1175,10 +1175,8 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h struct h_misc_64 hmac_misc; int hmac_size; #if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX ctx; + EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = HMAC_CTX_new(); #endif key = file2bin(keyfile, NULL, &keylen); @@ -1226,19 +1224,26 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h goto out; } - md = EVP_get_digestbyname(imaevm_params.hash_algo); - if (!md) { - log_err("EVP_get_digestbyname(%s) failed\n", - imaevm_params.hash_algo); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new failed\n"); goto out; } +#endif - err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL); - if (err) { + pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, evmkey, sizeof(evmkey)); + if (!pkey) { log_err("HMAC_Init() failed\n"); goto out; } + err = EVP_DigestSignInit(pctx, NULL, EVP_sha1(), NULL, pkey); + if (err != 1) { + log_err("EVP_DigestSignInit() failed\n"); + goto out; + } + for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value)); if (err < 0) { @@ -1249,12 +1254,12 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_info("skipping xattr: %s\n", *xattrname); continue; } - /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ log_info("name: %s, size: %d\n", *xattrname, err); log_debug_dump(xattr_value, err); - err = !HMAC_Update(pctx, xattr_value, err); - if (err) { - log_err("HMAC_Update() failed\n"); + + err = EVP_DigestSignUpdate(pctx, xattr_value, err); + if (err != 1) { + log_err("EVP_DigestSignUpdate() failed\n"); goto out_ctx_cleanup; } } @@ -1293,23 +1298,24 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_debug("hmac_misc (%d): ", hmac_size); log_debug_dump(&hmac_misc, hmac_size); - err = !HMAC_Update(pctx, (const unsigned char *)&hmac_misc, hmac_size); - if (err) { + err = EVP_DigestSignUpdate(pctx, &hmac_misc, hmac_size); + if (err != 1) { log_err("HMAC_Update() failed\n"); goto out_ctx_cleanup; } - err = !HMAC_Final(pctx, hash, &mdlen); - if (err) + err = EVP_DigestSignFinal(pctx, hash, &mdlen); + if (err != 1) log_err("HMAC_Final() failed\n"); out_ctx_cleanup: -#if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX_cleanup(pctx); -#else - HMAC_CTX_free(pctx); + EVP_PKEY_free(pkey); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); #endif out: free(key); - return err ?: mdlen; + if (err == 1) + return mdlen; + return err; } static int hmac_evm(const char *file, const char *key) @@ -1333,6 +1339,7 @@ static int hmac_evm(const char *file, const char *key) err = lsetxattr(file, xattr_evm, sig, len + 1, 0); if (err < 0) { log_err("setxattr failed: %s\n", file); + errno = 0; return err; } } From patchwork Fri Sep 2 16:28:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964407 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8DBE6ECAAD5 for ; Fri, 2 Sep 2022 16:29:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236286AbiIBQ3W (ORCPT ); Fri, 2 Sep 2022 12:29:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236420AbiIBQ3S (ORCPT ); Fri, 2 Sep 2022 12:29:18 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3A627DDA8D for ; Fri, 2 Sep 2022 09:29:09 -0700 (PDT) Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282G0w0m030758; Fri, 2 Sep 2022 16:29:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=/J9sLw+5b/f42Q5km3yDhBKn+qpgjLTUWcPySEm8vXY=; b=lgnABf6OAezevGrPAlyesF2fFF5LvrrBEA+F0aMVWxeE7tkMQOqZY4tLl5fgZJfTko1D 0YIMcC+Rfv7NjaJ8GcI0aaE4RYm1U6zZpCcTnnkFPNKy10kXD8hCMFE7i/4CGMThmk7O NLtIMWPbnXEz/flzxUVFi0QONNQDUJTvPcL+VlIXp7ppmT0/rk2VZ9suaA1+UlO9MR4O W5Qn5dfm8Dm6ORTVtcux3vj6rqnEIUXXw4vdQsmTbLQa/eIioO3cKeJnuJUlY1BmAhCN 8cNo1DpAhbX3qCNS9+X5kEoQVGAXT+su6GhMW8WuPvmOb+mdGNPK3eH6lKMSBSN1ROhf 9A== Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbmyx0xw3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:03 +0000 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G7qsn019601; Fri, 2 Sep 2022 16:29:01 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma02fra.de.ibm.com with ESMTP id 3j7aw8x5d6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:01 