From patchwork Wed Sep 14 02:29:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975496 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF615C54EE9 for ; Wed, 14 Sep 2022 02:30:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229482AbiINCaS (ORCPT ); Tue, 13 Sep 2022 22:30:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34136 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229547AbiINCaQ (ORCPT ); Tue, 13 Sep 2022 22:30:16 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CE7EA4456C for ; Tue, 13 Sep 2022 19:30:13 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E1fWPO011056; Wed, 14 Sep 2022 02:30:08 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=Y//fm9Dgzbk+PFjbKzqhMOboUHD60qTJUUpmKo88SPU=; b=BXJhuxxO+5k/Zeb+hCSPEQ4r4MtadnyDMF1UYW2+SLDUBH9fTapibFQlh+LtltqjfU4w JJuXIhIvqfRZJz1mRMx+qs7y9eioAMmPWKhGchdJgjZ45DzlveGANISfFKFImeEhTmm6 e479Co+8jULyXQVwRLiJnCu4hoNr9wZ5RfEGYN1AYSv1LVHkJX7mF80yJPiWKLx6NpDV cvHb30SVgGogdPPK1lWbjeYNWUFj1wYsmzd5+wLoZZ0Q3SNn9Ih1G20CwmNIFQ7JzVR3 tuxLr2ypp6UhxWJ89SG0ODljZQu1S8wF1C+b8/YrYJQcU8f7QO8dTbxVVcCH54k3njVE Ww== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk5h2h464-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:07 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2LNEL027543; Wed, 14 Sep 2022 02:30:05 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma04ams.nl.ibm.com with ESMTP id 3jjytx0aun-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:05 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2U2Rn36503834 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:02 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 01707A4040; Wed, 14 Sep 2022 02:30:02 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 277F3A404D; Wed, 14 Sep 2022 02:30:01 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:01 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 01/15] travis: update dist=focal Date: Tue, 13 Sep 2022 22:29:42 -0400 Message-Id: <20220914022956.1359218-2-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 2inTGnZN6ezhIzqgQB7HG_mXTe0qb918 X-Proofpoint-GUID: 2inTGnZN6ezhIzqgQB7HG_mXTe0qb918 X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 mlxscore=0 impostorscore=0 malwarescore=0 clxscore=1015 mlxlogscore=999 lowpriorityscore=0 adultscore=0 phishscore=0 bulkscore=0 spamscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Although Github Actions is available on Github Enterprise Server 3.x single server edition, as well as the unpaid version, it is not available in Github Enterprise Server 3.x cluster edition[1]. Continue updating travis.yml. [1] https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#github-packages Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 5741116e418a..edd2a21b83d3 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,6 @@ # Copyright (c) 2017-2021 Petr Vorel -dist: bionic +dist: focal language: C services: - docker From patchwork Wed Sep 14 02:29:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975498 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 214CBC6FA89 for ; Wed, 14 Sep 2022 02:30:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229547AbiINCaT (ORCPT ); Tue, 13 Sep 2022 22:30:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229484AbiINCaQ (ORCPT ); Tue, 13 Sep 2022 22:30:16 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D0FF845057 for ; Tue, 13 Sep 2022 19:30:13 -0700 (PDT) Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E1u6VW011370; Wed, 14 Sep 2022 02:30:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=bniy1ulIUzo3NXXzZuvQMD4AY5vSfcSUm9l7WXv7ZwA=; b=q9xkTSBpYnROuA2eCno0H1r2z2pjUw+A0AH+uC8dwpDNzO9P2eqHtht/s0KzQgoN4po+ yA02btQwTzJh3AxeuSmyTauQdM8Vp00eysBnjwQa1ymRYTxUAdZZkV8rj0VMQ44SajIa oUkmJ+wpXIhXG3hOtOqj45C3wdpr1fBrZN0ROPJIe4p3hTJg8TPAEEArdQ7PK2XdruoN f2gfpMmZwxNJ9H76CRqXDnrici37/foeqHBBo2O7YMNNcElv32fBHtDzfPpKWFtLMGRA FFYBBAk8i38vr/hgX3V3oD8s7lulc2/nmGiq655/jfnHpFYJ4rVTr7hoBIXzPNs8urNe 8Q== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk5qn0r2v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:09 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2KkFR026717; Wed, 14 Sep 2022 02:30:07 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma04ams.nl.ibm.com with ESMTP id 3jjytx0aut-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:06 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2U35Q40436028 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:03 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EF8FBA4055; Wed, 14 Sep 2022 02:30:02 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2FD90A4040; Wed, 14 Sep 2022 02:30:02 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:02 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 02/15] Update configure.ac to address a couple of obsolete warnings Date: Tue, 13 Sep 2022 22:29:43 -0400 Message-Id: <20220914022956.1359218-3-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: Sq5mjpmNJprfCu9J38-zsCu7GRROSrEM X-Proofpoint-ORIG-GUID: Sq5mjpmNJprfCu9J38-zsCu7GRROSrEM X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 priorityscore=1501 bulkscore=0 mlxscore=0 lowpriorityscore=0 spamscore=0 malwarescore=0 clxscore=1015 impostorscore=0 mlxlogscore=999 adultscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Remove AC_PROG_LIBTOOL and AC_HEAD_STDC. Replace AC_HELP_STRING with AS_HELP_STRING. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- acinclude.m4 | 2 +- configure.ac | 4 ---- m4/manpage-docbook-xsl.m4 | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/acinclude.m4 b/acinclude.m4 index dd430d4f0565..bb962f81a9c0 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -2,7 +2,7 @@ AC_DEFUN([PKG_ARG_ENABLE], [ AC_MSG_CHECKING(whether to enable $1) - AC_ARG_ENABLE([$1], AC_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), + AC_ARG_ENABLE([$1], AS_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), [pkg_cv_enable_$1=$enableval], [AC_CACHE_VAL([pkg_cv_enable_$1], [pkg_cv_enable_$1=$2])]) if test $pkg_cv_enable_$1 = yes; then diff --git a/configure.ac b/configure.ac index 1a0f093df562..9d3b23ff8def 100644 --- a/configure.ac +++ b/configure.ac @@ -15,16 +15,12 @@ AM_PROG_CC_C_O #AC_PROG_CXX #AC_PROG_CPP AC_PROG_INSTALL -AC_PROG_LIBTOOL #AC_PROG_LN_S LT_INIT # FIXME: Replace `main' with a function in `-lpthread': #AC_CHECK_LIB([pthread], [main]) -# Checks for header files. -AC_HEADER_STDC - PKG_CHECK_MODULES(LIBCRYPTO, [libcrypto >= 0.9.8 ]) AC_SUBST(KERNEL_HEADERS) AC_CHECK_HEADER(unistd.h) diff --git a/m4/manpage-docbook-xsl.m4 b/m4/manpage-docbook-xsl.m4 index 25c8ce54b068..f2ee912ed1be 100644 --- a/m4/manpage-docbook-xsl.m4 +++ b/m4/manpage-docbook-xsl.m4 @@ -7,7 +7,7 @@ AC_DEFUN([EVMCTL_MANPAGE_DOCBOOK_XSL], [ AC_PATH_PROGS(XMLCATALOG, xmlcatalog) AC_ARG_WITH([xml-catalog], - AC_HELP_STRING([--with-xml-catalog=CATALOG], + AS_HELP_STRING([--with-xml-catalog=CATALOG], [path to xml catalog to use]),, [with_xml_catalog=/etc/xml/catalog]) XML_CATALOG_FILE="$with_xml_catalog" From patchwork Wed Sep 14 02:29:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975500 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7695C6FA8B for ; Wed, 14 Sep 2022 02:30:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229568AbiINCaV (ORCPT ); Tue, 13 Sep 2022 22:30:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34232 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229691AbiINCaS (ORCPT ); Tue, 13 Sep 2022 22:30:18 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CBC4843607 for ; Tue, 13 Sep 2022 19:30:13 -0700 (PDT) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E1Ip6Q032050; Wed, 14 Sep 2022 02:30:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=n1sozLaN+TCzgsZq38h5BMslZ4VBh5iWS4XThUTRPGI=; b=WAHqZgrRAvhdNhzdKgrYweDQioaPU1U4Fq219pPHoAsL7xuUbrot004n5HmlrMHKkttb 0ttqKamO3aTqlFZBJT10auP+qs3kTLcMd+DgxqxpOzz82wUYlTzaDdSmcM6jE9k+HNDZ MfcsImByjBCrazpgGAo2xqBOWUFzBfbw3J3WZ3WQx3fwM4ZhsCksxWJpUAeTVC8+MtFz N0QA+1dNljJAFG/QN35d2Z1FCKlLAGWF6V2Oxf2gvIqDUpHa1l2JuUmwoAuGI0KFFiSc nkxGxXtztQRou8ulTMbIXAF4APiWvZKCFL4KViMR50J4SkLD0YCM98HpePecp/ojCEsB hQ== Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk56e1ptq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:09 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2MMxR000993; Wed, 14 Sep 2022 02:30:08 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma05fra.de.ibm.com with ESMTP id 3jjy9a08da-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:08 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2U4Rg38404560 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:04 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D35A1A4053; Wed, 14 Sep 2022 02:30:03 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2BD4AA4065; Wed, 14 Sep 2022 02:30:03 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:03 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 03/15] Deprecate IMA signature version 1 Date: Tue, 13 Sep 2022 22:29:44 -0400 Message-Id: <20220914022956.1359218-4-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: cd9cgXeMm8ckrs4nXjn_JerqVb-W5ytN X-Proofpoint-GUID: cd9cgXeMm8ckrs4nXjn_JerqVb-W5ytN X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 phishscore=0 priorityscore=1501 mlxlogscore=999 impostorscore=0 malwarescore=0 clxscore=1015 mlxscore=0 suspectscore=0 lowpriorityscore=0 spamscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The original IMA file signatures were based on a SHA1 hash. Kernel support for other hash algorithms was subsequently upstreamed. Deprecate "--rsa" support. Define "--enable-sigv1" option to configure signature v1 support. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- configure.ac | 6 ++++++ src/Makefile.am | 10 ++++++++++ src/evmctl.c | 20 ++++++++++++++++---- src/libimaevm.c | 22 +++++++++++++++++++--- tests/sign_verify.test | 18 ++++++++++++------ 5 files changed, 63 insertions(+), 13 deletions(-) diff --git a/configure.ac b/configure.ac index 9d3b23ff8def..dc666f2bb1fa 100644 --- a/configure.ac +++ b/configure.ac @@ -49,6 +49,11 @@ AC_ARG_ENABLE([openssl_conf], AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by evmctl.]) fi], [enable_openssl_conf=yes]) +AC_ARG_ENABLE(sigv1, + AS_HELP_STRING([--enable-sigv1], [Build ima-evm-utils with signature v1 support])) + AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) + AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -83,5 +88,6 @@ echo " openssl-conf: $enable_openssl_conf" echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" +echo " sigv1: $enable_sigv1" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 396496bb439d..90c7249020cf 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -7,6 +7,10 @@ libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) libimaevm_la_LDFLAGS = -version-info 3:0:0 libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS) +if CONFIG_SIGV1 +libimaevm_la_CFLAGS = -DCONFIG_SIGV1 +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -22,6 +26,12 @@ evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) evmctl_LDFLAGS = $(LDFLAGS_READLINE) evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la +# Enable IMA signature version 1 +if CONFIG_SIGV1 +evmctl_CFLAGS = -DCONFIG_SIGV1 +endif + + # USE_PCRTSS uses the Intel TSS if USE_PCRTSS evmctl_SOURCES += pcr_tss.c diff --git a/src/evmctl.c b/src/evmctl.c index 76e2561798fa..13b0105af8c4 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -987,7 +987,6 @@ static int cmd_verify_ima(struct command *cmd) init_public_keys("/etc/keys/x509_evm.der"); } - errno = 0; if (!file) { log_err("Parameters missing\n"); print_usage(cmd); @@ -1004,6 +1003,7 @@ static int cmd_verify_ima(struct command *cmd) return fails > 0; } +#if CONFIG_SIGV1 static int cmd_convert(struct command *cmd) { char *inkey; @@ -1034,6 +1034,7 @@ static int cmd_convert(struct command *cmd) RSA_free(key); return err; } +#endif static int cmd_import(struct command *cmd) { @@ -1088,6 +1089,7 @@ static int cmd_import(struct command *cmd) calc_keyid_v2((uint32_t *)keyid, name, pkey); EVP_PKEY_free(pkey); } else { +#if CONFIG_SIGV1 RSA *key = read_pub_key(inkey, imaevm_params.x509); if (!key) @@ -1095,6 +1097,10 @@ static int cmd_import(struct command *cmd) len = key2bin(key, pub); calc_keyid_v1(keyid, name, pub, len); RSA_free(key); +#else + log_info("Importing public RSA key is not supported\n"); + return 1; +#endif } log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); @@ -2598,7 +2604,9 @@ static void usage(void) " -d, --imahash make IMA hash\n" " -f, --sigfile store IMA signature in .sig file instead of xattr\n" " --xattr-user store xattrs in user namespace (for testing purposes)\n" - " --rsa use RSA key type and signing scheme v1\n" +#if CONFIG_SIGV1 + " --rsa use RSA key type and signing scheme v1 (deprecated)\n" +#endif " -k, --key path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n" " or a pkcs11 URI\n" " --keyid n overwrite signature keyid with a 32-bit value in hex (for signing)\n" @@ -2637,8 +2645,12 @@ static void usage(void) struct command cmds[] = { {"--version", NULL, 0, ""}, {"help", cmd_help, 0, ""}, - {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring.\n"}, - {"convert", cmd_convert, 0, "key", "convert public key into the keyring.\n"}, +#if CONFIG_SIGV1 + {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring. ([--rsa] deprecated)\n"}, + {"convert", cmd_convert, 0, "key", "convert public key into the keyring. (deprecated)\n"}, +#else + {"import", cmd_import, 0, "pubkey keyring", "Import public key into the keyring.\n"}, +#endif {"sign", cmd_sign_evm, 0, "[-r] [--imahash | --imasig ] [--key key] [--pass [password] file", "Sign file metadata.\n"}, {"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"}, {"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--key key] [--pass [password] file", "Make file content signature.\n"}, diff --git a/src/libimaevm.c b/src/libimaevm.c index e4b62b4989b2..4b37bf5bd62c 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -292,6 +292,7 @@ out: return pkey; } +#if CONFIG_SIGV1 RSA *read_pub_key(const char *keyfile, int x509) { EVP_PKEY *pkey; @@ -351,6 +352,7 @@ static int verify_hash_v1(const char *file, const unsigned char *hash, int size, return 0; } +#endif /* CONFIG_SIGV1 */ struct public_key_entry { struct public_key_entry *next; @@ -686,6 +688,7 @@ int verify_hash(const char *file, const unsigned char *hash, int size, { /* Get signature type from sig header */ if (sig[1] == DIGSIG_VERSION_1) { +#if CONFIG_SIGV1 const char *key = NULL; /* Read pubkey from RSA key */ @@ -695,6 +698,10 @@ int verify_hash(const char *file, const unsigned char *hash, int size, key = imaevm_params.keyfile; return verify_hash_v1(file, hash, size, sig + 1, siglen - 1, key); +#else + log_info("Signature version 1 deprecated."); + return -1; +#endif } else if (sig[1] == DIGSIG_VERSION_2) { return verify_hash_v2(file, hash, size, sig, siglen); } else if (sig[1] == DIGSIG_VERSION_3) { @@ -742,6 +749,7 @@ int ima_verify_signature(const char *file, unsigned char *sig, int siglen, return verify_hash(file, hash, hashlen, sig, siglen); } +#if CONFIG_SIGV1 /* * Create binary key representation suitable for kernel */ @@ -800,6 +808,7 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len if (imaevm_params.verbose > LOG_INFO) log_info("keyid-v1: %s\n", str); } +#endif /* CONFIG_SIGV1 */ /* * Calculate keyid of the public_key part of EVP_PKEY @@ -990,6 +999,7 @@ err_engine: return NULL; } +#if CONFIG_SIGV1 static RSA *read_priv_key(const char *keyfile, const char *keypass) { EVP_PKEY *pkey; @@ -1100,6 +1110,7 @@ out: RSA_free(key); return len; } +#endif /* CONFIG_SIGV1 */ /* * @sig is assumed to be of (MAX_SIGNATURE_SIZE - 1) size @@ -1214,9 +1225,14 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c if (keypass) imaevm_params.keypass = keypass; - return imaevm_params.x509 ? - sign_hash_v2(hashalgo, hash, size, keyfile, sig) : - sign_hash_v1(hashalgo, hash, size, keyfile, sig); + if (imaevm_params.x509) + return sign_hash_v2(hashalgo, hash, size, keyfile, sig); +#if CONFIG_SIGV1 + else + return sign_hash_v1(hashalgo, hash, size, keyfile, sig); +#endif + log_info("Signature version 1 deprecated."); + return -1; } static void libinit() diff --git a/tests/sign_verify.test b/tests/sign_verify.test index c56290aa4932..948892759424 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -17,6 +17,7 @@ cd "$(dirname "$0")" || exit 1 PATH=../src:$PATH +SIGV1=0 source ./functions.sh _require cmp evmctl getfattr openssl xxd @@ -368,13 +369,18 @@ try_different_sigs() { ## Test v1 signatures # Signature v1 only supports sha1 and sha256 so any other should fail -expect_fail \ - check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa +if [ $SIGV1 -eq 0 ]; then + __skip() { echo "IMA signature v1 tests are skipped: not supported"; return $SKIP; } + expect_pass __skip +else + expect_fail \ + check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa -sign_verify rsa1024 sha1 0x0301 --rsa -sign_verify rsa1024 sha256 0x0301 --rsa - try_different_keys - try_different_sigs + sign_verify rsa1024 sha1 0x0301 --rsa + sign_verify rsa1024 sha256 0x0301 --rsa + try_different_keys + try_different_sigs +fi ## Test v2 signatures