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GTKaY21955006 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:29:20 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EF83C5204E; Fri, 2 Sep 2022 16:28:57 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id 4C60D5204F; Fri, 2 Sep 2022 16:28:56 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 07/11] Add missing EVP_MD_CTX_free() call in calc_evm_hash() Date: Fri, 2 Sep 2022 12:28:32 -0400 Message-Id: <20220902162836.554839-8-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: SooPzYGuGTb7br4AARNXBC9I49EWZlmH X-Proofpoint-ORIG-GUID: SooPzYGuGTb7br4AARNXBC9I49EWZlmH X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_03,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 mlxlogscore=999 mlxscore=0 bulkscore=0 phishscore=0 malwarescore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020075 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org When EVP_MD_CTX_new() call was added, the corresponding EVP_MD_CTX_free() was never called. Properly free it. Fixes: 81010f0d87ef ("ima-evm-utils: Add backward compatible support for openssl 1.1") Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar --- src/evmctl.c | 57 ++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 17 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index a9b2f1040787..b89e74e06c3d 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -331,11 +331,17 @@ err: return -1; } +/* + * calc_evm_hash - calculate the file metadata hash + * + * Returns 0 for EVP_ function failures. Return -1 for other failures. + * Return hash algorithm size on success. + */ static int calc_evm_hash(const char *file, unsigned char *hash) { const EVP_MD *md; struct stat st; - int err; + int err = -1; uint32_t generation = 0; EVP_MD_CTX *pctx; unsigned int mdlen; @@ -349,12 +355,11 @@ static int calc_evm_hash(const char *file, unsigned char *hash) #if OPENSSL_VERSION_NUMBER < 0x10100000 EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = EVP_MD_CTX_new(); #endif if (lstat(file, &st)) { log_err("Failed to stat: %s\n", file); + errno = 0; return -1; } @@ -391,20 +396,30 @@ static int calc_evm_hash(const char *file, unsigned char *hash) list_size = llistxattr(file, list, sizeof(list)); if (list_size < 0) { log_err("llistxattr() failed\n"); + errno = 0; return -1; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new() failed\n"); + return 0; + } +#endif + md = EVP_get_digestbyname(imaevm_params.hash_algo); if (!md) { log_err("EVP_get_digestbyname(%s) failed\n", imaevm_params.hash_algo); - return 1; + err = 0; + goto out; } err = EVP_DigestInit(pctx, md); if (!err) { log_err("EVP_DigestInit() failed\n"); - return 1; + goto out; } for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { @@ -415,7 +430,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("selinux[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, selinux_str); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && ima_str) { @@ -423,7 +439,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("ima[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } hex2bin(xattr_value, ima_str, err); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && evm_portable){ @@ -432,7 +449,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err < 0) { log_err("EVM portable sig: %s required\n", xattr_ima); - return -1; + goto out; } use_xattr_ima = 1; } else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) { @@ -442,7 +459,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err >= sizeof(xattr_value)) { log_err("caps[%u] value is too long to fit into xattr[%zu]\n", err + 1, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, caps_str); } else { @@ -463,7 +481,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, xattr_value, err); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } @@ -517,29 +535,33 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } if (!evm_immutable && !evm_portable && !