with RSA PKCS#1 # List of allowed hashes much greater but not all are supported. From patchwork Wed Sep 14 02:29:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975499 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D03D2ECAAD8 for ; Wed, 14 Sep 2022 02:30:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229788AbiINCaV (ORCPT ); Tue, 13 Sep 2022 22:30:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34236 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229568AbiINCaS (ORCPT ); Tue, 13 Sep 2022 22:30:18 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DEE446210 for ; Tue, 13 Sep 2022 19:30:15 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E29iGJ024499; Wed, 14 Sep 2022 02:30:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=Y9Rld75iQekuvLUzD1vgMip7BMykrnSVA//hIUurg5k=; b=Pi3EeV79B2dmmHCHcvHu/ADTE2rMYLa10V9tcfeQNXqX2ozgbKAdZzFDf0JY65B5iZwQ 7fzU3BClifH4cyZ/6gziL8ReqMfCG1p/wWhkjNq9YT/FK6ZQz1s9P+dEopAuain/uU3c Y6MkvDn6I7yDeNRtzZ7qz3WLAWAzo2b+wg2dlD03kI43hdzDAEEUhESAatrGvqEYh2qj nmRft7MmUG6xfnFHrsuvsKwkQYQUSAn4+liZBAFIp+91y2M/Zu5L/tj9hFBETFarj6Q9 DKasJRg4t4wrj4LfE0atSbijaRLSH8LccEsofzSebTj/Hf+wmEOFqyLIVNy39IoslPQH bw== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk5pa0wya-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:11 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2Khm6025260; Wed, 14 Sep 2022 02:30:10 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma03ams.nl.ibm.com with ESMTP id 3jjy95rbv3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:09 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2U4ND39321862 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:04 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CA328A4059; Wed, 14 Sep 2022 02:30:04 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 18DE0A4040; Wed, 14 Sep 2022 02:30:04 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:03 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 04/15] Replace the low level SHA1 calls when calculating the TPM 1.2 PCRs Date: Tue, 13 Sep 2022 22:29:45 -0400 Message-Id: <20220914022956.1359218-5-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: N_aAfs9VSQD6wtlLEB6knE4zo66BPFGL X-Proofpoint-ORIG-GUID: N_aAfs9VSQD6wtlLEB6knE4zo66BPFGL X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 priorityscore=1501 mlxscore=0 mlxlogscore=999 lowpriorityscore=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 suspectscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 emits deprecated warnings for SHA1 functions. Use the EVP_ functions when walking the TPM 1.2 binary bios measurements to calculate the TPM 1.2 PCRs. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 59 insertions(+), 6 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 13b0105af8c4..641504047a36 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2295,6 +2295,11 @@ static int cmd_ima_measurement(struct command *cmd) return ima_measurement(file); } +/* + * read_binary_bios_measurements - read the TPM 1.2 event log + * + * Returns 0 on success, 1 on failure. + */ #define MAX_EVENT_DATA_SIZE 200000 static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) { @@ -2307,12 +2312,19 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } header; unsigned char data[MAX_EVENT_DATA_SIZE]; } event; + EVP_MD_CTX *mdctx; + const EVP_MD *md; + unsigned int mdlen; + int evp_err = 1; /* success */ struct stat s; FILE *fp; - SHA_CTX c; int err = 0; int len; int i; +#if OPENSSL_VERSION_NUMBER < 0x10100000 + EVP_MD_CTX ctx; + mdctx = &ctx; +#endif if (stat(file, &s) == -1) { errno = 0; @@ -2334,6 +2346,23 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) if (imaevm_params.verbose > LOG_INFO) log_info("Reading the TPM 1.2 event log %s.\n", file); + md = EVP_get_digestbyname(bank->algo_name); + if (!md) { + log_errno("Unknown message digest %s\n", bank->algo_name); + errno = 0; + fclose(fp); + return 1; + } + +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + mdctx = EVP_MD_CTX_new(); + if (!mdctx) { + log_err("EVP_MD_CTX_new failed\n"); + fclose(fp); + return 1; + } +#endif + /* Extend the pseudo TPM PCRs with the event digest */ while (fread(&event, sizeof(event.header), 1, fp) == 1) { if (imaevm_params.verbose > LOG_INFO) { @@ -2342,13 +2371,30 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } if (event.header.pcr >= NUM_PCRS) { log_err("Invalid PCR %d.\n", event.header.pcr); - err = 1; break; } - SHA1_Init(&c); - SHA1_Update(&c, bank->pcr[event.header.pcr], 20); - SHA1_Update(&c, event.header.digest, 20); - SHA1_Final(bank->pcr[event.header.pcr], &c); + + evp_err = EVP_DigestInit(mdctx, md); + if (evp_err == 0) { + log_err("EVP_DigestInit() failed\n"); + break; + } + + evp_err = EVP_DigestUpdate(mdctx, bank->pcr[event.header.pcr], 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestUpdate(mdctx, event.header.digest, 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestFinal(mdctx, bank->pcr[event.header.pcr], &mdlen); + if (evp_err == 0) { + log_err("EVP_DigestFinal() failed\n"); + break; + } if (event.header.len > MAX_EVENT_DATA_SIZE) { log_err("Event data event too long.\n"); err = 1; @@ -2357,10 +2403,17 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) len = fread(event.data, event.header.len, 1, fp); if (len != 1) { log_errno("Failed reading event data (short read)\n"); + err = 1; break; } } + + if (evp_err == 0) /* EVP_ functions return 1 on success, 0 on failure */ + err = 1; fclose(fp); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(mdctx); +#endif if (imaevm_params.verbose <= LOG_INFO) return err; From patchwork Wed Sep 14 02:29:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975497 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 528F7C6FA86 for ; Wed, 14 Sep 2022 02:30:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229751AbiINCaT (ORCPT ); Tue, 13 Sep 2022 22:30:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34234 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229638AbiINCaS (ORCPT ); Tue, 13 Sep 2022 22:30:18 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6685B4507D for ; Tue, 13 Sep 2022 19:30:15 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E2N0BJ012443; Wed, 14 Sep 2022 02:30:11 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=JjFObJdu+i+lj8LbsPGzkBLkTS7fnDG4hTTvTkuUpJk=; b=knQ/kR5oM+JbMdlyH2xy7KG1Pom29biusKKH/70UV7EUw5F8/T4U6ba4WgyULvm/B3Hx k7cKPZUzqLm8WbSP3jW1W0RkK810u40hNrHua+qY0uqGqaqYql6EGoqmQw7o4rC8o9QF 7TgznGIt8Tfladi6WLBKbfmVG2TUxLoPbCbIsodGvWyY747PN8isrz/tDSHrFzrhzRz2 nCufnTURJula8Cm69cgI3F+/yTY0ddzk6HAc8Yd5uT08gjE9Qfi1e33ZAa2zGJJuFyuC xu/orTezveuvhj7ZT2YwY7f16k2WcD16e33PdUeY9VVGd6B5r0zG/xOXBQI1+mN6ZEdo 8g== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk64fr3g6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:11 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2KVr2026673; Wed, 14 Sep 2022 02:30:09 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma04ams.nl.ibm.com with ESMTP id 3jjytx0auv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:09 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2U5d743254156 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:05 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C04D3A4051; Wed, 14 Sep 2022 02:30:05 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0761FA4040; Wed, 14 Sep 2022 02:30:05 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:04 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 05/15] Replace the low level HMAC calls when calculating the EVM HMAC Date: Tue, 13 Sep 2022 22:29:46 -0400 Message-Id: <20220914022956.1359218-6-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 8b-oB106q9MjnKMsQDIqSYk8Hw3mEzqR X-Proofpoint-ORIG-GUID: 8b-oB106q9MjnKMsQDIqSYk8Hw3mEzqR X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 impostorscore=0 mlxscore=0 lowpriorityscore=0 mlxlogscore=999 clxscore=1015 adultscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Calculating the EVM HMAC and labeling the filesystem was originally included in ima-evm-utils for debugging purposes only. For now, instead of removing EVM HMAC support just replace the low level HMAC_ calls with EVP_ calls. The '-a, --hashalgo' specifies the IMA hash or signature algorithm. The kernel EVM HMAC is limited to SHA1. Fix ima-evm-utils by hard coding the EVM HMAC algorithm to SHA1. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 58 ++++++++++++++++++++++++++++++---------------------- 1 file changed, 33 insertions(+), 25 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 641504047a36..27d2061f23be 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -61,6 +61,7 @@ #include #include #include +#include #include #include #include @@ -1159,12 +1160,12 @@ static int cmd_setxattr_ima(struct command *cmd) static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash) { - const EVP_MD *md; + size_t mdlen; + EVP_MD_CTX *pctx; + EVP_PKEY *pkey = NULL; struct stat st; int err = -1; uint32_t generation = 0; - HMAC_CTX *pctx; - unsigned int mdlen; char **xattrname; unsigned char xattr_value[1024]; unsigned char *key; @@ -1175,10 +1176,8 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h struct h_misc_64 hmac_misc; int hmac_size; #if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX ctx; + EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = HMAC_CTX_new(); #endif key = file2bin(keyfile, NULL, &keylen); @@ -1226,19 +1225,26 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h goto out; } - md = EVP_get_digestbyname(imaevm_params.hash_algo); - if (!md) { - log_err("EVP_get_digestbyname(%s) failed\n", - imaevm_params.hash_algo); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new failed\n"); goto out; } +#endif - err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL); - if (err) { + pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, evmkey, sizeof(evmkey)); + if (!pkey) { log_err("HMAC_Init() failed\n"); goto out; } + err = EVP_DigestSignInit(pctx, NULL, EVP_sha1(), NULL, pkey); + if (err != 1) { + log_err("EVP_DigestSignInit() failed\n"); + goto out; + } + for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value)); if (err < 0) { @@ -1249,12 +1255,12 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_info("skipping xattr: %s\n", *xattrname); continue; } - /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ log_info("name: %s, size: %d\n", *xattrname, err); log_debug_dump(xattr_value, err); - err = !HMAC_Update(pctx, xattr_value, err); - if (err) { - log_err("HMAC_Update() failed\n"); + + err = EVP_DigestSignUpdate(pctx, xattr_value, err); + if (err != 1) { + log_err("EVP_DigestSignUpdate() failed\n"); goto out_ctx_cleanup; } } @@ -1293,23 +1299,24 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_debug("hmac_misc (%d): ", hmac_size); log_debug_dump(&hmac_misc, hmac_size); - err = !HMAC_Update(pctx, (const unsigned char *)&hmac_misc, hmac_size); - if (err) { + err = EVP_DigestSignUpdate(pctx, &hmac_misc, hmac_size); + if (err != 1) { log_err("HMAC_Update() failed\n"); goto out_ctx_cleanup; } - err = !HMAC_Final(pctx, hash, &mdlen); - if (err) + err = EVP_DigestSignFinal(pctx, hash, &mdlen); + if (err != 1) log_err("HMAC_Final() failed\n"); out_ctx_cleanup: -#if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX_cleanup(pctx); -#else - HMAC_CTX_free(pctx); + EVP_PKEY_free(pkey); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); #endif out: free(key); - return err ?: mdlen; + if (err == 1) + return mdlen; + return err; } static int hmac_evm(const char *file, const char *key) @@ -1333,6 +1340,7 @@ static int hmac_evm(const char *file, const char *key) err = lsetxattr(file, xattr_evm, sig, len + 1, 0); if (err < 0) { log_err("setxattr failed: %s\n", file); + errno = 0; return err; } } From patchwork Wed Sep 14 02:29:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975502 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56F07ECAAD8 for ; Wed, 14 Sep 2022 02:30:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229605AbiINCaX (ORCPT ); Tue, 13 Sep 2022 22:30:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229590AbiINCaS (ORCPT ); Tue, 13 Sep 2022 22:30:18 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 464B346604 for ; Tue, 13 Sep 2022 19:30:16 -0700 (PDT) Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E1uFPo013143; Wed, 14 Sep 2022 02:30:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=dx6J/OEtGLpZk1N1k9/CMY/JT2oRkIXueei5YslGvYo=; b=tpXPDfSFB4Y7Xkwp5mNWXK7OKeB4/M0dGa0Qigu7mp4FlDyxJB+HuL3afPdMoaZkb4mK s+f7mCUX7rx2DAH27YlphZVIyc1ZoXD6IDVRE74OmBM5R25zwoLAeR+lG9FnRiHZ/aNT TfJ8CGgRzL4yNafcedafD+DCfSEQ008P9gDceltOTpAT4JhH7Yvtc4YiXg5KKUYxWja8 dzKL+1jgPHYfUQchB6H7xSmbhKrqKhr3migfqwFLQcC0+bQ15xxrV4H0BZWQEuvUDgSO th/FSAkNYjv9CVu5irrPz3C6eypGtdKnYUSmU53RLT8c8deZbhagulaqQB/Besn2s2qY ZQ== Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk5qn0r4q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:12 +0000 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2KiTQ027177; Wed, 14 Sep 2022 02:30:09 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma06ams.nl.ibm.com with ESMTP id 3jjyfr8bfb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:09 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2UVrf15597966 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:31 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id ACA06A4051; Wed, 14 Sep 2022 02:30:06 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EF79BA4040; Wed, 14 Sep 2022 02:30:05 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:05 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 06/15] Add missing EVP_MD_CTX_free() call in calc_evm_hash() Date: Tue, 13 Sep 2022 22:29:47 -0400 Message-Id: <20220914022956.1359218-7-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 3LMj5ksgGg-EKx43C-EDRcFssbLIJTFI X-Proofpoint-ORIG-GUID: 3LMj5ksgGg-EKx43C-EDRcFssbLIJTFI X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 priorityscore=1501 bulkscore=0 mlxscore=0 lowpriorityscore=0 spamscore=0 malwarescore=0 clxscore=1015 impostorscore=0 mlxlogscore=999 adultscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org When EVP_MD_CTX_new() call was added, the corresponding EVP_MD_CTX_free() was never called. Properly free it. Fixes: 81010f0d87ef ("ima-evm-utils: Add backward compatible support for openssl 1.1") Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 57 ++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 17 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 27d2061f23be..b8c92aad6b84 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -332,11 +332,17 @@ err: return -1; } +/* + * calc_evm_hash - calculate the file metadata hash + * + * Returns 0 for EVP_ function failures. Return -1 for other failures. + * Return hash algorithm size on success. + */ static int calc_evm_hash(const char *file, unsigned char *hash) { const EVP_MD *md; struct stat st; - int err; + int err = -1; uint32_t generation = 0; EVP_MD_CTX *pctx; unsigned int mdlen; @@ -350,12 +356,11 @@ static int calc_evm_hash(const char *file, unsigned char *hash) #if OPENSSL_VERSION_NUMBER < 0x10100000 EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = EVP_MD_CTX_new(); #endif if (lstat(file, &st)) { log_err("Failed to stat: %s\n", file); + errno = 0; return -1; } @@ -392,20 +397,30 @@ static int calc_evm_hash(const char *file, unsigned char *hash) list_size = llistxattr(file, list, sizeof(list)); if (list_size < 0) { log_err("llistxattr() failed\n"); + errno = 0; return -1; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new() failed\n"); + return 0; + } +#endif + md = EVP_get_digestbyname(imaevm_params.hash_algo); if (!md) { log_err("EVP_get_digestbyname(%s) failed\n", imaevm_params.hash_algo); - return 1; + err = 0; + goto out; } err = EVP_DigestInit(pctx, md); if (!err) { log_err("EVP_DigestInit() failed\n"); - return 1; + goto out; } for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { @@ -416,7 +431,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("selinux[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, selinux_str); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && ima_str) { @@ -424,7 +440,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("ima[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } hex2bin(xattr_value, ima_str, err); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && evm_portable){ @@ -433,7 +450,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err < 0) { log_err("EVM portable sig: %s required\n", xattr_ima); - return -1; + goto out; } use_xattr_ima = 1; } else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) { @@ -443,7 +460,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err >= sizeof(xattr_value)) { log_err("caps[%u] value is too long to fit into xattr[%zu]\n", err + 1, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, caps_str); } else { @@ -464,7 +482,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, xattr_value, err); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } @@ -518,29 +536,33 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } if (!evm_immutable && !evm_portable && !(hmac_flags & HMAC_FLAG_NO_UUID)) { err = get_uuid(&st, uuid); if (err) - return -1; + goto out; err = EVP_DigestUpdate(pctx, (const unsigned char *)uuid, sizeof(uuid)); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } err = EVP_DigestFinal(pctx, hash, &mdlen); - if (!err) { + if (!err) log_err("EVP_DigestFinal() failed\n"); - return 1; - } - return mdlen; +out: +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); +#endif + if (err == 1) + return mdlen; + return err; } static int sign_evm(const char *file, const char *key) @@ -576,6 +598,7 @@ static int sign_evm(const char *file, const char *key) err = lsetxattr(file, xattr_evm, sig, len, 0); if (err < 0) { log_err("setxattr failed: %s\n", file); + errno = 0; return err; } } From patchwork Wed Sep 14 02:29:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975506 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6185C6FA86 for ; Wed, 14 Sep 2022 02:30:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229590AbiINCaY (ORCPT ); Tue, 13 Sep 2022 22:30:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229484AbiINCaT (ORCPT ); Tue, 13 Sep 2022 22:30:19 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A33DC4456C for ; Tue, 13 Sep 2022 19:30:17 -0700 (PDT) Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E2TjOJ015751; Wed, 14 Sep 2022 02:30:13 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=kbugM/h6rXRRZoihxp1LccE33sxavvKleOO8XuE74fY=; b=Mh6Vd5z6kSFfCiEz8OvTDooRh0gLwrvwq7jr0z/Po5vwJVB2hqN/IgRgF3Rdc5Gdyo8A gjWr/Dey7CxDRwRCnQi3LnSBj2Bq3U9VzvpytRv2PsjbLAU+4fhZEy6hRIOwFK24Bh81 eT1F6+mS/y8np0E1kW9MRZMyYvzpOIi/JAmNnWePHKwPCZI2MDaSNStJe34a+c1XP8AF Y/vrHUG5GeGrZ5X4PW5lng2F0TAK2hKycxqs9ZU0bap64uhc1eUc1DS6SaCdL8b25tel IpiWtuDHjuxtn2Y3oNH9ozLs4AyTEhwbnGYOrv1p0WDj56MdcV+Hj3CKwbKggzTb2MRs kw== Received: from ppma01fra.de.ibm.com (46.49.7a9f.ip4.static.sl-reverse.com [159.122.73.70]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk67m007p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:12 +0000 Received: from pps.filterd (ppma01fra.de.ibm.com [127.0.0.1]) by ppma01fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2KmkY000923; Wed, 14 Sep 2022 02:30:10 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma01fra.de.ibm.com with ESMTP id 3jjy2j88w5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:10 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2QMcJ21102858 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:26:22 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9391BA4051; Wed, 14 Sep 2022 02:30:07 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DBE57A404D; Wed, 14 Sep 2022 02:30:06 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:06 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 07/15] Disable use of OpenSSL "engine" support Date: Tue, 13 Sep 2022 22:29:48 -0400 Message-Id: <20220914022956.1359218-8-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: p6H-_gF1wX5MmmhPsic3lUgccFCUl0ap X-Proofpoint-ORIG-GUID: p6H-_gF1wX5MmmhPsic3lUgccFCUl0ap X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 spamscore=0 adultscore=0 lowpriorityscore=0 impostorscore=0 suspectscore=0 mlxlogscore=999 mlxscore=0 priorityscore=1501 malwarescore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 "engine" support is deprecated and replaced with "providers". Engine support will continue to work for a while, but results in deprecated declaration and other messages. One option is simply to hide them ("-Wno-deprecated-declarations"). The other alternative is to conditionally build ima-evm-utils without OpenSSL engine support and without disabling deprecated declarations. Based on "--disable-engine" or "--enable-engine=no" configuration option, disable OpenSSL "engine" support. Signed-off-by: Mimi Zohar --- configure.ac | 5 +++++ src/Makefile.am | 8 ++++++++ src/evmctl.c | 17 ++++++++++++++++- src/imaevm.h | 2 ++ src/libimaevm.c | 7 ++++++- tests/functions.sh | 2 +- tests/ima_hash.test | 1 + tests/sign_verify.test | 1 + 8 files changed, 40 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index dc666f2bb1fa..49e9350ace07 100644 --- a/configure.ac +++ b/configure.ac @@ -54,6 +54,10 @@ AC_ARG_ENABLE(sigv1, AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) +AC_ARG_ENABLE(engine, + [AS_HELP_STRING([--disable-engine], [build ima-evm-utils without OpenSSL engine support])],,[enable_engine=yes]) + AM_CONDITIONAL([CONFIG_ENGINE], [test "x$enable_engine" = "xyes"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -89,5 +93,6 @@ echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" echo " sigv1: $enable_sigv1" +echo " engine: $enable_engine" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 90c7249020cf..a810d6e0acff 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -11,6 +11,10 @@ if CONFIG_SIGV1 libimaevm_la_CFLAGS = -DCONFIG_SIGV1 endif +if CONFIG_ENGINE +libimaevm_la_CFLAGS = -DCONFIG_ENGINE +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -31,6 +35,10 @@ if CONFIG_SIGV1 evmctl_CFLAGS = -DCONFIG_SIGV1 endif +# Enable "--engine" support +if CONFIG_ENGINE +evmctl_CFLAGS = -DCONFIG_ENGINE +endif # USE_PCRTSS uses the Intel TSS if USE_PCRTSS diff --git a/src/evmctl.c b/src/evmctl.c index b8c92aad6b84..19d822efcee0 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -65,7 +65,9 @@ #include #include #include +#if CONFIG_ENGINE #include +#endif #include #include "hash_info.h" #include "pcr.h" @@ -2716,7 +2718,9 @@ static void usage(void) " --selinux use custom Selinux label for EVM\n" " --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n" " --verify-sig verify measurement list signatures\n" - " --engine e preload OpenSSL engine e (such as: gost)\n" +#if CONFIG_ENGINE + " --engine e preload OpenSSL engine e (such as: gost) is deprecated\n" +#endif " --ignore-violations ignore ToMToU measurement violations\n" " -v increase verbosity level\n" " -h, --help display this help and exit\n" @@ -2778,7 +2782,9 @@ static struct option opts[] = { {"selinux", 1, 0, 136}, {"caps", 2, 0, 137}, {"verify-sig", 0, 0, 138}, +#if CONFIG_ENGINE {"engine", 1, 0, 139}, +#endif {"xattr-user", 0, 0, 140}, {"ignore-violations", 0, 0, 141}, {"pcrs", 1, 0, 142}, @@ -2831,9 +2837,11 @@ static char *get_password(void) return password; } +#if CONFIG_ENGINE static ENGINE *setup_engine(const char *engine_id) { ENGINE *eng = ENGINE_by_id(engine_id); + if (!eng) { log_err("engine %s isn't available\n", optarg); ERR_print_errors_fp(stderr); @@ -2847,6 +2855,7 @@ static ENGINE *setup_engine(const char *engine_id) ENGINE_set_default(eng, ENGINE_METHOD_ALL); return eng; } +#endif int main(int argc, char *argv[]) { @@ -2972,11 +2981,13 @@ int main(int argc, char *argv[]) case 138: verify_list_sig = 1; break; +#if CONFIG_ENGINE case 139: /* --engine e */ imaevm_params.eng = setup_engine(optarg); if (!imaevm_params.eng) goto error; break; +#endif case 140: /* --xattr-user */ xattr_ima = "user.ima"; xattr_evm = "user.evm"; @@ -3035,7 +3046,9 @@ int main(int argc, char *argv[]) if (imaevm_params.keyfile != NULL && imaevm_params.eng == NULL && !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { +#if CONFIG_ENGINE imaevm_params.eng = setup_engine("pkcs11"); +#endif if (!imaevm_params.eng) goto error; } @@ -3061,6 +3074,7 @@ int main(int argc, char *argv[]) } error: +#if CONFIG_ENGINE if (imaevm_params.eng) { ENGINE_finish(imaevm_params.eng); ENGINE_free(imaevm_params.eng); @@ -3068,6 +3082,7 @@ error: ENGINE_cleanup(); #endif } +#endif ERR_free_strings(); EVP_cleanup(); BIO_free(NULL); diff --git a/src/imaevm.h b/src/imaevm.h index afcf1e042014..ebe8c20d566a 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -48,7 +48,9 @@ #include #include #include +#ifdef CONFIG_ENGINE #include +#endif #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ diff --git a/src/libimaevm.c b/src/libimaevm.c index 4b37bf5bd62c..5d05f1bc1720 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -956,9 +956,10 @@ uint32_t imaevm_read_keyid(const char *certfile) static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) { FILE *fp; - EVP_PKEY *pkey; + EVP_PKEY *pkey = NULL; if (!strncmp(keyfile, "pkcs11:", 7)) { +#ifdef CONFIG_ENGINE if (!imaevm_params.keyid) { log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); return NULL; @@ -975,6 +976,10 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) log_err("Failed to load private key %s\n", keyfile); goto err_engine; } +#else + log_err("OpenSSL \"engine\" support is disabled\n"); + goto err_engine; +#endif } else { fp = fopen(keyfile, "r"); if (!fp) { diff --git a/tests/functions.sh b/tests/functions.sh index 8f6f02dfcd95..209d79684f04 100755 --- a/tests/functions.sh +++ b/tests/functions.sh @@ -312,4 +312,4 @@ _softhsm_teardown() { rm -rf "${SOFTHSM_SETUP_CONFIGDIR}" unset SOFTHSM_SETUP_CONFIGDIR SOFTHSM2_CONF PKCS11_KEYURI \ EVMCTL_ENGINE OPENSSL_ENGINE OPENSSL_KEYFORM -} \ No newline at end of file +} diff --git a/tests/ima_hash.test b/tests/ima_hash.test index e88fd59cc359..20c673e2d86f 100755 --- a/tests/ima_hash.test +++ b/tests/ima_hash.test @@ -71,6 +71,7 @@ expect_pass check sha384 0x0405 38b060a751ac96384cd9327eb1b1e36a21fdb71114b expect_pass check sha512 0x0406 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e expect_pass check rmd160 0x0403 9c1185a5c5e9fc54612808977ee8f548b2258d31 expect_pass check sm3 0x0411 1ab21d8355cfa17f8e61194831e81a8f22bec8c728fefb747ed035eb5082aa2b + _enable_gost_engine expect_pass check md_gost12_256 0x0412 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb expect_pass check streebog256 0x0412 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 948892759424..6839896aa04b 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -18,6 +18,7 @@ cd "$(dirname "$0")" || exit 1 PATH=../src:$PATH SIGV1=0 + source ./functions.sh _require cmp evmctl getfattr openssl xxd From patchwork Wed Sep 14 02:29:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975501 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52B7CC6FA8D for ; Wed, 14 Sep 2022 02:30:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229652AbiINCaW (ORCPT ); Tue, 13 Sep 2022 22:30:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34260 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229605AbiINCaT (ORCPT ); Tue, 13 Sep 2022 22:30:19 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 52A9F46622 for ; Tue, 13 Sep 2022 19:30:17 -0700 (PDT) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E2N902027456; Wed, 14 Sep 2022 02:30:13 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=WaT4REzbx2zKSdUoziwKDMIrRCzpDTkv+pbDv9uW3Qw=; b=HnellHhfcRoeKWTI702eNGZ2ZE3GZF07E2sh+2D2jLyPB41QEkrwBQKWhTRMBhRRR2ad AQTg5m2Q2Mc3m1BOpwzz+8arkVJ0rMR/KZ/BDexsUt6jQ7+YNBWRQim+FUkUEtdieevi sDdIZwclSoFF+IiSVWWP9aCpYHNUs9jQGWbnn4mlRjBDgjEI9va56ooPRWwbLm663xQQ hWw3iftyesOhaVVOBQ9Cqv5JyfrQrG2Za2Xqq3/4AvIMaZOKB/5OeHKHDRLKLwr4ejTe QIeA3m99rT00UKAHuYOMbXVWlBahi7mKdo0A30kwJ69Q0EYU1Z5vn9ySvASIQxJLapz3 cg== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk64jr4ay-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:13 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2KkFS026717; Wed, 14 Sep 2022 02:30:12 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma04ams.nl.ibm.com with ESMTP id 3jjytx0auy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:11 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2U8Z333816896 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:08 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A1C70A4055; Wed, 14 Sep 2022 02:30:08 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D4EDAA4057; Wed, 14 Sep 2022 02:30:07 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:07 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 08/15] Fix potential use after free in read_tpm_banks() Date: Tue, 13 Sep 2022 22:29:49 -0400 Message-Id: <20220914022956.1359218-9-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 7HRq-1K9qFJgHYzgWAyk1nWuqnzkfxqE X-Proofpoint-ORIG-GUID: 7HRq-1K9qFJgHYzgWAyk1nWuqnzkfxqE X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 mlxscore=0 mlxlogscore=999 bulkscore=0 suspectscore=0 spamscore=0 priorityscore=1501 clxscore=1015 lowpriorityscore=0 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On failure to read TPM 2.0 bank PCRs 'errmsg' is not properly set to NULL after being freed. Fix potential use after free. Fixes: 3472f9ba9c05 ("ima-evm-utils: read the PCRs for the requested TPM banks") Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/evmctl.c b/src/evmctl.c index 19d822efcee0..797fcef60506 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2076,6 +2076,7 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank) log_debug("Failed to read %s PCRs: (%s)\n", bank[i].algo_name, errmsg); free(errmsg); + errmsg = NULL; bank[i].supported = 0; } } From patchwork Wed Sep 14 02:29:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975503 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BCC1C6FA89 for ; Wed, 14 Sep 2022 02:30:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229728AbiINCaY (ORCPT ); Tue, 13 Sep 2022 22:30:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229638AbiINCaU (ORCPT ); Tue, 13 Sep 2022 22:30:20 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 705BD4507D for ; Tue, 13 Sep 2022 19:30:19 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E1g961014093; Wed, 14 Sep 2022 02:30:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=BKnoEwWT1W4E2PWI6+QfZVzdPz8h4fMOJZVj/j23qNs=; b=aEidUpCwheInc1wY5OVBEv8VTwqwrouWOhYHC8WCFvPfoiksA2b4+c1T0zH2rO3kGT2T 7yludXI+orSgxFWdh+I6wAJQNN2yo6tlIBmxz/cffsNTIi55eZDHAF5Jft6JTGgNoIU0 IU9tiqoiFgi+Wt4GZ4+bPMTi2r35M/fepqMdVzyn+nqD62vhH/gOv33dgyOUITKhoJz+ rs/dv2daHogol1Dn0t2zR21OULjoFPYhNiGd8CBW8YLawrhcAKmkH8dxmh5ZxncGAePj JsBE6byRmfdQTFhNtCgTzyyUzSrVl0OySLE7hAusbnER9rsjnSbi3x+JiCYri7yGDKD5 RQ== Received: from ppma03fra.de.ibm.com (6b.4a.5195.ip4.static.sl-reverse.com [149.81.74.107]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk5h2h4ad-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:15 +0000 Received: from pps.filterd (ppma03fra.de.ibm.com [127.0.0.1]) by ppma03fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2K9bD025759; Wed, 14 Sep 2022 02:30:13 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma03fra.de.ibm.com with ESMTP id 3jjy25r8yu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:12 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2U9iG35520862 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:09 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 91875A4053; Wed, 14 Sep 2022 02:30:09 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D02FEA404D; Wed, 14 Sep 2022 02:30:08 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:08 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 09/15] Limit the file hash algorithm name length Date: Tue, 13 Sep 2022 22:29:50 -0400 Message-Id: <20220914022956.1359218-10-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: eBZ7UdFvaYUMylIneOftAcTluQuKvk1w X-Proofpoint-GUID: eBZ7UdFvaYUMylIneOftAcTluQuKvk1w X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 mlxscore=0 impostorscore=0 malwarescore=0 clxscore=1015 mlxlogscore=999 lowpriorityscore=0 adultscore=0 phishscore=0 bulkscore=0 spamscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Instead of assuming the file hash algorithm is a properly NULL terminated string, properly limit the "algo:" field size. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index 797fcef60506..9dfbb2373997 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1603,7 +1603,7 @@ void ima_ng_show(struct template_entry *entry) total_len -= sizeof(field_len); algo = (char *)fieldp; - len = strlen(algo) + 1; + len = strnlen(algo, field_len - 1) + 1; digest_len = field_len - len; digest = fieldp + len; From patchwork Wed Sep 14 02:29:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975504 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8ED74C54EE9 for ; Wed, 14 Sep 2022 02:30:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229863AbiINCaZ (ORCPT ); Tue, 13 Sep 2022 22:30:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34326 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229833AbiINCaV (ORCPT ); Tue, 13 Sep 2022 22:30:21 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0647F422DB for ; Tue, 13 Sep 2022 19:30:19 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E2N6rw012539; Wed, 14 Sep 2022 02:30:16 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=vFzrvy6J8AxzpUCFd4MxvVPUHJ0f5ocdHDnZ0khOy9A=; b=I1yZ5K0secVljaduwYoHiYBP6UzECSB/XkLizKwmf8odozBVlfPoSNdoDqaN3Q0GUUnJ 1JUaGRaEa+BJDJBXkrURMsLYW5PaLNIYtdQXh1qJk/9iIj4kYhGKs6Y2XWfnNU0Fzqb7 Ux1AFWdX/PHtT7HTA9T9Ig7oyi7Nynu7MM0uvssRNFkokeHaNRPOdbGB+djfTYslEy6o pf0V9z1Y4yzz6k3syy8qyq8yvSXiuf718L9gaUIWbXNqwV0rZPWdicQCgWPWdTwzU/fD 6LTMhOsunw5doRQgZ376BQF0C+g8kPPYu0DimVrZePuiCfpuyW2AbT44YLuGnp9+Ewib Zw== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk64fr3j6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:15 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2LTmS006611; Wed, 14 Sep 2022 02:30:13 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma06fra.de.ibm.com with ESMTP id 3jjymmr82f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:13 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2UAR535586420 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:10 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 83E9EA4040; Wed, 14 Sep 2022 02:30:10 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C08EAA404D; Wed, 14 Sep 2022 02:30:09 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:09 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 10/15] Missing template data size lower bounds checking Date: Tue, 13 Sep 2022 22:29:51 -0400 Message-Id: <20220914022956.1359218-11-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: zn1OVSRdpR11HsomMnFKsQFAva8aPcqc X-Proofpoint-ORIG-GUID: zn1OVSRdpR11HsomMnFKsQFAva8aPcqc X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 impostorscore=0 mlxscore=0 lowpriorityscore=0 mlxlogscore=999 clxscore=1015 adultscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Each record in the IMA measurement list must contain some template data. Ensure the template data is not zero length. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index 9dfbb2373997..d3f8eac26362 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2189,6 +2189,10 @@ static int ima_measurement(const char *file) log_err("Unable to read template length\n"); goto out; } + if (entry.template_len == 0) { + log_err("Invalid template data len\n"); + goto out; + } } else { entry.template_len = SHA_DIGEST_LENGTH + TCG_EVENT_NAME_LEN_MAX + 1; From patchwork Wed Sep 14 02:29:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975505 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10017ECAAD8 for ; Wed, 14 Sep 2022 02:30:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229945AbiINCaZ (ORCPT ); Tue, 13 Sep 2022 22:30:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34328 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229837AbiINCaV (ORCPT ); Tue, 13 Sep 2022 22:30:21 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 631D24456C for ; Tue, 13 Sep 2022 19:30:20 -0700 (PDT) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E2N9pe027474; Wed, 14 Sep 2022 02:30:16 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=rYx+eMoMXrV5E44DACZM2X+Jbq59hAzPBtDTSrz0EQs=; b=g0hObpNQGYOHKb2or1FDrO3wE8zOngoV7DRmkM+WD4+/0Nw5R0voVQ+o+DClX7tq+KdY 9D96oXdd3i8hFGdz7t1b/RIJbK4JZoa+z/fjF9upTbsIWvN9or+/CLysbcJhhocndLNx +kblsTMDkTgGN+xeAebQz/QKuq/bv72JwTIp4wz1n5IeE9fTg1p26d6JpLKpiaJmSjlq 0RMnhFtOaSbFvjzRGiT6t+eo0x1H2qPc72nxWwo3oq4Dzwf47/Db/7/Dp6eR5aD8dPI+ FKC2xA0ykk13kIT9bDEgPqeEl9TnjGLkfZ+A7qhNcMz73hYcXUqhQlHgwcW3pn5Vr22X RA== Received: from ppma04fra.de.ibm.com (6a.4a.5195.ip4.static.sl-reverse.com [149.81.74.106]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk64jr4bw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:16 +0000 Received: from pps.filterd (ppma04fra.de.ibm.com [127.0.0.1]) by ppma04fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2L6m7001677; Wed, 14 Sep 2022 02:30:14 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma04fra.de.ibm.com with ESMTP id 3jjy2n08wx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:14 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2UBtr36045082 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:11 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 73D1BA404D; Wed, 14 Sep 2022 02:30:11 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B27EFA4040; Wed, 14 Sep 2022 02:30:10 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:10 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 11/15] Limit configuring OpenSSL engine support Date: Tue, 13 Sep 2022 22:29:52 -0400 Message-Id: <20220914022956.1359218-12-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: NIYCWCptoFc1Iu1AB2l8ikGzVE1lv0L7 X-Proofpoint-ORIG-GUID: NIYCWCptoFc1Iu1AB2l8ikGzVE1lv0L7 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 impostorscore=0 mlxscore=0 mlxlogscore=926 bulkscore=0 suspectscore=0 spamscore=0 priorityscore=1501 clxscore=1015 lowpriorityscore=0 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org If either OPENSSL_NO_DYNAMIC_ENGINE or OPENSSL_NO_ENGINE is defined, ima-evm-utils cannot be built with OpenSSL engine support. Disable engine support. Suggested-by: Vitaly Chikunov Fixes: 9e08e4495f24 ("Disable use of OpenSSL "engine" support") Signed-off-by: Mimi Zohar --- src/imaevm.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/imaevm.h b/src/imaevm.h index ebe8c20d566a..8114bd051514 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -52,6 +52,10 @@ #include #endif +#if defined(OPENSSL_NO_ENGINE) || defined(OPENSSL_NO_DYNAMIC_ENGINE) +#undef CONFIG_ENGINE +#endif + #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ ({ if (level <= imaevm_params.verbose) fprintf(stderr, fmt, ##args); }) From patchwork Wed Sep 14 02:29:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975507 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC36BC6FA8B for ; Wed, 14 Sep 2022 02:30:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229638AbiINCa1 (ORCPT ); Tue, 13 Sep 2022 22:30:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34366 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229691AbiINCaW (ORCPT ); Tue, 13 Sep 2022 22:30:22 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E25C145057 for ; Tue, 13 Sep 2022 19:30:21 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E1qitf006698; Wed, 14 Sep 2022 02:30:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=1B+UvNZ3diN79woVNl/H/fdOz1YLNIgz4tJ2otKm5MY=; b=pn+99wx2tewkw0zZS57+XITxywa2XG66R82aZGrtlKFpqCNkneXTisjOFSi8LAKQ45OS kJeH1wHvtdXlSD7Dulm0UyAZEuAxKfRC0hQ7RJUA9QxblODZibCcaJwoZOZfI9QVEHqY 1L4Qd+fsncBuAu8raHOUrfoGUIn7E7ekxfD6VIa/eoVBCfYCUkfZOE8C2wvBrhFGz9Rn kzwc/GfcTIWiNO9ia9mGp/fKU6wVZJ/Q1ZAGaBSGNOm4Mepxlhfvn9ZhNHjWtOoCTWyv FXpt2uz/1pS18hSd6nKbgfV60L2crCiVBz61uu2Oykpv2Cy/TKJcNidEGJKgGgTiLAr2 ng== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk5pa0x1h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:17 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2KgRO025255; Wed, 14 Sep 2022 02:30:15 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma03ams.nl.ibm.com with ESMTP id 3jjy95rbv6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:15 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2UCYL41091336 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:12 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6378AA4051; Wed, 14 Sep 2022 02:30:12 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A25F1A4040; Wed, 14 Sep 2022 02:30:11 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:11 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 12/15] Base sm2/sm3 test on openssl version installed Date: Tue, 13 Sep 2022 22:29:53 -0400 Message-Id: <20220914022956.1359218-13-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: b3rPJ_dSsJrKRMkHAUZGY-Zsc7jCAKD6 X-Proofpoint-ORIG-GUID: b3rPJ_dSsJrKRMkHAUZGY-Zsc7jCAKD6 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 priorityscore=1501 mlxscore=0 mlxlogscore=999 lowpriorityscore=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 suspectscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Since the distros are now shipping with OpenSSL 3, no need to build it. Limit the sm2/sm3 test to OpenSSL 3. Signed-off-by: Mimi Zohar --- tests/sign_verify.test | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 6839896aa04b..3b3c9d792311 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -414,8 +414,8 @@ sign_verify prime256v1 sha384 0x030205:K:004[345678] sign_verify prime256v1 sha512 0x030206:K:004[345678] # If openssl 3.0 is installed, test the SM2/3 algorithm combination -if [ -x /opt/openssl3/bin/openssl ]; then - PATH=/opt/openssl3/bin:$PATH LD_LIBRARY_PATH=/opt/openssl3/lib \ +ssl_version=$(openssl version | sed -e 's/^OpenSSL //' | sed -e 's/ .*//') +if test "${ssl_version::1}" = "3"; then sign_verify sm2 sm3 0x030211:K:004[345678] fi From patchwork Wed Sep 14 02:29:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975508 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E7A1C6FA89 for ; Wed, 14 Sep 2022 02:30:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229691AbiINCa1 (ORCPT ); Tue, 13 Sep 2022 22:30:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34442 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229484AbiINCaY (ORCPT ); Tue, 13 Sep 2022 22:30:24 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5007245057 for ; Tue, 13 Sep 2022 19:30:23 -0700 (PDT) Received: from pps.filterd (m0187473.