(hmac_flags & HMAC_FLAG_NO_UUID)) { err = get_uuid(&st, uuid); if (err) - return -1; + goto out; err = EVP_DigestUpdate(pctx, (const unsigned char *)uuid, sizeof(uuid)); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } err = EVP_DigestFinal(pctx, hash, &mdlen); - if (!err) { + if (!err) log_err("EVP_DigestFinal() failed\n"); - return 1; - } - return mdlen; +out: +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); +#endif + if (err == 1) + return mdlen; + return err; } static int sign_evm(const char *file, const char *key) @@ -575,6 +597,7 @@ static int sign_evm(const char *file, const char *key) err = lsetxattr(file, xattr_evm, sig, len, 0); if (err < 0) { log_err("setxattr failed: %s\n", file); + errno = 0; return err; } } From patchwork Fri Sep 2 16:28:33 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964410 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77932C001B5 for ; Fri, 2 Sep 2022 16:29:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235589AbiIBQ30 (ORCPT ); Fri, 2 Sep 2022 12:29:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44508 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236418AbiIBQ3X (ORCPT ); Fri, 2 Sep 2022 12:29:23 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3EA7BDB7C5 for ; Fri, 2 Sep 2022 09:29:12 -0700 (PDT) Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282G0wto030778; Fri, 2 Sep 2022 16:29:05 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=d3MECtkHNqJbthFBAhG/0JufyRqmfs0MhUPWTxVH9Os=; b=W8EUnSGp1WQ5iWz91A764Q1qwHtrN37+Pp78pwMX4g02EJZYnafd+IzXB01T7rD2juqw Tfc9Zi/mkX8jJ/MSFAWwajxSWmjbJHxo4k/7iisXdDGvJi2U+hgdyDCupRWiVOsI+KGb WJiQd9stFqIIG+ZqsxUyiEpb3QJqEmljoSVm/ON3OPVREDIva4IgsgfLLoFh/xB20eKi 8qPkBs4C8cHOAI+asHjSCOPVx14pAn4fnXe5x526qzDPiXE/c/2dNhq2T8L2rcCSRF82 HQafK9NP4WThCEgohmKxDHtWcfWEyTLvTzwk50zGACjbc4BGxXzsfX2zoQNcPNYTC8ul pQ== Received: from ppma01fra.de.ibm.com (46.49.7a9f.ip4.static.sl-reverse.com [159.122.73.70]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbmyx0xx7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:05 +0000 Received: from pps.filterd (ppma01fra.de.ibm.com [127.0.0.1]) by ppma01fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G8glv021109; Fri, 2 Sep 2022 16:29:03 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma01fra.de.ibm.com with ESMTP id 3j8hkad0c3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:03 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GPdtf27394544 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:25:39 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C41605204E; Fri, 2 Sep 2022 16:28:59 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id 53F4A5204F; Fri, 2 Sep 2022 16:28:58 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 08/11] Deprecate use of OpenSSL v3 "engine" support Date: Fri, 2 Sep 2022 12:28:33 -0400 Message-Id: <20220902162836.554839-9-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: _-42uKTdgM7HY2pFoaOBzsp4zNAUeChW X-Proofpoint-ORIG-GUID: _-42uKTdgM7HY2pFoaOBzsp4zNAUeChW X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_03,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 mlxlogscore=999 mlxscore=0 bulkscore=0 phishscore=0 malwarescore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020075 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 "engine" support is deprecated and replaced with "providers". Engine support will continue to work for a while, but results in deprecated declaration and other messages. One option is simply to hide them ("-Wno-deprecated-declarations"). The other alternative is to conditionally build ima-evm-utils without OpenSSL v3 engine support and without disabling deprecated declarations. Based on "--disable-engine" or "--enable-engine=no" configuration option, disable OpenSSL v3 "engine" support. When ima-evm-utils engine support is disabled, don't execute the tests requiring it. Signed-off-by: Mimi Zohar --- configure.ac | 13 +++++++++++++ src/Makefile.am | 8 ++++++++ src/evmctl.c | 17 ++++++++++++++++- src/imaevm.h | 2 ++ src/libimaevm.c | 5 +++++ tests/functions.sh | 14 +++++++++++++- tests/ima_hash.test | 9 +++++++++ tests/sign_verify.test | 10 ++++++++++ 8 files changed, 76 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index dc666f2bb1fa..1a7d7eb17370 100644 --- a/configure.ac +++ b/configure.ac @@ -54,6 +54,17 @@ AC_ARG_ENABLE(sigv1, AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) +AC_ARG_ENABLE(engine, + [AS_HELP_STRING([--disable-engine], [build ima-evm-utils without OpenSSL v3 engine support])]) + +ssl_version=$(openssl version | sed -e 's/^OpenSSL //' | sed -e 's/ .*//') +if test "${ssl_version::1}" != "3"; then + enable_engine="yes" +elif test -z "$enable_engine"; then + enable_engine="yes" +fi +AM_CONDITIONAL([CONFIG_ENGINE], [test "x$enable_engine" = "xyes"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -89,5 +100,7 @@ echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" echo " sigv1: $enable_sigv1" +echo " engine: $enable_engine" +echo " ssl: $ssl_version" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 90c7249020cf..a810d6e0acff 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -11,6 +11,10 @@ if CONFIG_SIGV1 libimaevm_la_CFLAGS = -DCONFIG_SIGV1 endif +if CONFIG_ENGINE +libimaevm_la_CFLAGS = -DCONFIG_ENGINE +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -31,6 +35,10 @@ if CONFIG_SIGV1 evmctl_CFLAGS = -DCONFIG_SIGV1 endif +# Enable "--engine" support +if CONFIG_ENGINE +evmctl_CFLAGS = -DCONFIG_ENGINE +endif # USE_PCRTSS uses the Intel TSS if USE_PCRTSS diff --git a/src/evmctl.c b/src/evmctl.c index b89e74e06c3d..fa588e0caba2 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -64,7 +64,9 @@ #include #include #include +#if CONFIG_ENGINE #include +#endif #include #include "hash_info.h" #include "pcr.h" @@ -2715,7 +2717,9 @@ static void usage(void) " --selinux use custom Selinux label for EVM\n" " --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n" " --verify-sig verify measurement list signatures\n" - " --engine e preload OpenSSL engine e (such as: gost)\n" +#if CONFIG_ENGINE + " --engine e preload OpenSSL engine e (such as: gost) is deprecated\n" +#endif " --ignore-violations ignore ToMToU measurement violations\n" " -v increase verbosity level\n" " -h, --help display this help and exit\n" @@ -2777,7 +2781,9 @@ static struct option opts[] = { {"selinux", 1, 0, 136}, {"caps", 2, 0, 137}, {"verify-sig", 0, 0, 138}, +#if CONFIG_ENGINE {"engine", 1, 0, 139}, +#endif {"xattr-user", 0, 0, 140}, {"ignore-violations", 0, 0, 141}, {"pcrs", 1, 0, 142}, @@ -2830,9 +2836,11 @@ static char *get_password(void) return password; } +#if CONFIG_ENGINE static ENGINE *setup_engine(const char *engine_id) { ENGINE *eng = ENGINE_by_id(engine_id); + if (!eng) { log_err("engine %s isn't available\n", optarg); ERR_print_errors_fp(stderr); @@ -2846,6 +2854,7 @@ static ENGINE *setup_engine(const char *engine_id) ENGINE_set_default(eng, ENGINE_METHOD_ALL); return eng; } +#endif int main(int argc, char *argv[]) { @@ -2971,11 +2980,13 @@ int main(int argc, char *argv[]) case 138: verify_list_sig = 1; break; +#if CONFIG_ENGINE case 139: /* --engine e */ imaevm_params.eng = setup_engine(optarg); if (!imaevm_params.eng) goto error; break; +#endif case 140: /* --xattr-user */ xattr_ima = "user.ima"; xattr_evm = "user.evm"; @@ -3034,7 +3045,9 @@ int main(int argc, char *argv[]) if (imaevm_params.keyfile != NULL && imaevm_params.eng == NULL && !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { +#if CONFIG_ENGINE imaevm_params.eng = setup_engine("pkcs11"); +#endif if (!imaevm_params.eng) goto error; } @@ -3060,6 +3073,7 @@ int main(int argc, char *argv[]) } error: +#if CONFIG_ENGINE if (imaevm_params.eng) { ENGINE_finish(imaevm_params.eng); ENGINE_free(imaevm_params.eng); @@ -3067,6 +3081,7 @@ error: ENGINE_cleanup(); #endif } +#endif ERR_free_strings(); EVP_cleanup(); BIO_free(NULL); diff --git a/src/imaevm.h b/src/imaevm.h index afcf1e042014..ebe8c20d566a 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -48,7 +48,9 @@ #include #include #include +#ifdef CONFIG_ENGINE #include +#endif #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ diff --git a/src/libimaevm.c b/src/libimaevm.c index 4b37bf5bd62c..ba489402f6f1 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -959,6 +959,7 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) EVP_PKEY *pkey; if (!strncmp(keyfile, "pkcs11:", 7)) { +#ifdef CONFIG_ENGINE if (!imaevm_params.keyid) { log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); return NULL; @@ -975,6 +976,10 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) log_err("Failed to load private key %s\n", keyfile); goto err_engine; } +#else + log_err("OpenSSL 3 \"engine\" support is deprecated\n"); + goto err_engine; +#endif } else { fp = fopen(keyfile, "r"); if (!fp) { diff --git a/tests/functions.sh b/tests/functions.sh index 8f6f02dfcd95..19c1725d5b32 100755 --- a/tests/functions.sh +++ b/tests/functions.sh @@ -312,4 +312,16 @@ _softhsm_teardown() { rm -rf "${SOFTHSM_SETUP_CONFIGDIR}" unset SOFTHSM_SETUP_CONFIGDIR SOFTHSM2_CONF PKCS11_KEYURI \ EVMCTL_ENGINE OPENSSL_ENGINE OPENSSL_KEYFORM -} \ No newline at end of file +} + +# OpenSSL 3 engine support still works, but is deprecated. In preparation +# for it being removed, a new ima-evm-utils configuration option +# "--disable-engine" and the equivalent "--enable-engine=no" is defined.` +_is_engine_supported() { + cmd="evmctl --engine pkcs11" + $cmd &>/dev/null + if [ $? -eq 1 ]; then + return 0 + fi + return 1 +} diff --git a/tests/ima_hash.test b/tests/ima_hash.test index e88fd59cc359..33223e6c7a94 100755 --- a/tests/ima_hash.test +++ b/tests/ima_hash.test @@ -71,6 +71,15 @@ expect_pass check sha384 0x0405 38b060a751ac96384cd9327eb1b1e36a21fdb71114b expect_pass check sha512 0x0406 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e expect_pass check rmd160 0x0403 9c1185a5c5e9fc54612808977ee8f548b2258d31 expect_pass check sm3 0x0411 1ab21d8355cfa17f8e61194831e81a8f22bec8c728fefb747ed035eb5082aa2b + +# Remaining tests require engine support +_is_engine_supported +if [ $? -eq 0 ]; then + __skip() { echo "Tests requiring engine support are skipped (not supported)"; return $SKIP; } + expect_pass __skip + exit 0 +fi + _enable_gost_engine expect_pass check md_gost12_256 0x0412 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb expect_pass check streebog256 0x0412 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 948892759424..fff9dd7bd42c 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -18,6 +18,8 @@ cd "$(dirname "$0")" || exit 1 PATH=../src:$PATH SIGV1=0 +ENGINE_SUPPORTED=0 + source ./functions.sh _require cmp evmctl getfattr openssl xxd @@ -418,6 +420,14 @@ if [ -x /opt/openssl3/bin/openssl ]; then sign_verify sm2 sm3 0x030211:K:004[345678] fi +# Remaining tests require engine support +_is_engine_supported +if [ $? -eq 0 ]; then + __skip() { echo "Tests requiring engine support are skipped (not supported)"; return $SKIP; } + expect_pass __skip + exit 0 +fi + # Test v2 signatures with EC-RDSA _enable_gost_engine sign_verify gost2012_256-A md_gost12_256 0x030212:K:0040 From patchwork Fri Sep 2 16:28:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964408 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BE64C38145 for ; Fri, 2 Sep 2022 16:29:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235657AbiIBQ3Y (ORCPT ); Fri, 2 Sep 2022 12:29:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44576 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236433AbiIBQ3V (ORCPT ); Fri, 2 Sep 2022 12:29:21 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1775FDA3ED for ; Fri, 2 Sep 2022 09:29:11 -0700 (PDT) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282GS0MU009175; Fri, 2 Sep 2022 16:29:07 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=rSlLZ3DNSq6UVeaMkxAYlwRnw4cxT8C5DM0colvrAEQ=; b=kdAgCtpP8sFbVQPm9SlRZRBDJsisHL01b6A5LN4nTrj34+ilOvW4gyY7vHi1E8besjhs pKpZ790sEVAA1o9Vzy//gjZjcWCFo0mFkHJCWREDruGz50lBr/4jIdtfKDx6w/7L6YOX JCHkvyRpVD5u9StCNPc24MgnFJBwUp5nl1eapZtKAlHG/d+ed3R3XsJem8B1EzrkV34u 0/FmR90TuS5upoRP5NGd7suonM1/n81oLSphzSyaByN2LlcxWAsZEO+8EgRMf/3sZe3O tgvRQytcD3talirIggQJIOQNZXSwpK0y9uac5IbZcTu5Am0ZAZhKyjxxqKVaue3C5Lq+ zA== Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbnck8119-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:06 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G8alU019279; Fri, 2 Sep 2022 16:29:05 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma05fra.de.ibm.com with ESMTP id 3j7aw8x5kc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:05 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GT1lw29032886 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:29:01 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A2B465204F; Fri, 2 Sep 2022 16:29:01 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id 12BC55204E; Fri, 2 Sep 2022 16:28:59 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 09/11] Fix potential use after free in read_tpm_banks() Date: Fri, 2 Sep 2022 12:28:34 -0400 Message-Id: <20220902162836.554839-10-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: OA7Z3JnK_dlytSfar-nWAmBw5h7tX_bk X-Proofpoint-ORIG-GUID: OA7Z3JnK_dlytSfar-nWAmBw5h7tX_bk X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_04,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 mlxscore=0 impostorscore=0 mlxlogscore=897 spamscore=0 suspectscore=0 lowpriorityscore=0 phishscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020078 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On failure to read TPM 2.0 bank PCRs 'errmsg' is not properly set to NULL after being freed. Fix potential use after free. Fixes: 3472f9ba9c05 ("ima-evm-utils: read the PCRs for the requested TPM banks") Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar --- src/evmctl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/evmctl.c b/src/evmctl.c index fa588e0caba2..a497b1a468d6 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2075,6 +2075,7 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank) log_debug("Failed to read %s PCRs: (%s)\n", bank[i].algo_name, errmsg); free(errmsg); + errmsg = NULL; bank[i].supported = 0; } } From patchwork Fri Sep 2 16:28:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964409 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3AD1BC001B5 for ; Fri, 2 Sep 2022 16:29:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236422AbiIBQ3Z (ORCPT ); Fri, 2 Sep 2022 12:29:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44444 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236140AbiIBQ3W (ORCPT ); Fri, 2 Sep 2022 12:29:22 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2C192DAA2E for ; Fri, 2 Sep 2022 09:29:14 -0700 (PDT) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282GS0VC009176; Fri, 2 Sep 2022 16:29:08 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=N69wR1mV5qKCMCs9CYE76RAoJOz2SKx2OwoLJjJCodk=; b=GXSn0eqkQUmCb9pgFawV/YOijUOcgwaiJsdwSv/JKMihmuWqvz3Q5BDjWc0/9gc4+9HV Q1txjhqOL/CBh9KEua1/xNUCHxe4TwcVnVON0srHNCNk1ZXJGp9fIyO1ud9yzn3eYPHb pts2JHX3264VqTqMr1w/CCZmtIbXhPZMnXziFCkIZFqvzm3mjWzfTBTMgE3P8nF1fiGv 7iYlH2C46CfPpMfq1bJYc+pXWfZI09jSHAw3m3arWCdaCc1BITKDZwv3izP9dDLZDORM kVO/fNuwmi54KkwWbkqq/IvKRMe1NdTeRJxFpFREkHsWqhMI7nyAxd96js5aQXAyX00h Yw== Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbnck811t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:08 +0000 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G80fR011785; Fri, 2 Sep 2022 16:29:06 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma06ams.nl.ibm.com with ESMTP id 3j7ahj8e91-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:06 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GT3vv35520896 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:29:03 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 30E285204E; Fri, 2 Sep 2022 16:29:03 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id E3DB752050; Fri, 2 Sep 2022 16:29:01 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 10/11] Limit the file hash algorithm name length Date: Fri, 2 Sep 2022 12:28:35 -0400 Message-Id: <20220902162836.554839-11-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: OsWFYClcO7xHlYqur3GyjMhD1wkmJ4Oi X-Proofpoint-ORIG-GUID: OsWFYClcO7xHlYqur3GyjMhD1wkmJ4Oi X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_04,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 mlxscore=0 impostorscore=0 mlxlogscore=999 spamscore=0 suspectscore=0 lowpriorityscore=0 phishscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020078 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Instead of assuming the file hash algorithm is a properly NULL terminated string, properly limit the "algo:" field size. Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar --- src/evmctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index a497b1a468d6..aac669438a1c 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1602,7 +1602,7 @@ void ima_ng_show(struct template_entry *entry) total_len -= sizeof(field_len); algo = (char *)fieldp; - len = strlen(algo) + 1; + len = strnlen(algo, field_len - 1) + 1; digest_len = field_len - len; digest = fieldp + len; From patchwork Fri Sep 2 16:28:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12964411 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C85A8ECAAD5 for ; Fri, 2 Sep 2022 16:29:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236404AbiIBQ32 (ORCPT ); Fri, 2 Sep 2022 12:29:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44420 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236439AbiIBQ3Y (ORCPT ); Fri, 2 Sep 2022 12:29:24 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D9207DC0B9 for ; Fri, 2 Sep 2022 09:29:15 -0700 (PDT) Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 282G0wb9030791; Fri, 2 Sep 2022 16:29:11 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=3cQT0jAMiIEKOnjXuRz1TD6kDtKHKfVNX9Wq47dPQGo=; b=krUg0vEJ+i1SR8CrpOSi94fzgCEnCemAjk5XUoy/lPXjPDN0Kg+d8V0AjiLEqlzkrrXu R0+jtHxOa6iA1bWlBvVOAjxTUz7Rm2QtI6e3nVb4CxhdhVDhPCj8W0WqXN71RSABzRRo 9mQpXJ7NAmW/DyQv+qI5puxPA3Cb/P0RaDmIqUui1ck+7MXrK2Py0labh4XfrBlmZasd wgoHOq5bQzrEOMEgRCRSxgWDtpuhZ32L7l10pugSFVn+GoG/70CHBguM7hH2KqdJNMdf jarWXBf6A7gk9Ap+G1w442mU0akNHUbtHx/adYr/EgCfKc/y3nX5BcZ9ejIBaAzViW7F yQ== Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jbmyx0y12-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:10 +0000 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 282G7sFY011773; Fri, 2 Sep 2022 16:29:08 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma06ams.nl.ibm.com with ESMTP id 3j7ahj8e93-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Sep 2022 16:29:08 +0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 282GTRf038076808 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 2 Sep 2022 16:29:27 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 242B95204F; Fri, 2 Sep 2022 16:29:05 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.132.193]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id A34945204E; Fri, 2 Sep 2022 16:29:03 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils 11/11] Missing template data size lower bounds checking Date: Fri, 2 Sep 2022 12:28:36 -0400 Message-Id: <20220902162836.554839-12-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220902162836.554839-1-zohar@linux.ibm.com> References: <20220902162836.554839-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 7B_M9VC0e_u0NURkFi36LNYFckulHPEu X-Proofpoint-ORIG-GUID: 7B_M9VC0e_u0NURkFi36LNYFckulHPEu X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-02_03,2022-08-31_03,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 spamscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 mlxlogscore=999 mlxscore=0 bulkscore=0 phishscore=0 malwarescore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2209020075 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Each record in the IMA measurement list must contain some template data. Ensure the template data is not zero length. Reviewed-by: Petr Vorel Signed-off-by: Mimi Zohar --- src/evmctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index aac669438a1c..e603449b7d9e 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2188,6 +2188,10 @@ static int ima_measurement(const char *file) log_err("Unable to read template length\n"); goto out; } + if (entry.template_len == 0) { + log_err("Invalid template data len\n"); + goto out; + } } else { entry.template_len = SHA_DIGEST_LENGTH + TCG_EVENT_NAME_LEN_MAX + 1;