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E2Dl0P026766; Wed, 14 Sep 2022 02:30:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=drT64InxfTIATQKuCRL+GopbslNgDcvCaBLvhsbs44Y=; b=HADy8p5QciE7mN6I3mSOMg9QlfUaJpghAXP6Ooc39GwKZOvTidot4izYzXQ3dX26xQAf kcoJ1u6lM+41ng+jxH0tPFJWN84CRZPjWaU3hJXw3pO4YqGRCyqREzvdlsUWymjz9xsX 6auS9R3vHqF0VhiAJ/NsPnmefdovOFQjwzcFlUd3vdQlFNjK6docRkvlP3OKN7OYRRee 9W3CTJmsQnvsA484Bpm3qXdDurcNmuVBYl48FZzDgHYD8r5Ezt14b5GNh16favLDiaPB tWgs5gT22R2S2KDhnSSHomH6DT3UlHV5Xb5NQ79T+xWcaZoBKoYQk141S2U1MEWtQVGg 6A== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk605g9ps-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:18 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2KbpC026697; Wed, 14 Sep 2022 02:30:16 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma04ams.nl.ibm.com with ESMTP id 3jjytx0av1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:16 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2Ubbl18612718 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:37 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4956EA4055; Wed, 14 Sep 2022 02:30:13 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 918D8A404D; Wed, 14 Sep 2022 02:30:12 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:12 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 13/15] Compile a newer version of OpenSSL Date: Tue, 13 Sep 2022 22:29:54 -0400 Message-Id: <20220914022956.1359218-14-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: jPRyjCOBPSxNBHOpX_I_OnfhtQSg1kRE X-Proofpoint-GUID: jPRyjCOBPSxNBHOpX_I_OnfhtQSg1kRE X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 mlxscore=0 suspectscore=0 priorityscore=1501 spamscore=0 lowpriorityscore=0 clxscore=1015 phishscore=0 mlxlogscore=999 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org With the distros shipping OpenSSL 3 with engine support, the original purpose for compiling OpenSSL 3 to test sm2/sm3 is no longer necessary and could be removed. Or, it could be re-purposed for building OpenSSL without engine support, which is needed for testing. For both travis and github actions, update openssl-3.0.0-beta1 with openssl-3.0.5. Signed-off-by: Mimi Zohar --- .github/workflows/ci.yml | 6 +++--- .travis.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dc06fce64ba5..5595855512e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: ARCH: i386 TSS: tpm2-tss VARIANT: i386 - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 # cross compilation builds - container: "debian:stable" @@ -52,7 +52,7 @@ jobs: env: CC: clang TSS: ibmtss - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 - container: "opensuse/leap" env: @@ -63,7 +63,7 @@ jobs: env: CC: gcc TSS: ibmtss - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 - container: "ubuntu:xenial" env: diff --git a/.travis.yml b/.travis.yml index edd2a21b83d3..09db401928f6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -9,7 +9,7 @@ matrix: include: # 32 bit build - os: linux - env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss COMPILE_SSL=openssl-3.0.5 compiler: gcc # cross compilation builds @@ -32,7 +32,7 @@ matrix: # glibc (gcc/clang) - os: linux - env: DISTRO=opensuse/tumbleweed TSS=ibmtss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host" COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=opensuse/tumbleweed TSS=ibmtss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host" COMPILE_SSL=openssl-3.0.5 compiler: clang - os: linux @@ -40,7 +40,7 @@ matrix: compiler: gcc - os: linux - env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.5 compiler: gcc - os: linux From patchwork Wed Sep 14 02:29:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975510 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E0DFC54EE9 for ; Wed, 14 Sep 2022 02:30:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229837AbiINCa2 (ORCPT ); Tue, 13 Sep 2022 22:30:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229898AbiINCaZ (ORCPT ); Tue, 13 Sep 2022 22:30:25 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 379FC501BF for ; Tue, 13 Sep 2022 19:30:23 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E1qfPg006543; Wed, 14 Sep 2022 02:30:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=pHfyhfOua4HpxRTyzBCcVl8oaaFZ9UmCrfnjGPIS8I8=; b=JlhrBmjE/f+2A6ThjwPvyBGggdYlzr1LmnC35QT3HB/9EBfcT1BqCV6gsbxXYdWGICQN zF2JCdwuYmBAjSCgIOOPRv9ho1phhU8S/5R29oVMPayYmqiFWZejvXzo7oLPpxGOKu0l IssDG5+mWEs3ICDM4qfOyq5ODZ+KhNHwAgt5OjNSSATPe+NSCwU3KDOlu3fVZd9ndEx8 2wBm9d72lW63i0eXqXAXJ0aXFhbVmZw5+4MnErQYTfXj18wneNpnjAXWwaxGTEcaTWwk QorkpOBhbSgfYAzetFGP+l0nojwVjx54QyvmXXrLSTXDLHsGlSUNA24V0XM50TxPj0AR 5Q== Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk5pa0x2n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:19 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2MMxT000993; Wed, 14 Sep 2022 02:30:17 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma05fra.de.ibm.com with ESMTP id 3jjy9a08de-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:17 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2QTfK17498442 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:26:29 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3BA86A4055; Wed, 14 Sep 2022 02:30:14 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 78E81A404D; Wed, 14 Sep 2022 02:30:13 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:13 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 14/15] Build OpenSSL without engine support Date: Tue, 13 Sep 2022 22:29:55 -0400 Message-Id: <20220914022956.1359218-15-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: N-GG6qJj8IDKqtQNItuRTn76oFd_36xI X-Proofpoint-ORIG-GUID: N-GG6qJj8IDKqtQNItuRTn76oFd_36xI X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 priorityscore=1501 mlxscore=0 mlxlogscore=999 lowpriorityscore=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 suspectscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Fix COMPILE_SSL to build for the proper architecture, link with the appropriate library, and set up library path for evmctl. Compile OpenSSL with "no-engine" and "no-dynamic-engine" support. Signed-off-by: Mimi Zohar --- .github/workflows/ci.yml | 4 ++-- .travis.yml | 2 +- build.sh | 8 ++++++++ src/evmctl.c | 4 +++- tests/install-openssl3.sh | 9 ++++++++- 5 files changed, 22 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5595855512e4..8223b8767351 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -114,7 +114,7 @@ jobs: INSTALL="${INSTALL%%/*}" if [ "$VARIANT" ]; then ARCH="$ARCH" ./ci/$INSTALL.$VARIANT.sh; fi ARCH="$ARCH" CC="$CC" TSS="$TSS" ./ci/$INSTALL.sh - if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" ./tests/install-openssl3.sh; fi + if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" VARIANT="$VARIANT" ./tests/install-openssl3.sh; fi - name: Build swtpm run: | @@ -129,4 +129,4 @@ jobs: run: $CC --version - name: Compile - run: CC="$CC" VARIANT="$VARIANT" ./build.sh + run: CC="$CC" VARIANT="$VARIANT" COMPILE_SSL="$COMPILE_SSL" ./build.sh diff --git a/.travis.yml b/.travis.yml index 09db401928f6..faaa4b5d675b 100644 --- a/.travis.yml +++ b/.travis.yml @@ -95,4 +95,4 @@ script: - INSTALL="${DISTRO#${REPO}}" - INSTALL="${INSTALL%%:*}" - INSTALL="${INSTALL%%/*}" - - $CONTAINER run $CONTAINER_ARGS -t ima-evm-utils /bin/sh -c "if [ \"$VARIANT\" ]; then ARCH=\"$ARCH\" ./ci/$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./ci/$INSTALL.sh && if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" ./tests/install-openssl3.sh; fi && if [ ! \"$VARIANT\" ]; then which tpm_server || which swtpm || if which tssstartup; then ./tests/install-swtpm.sh; fi; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" ./build.sh" + - $CONTAINER run $CONTAINER_ARGS -t ima-evm-utils /bin/sh -c "if [ \"$VARIANT\" ]; then ARCH=\"$ARCH\" ./ci/$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./ci/$INSTALL.sh && if [ \"$COMPILE_SSL\" ]; then COMPILE_SSL=\"$COMPILE_SSL\" VARIANT=\"$VARIANT\" ./tests/install-openssl3.sh; fi && if [ ! \"$VARIANT\" ]; then which tpm_server || which swtpm || if which tssstartup; then ./tests/install-swtpm.sh; fi; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" COMPILE_SSL=\"$COMPILE_SSL\" ./build.sh" diff --git a/build.sh b/build.sh index c4d28f1302c6..0c2fdd9e995d 100755 --- a/build.sh +++ b/build.sh @@ -32,6 +32,14 @@ log_exit() cd `dirname $0` +if [ "$COMPILE_SSL" ]; then + echo "COMPILE_SSL: $COMPILE_SSL" + export CFLAGS="-I/opt/openssl3/include $CFLAGS" + export LD_LIBRARY_PATH="/opt/openssl3/lib64:/opt/openssl3/lib:$HOME/src/ima-evm-utils/src/.libs:$LD_LIBRARY_PATH" + export LDFLAGS="-L/opt/openssl3/lib64 -L/opt/openssl3/lib $LDFLAGS" + export PATH="/opt/openssl3/bin:$HOME/src/ima-evm-utils/src/.libs:$PATH" +fi + case "$VARIANT" in i386) echo "32-bit compilation" diff --git a/src/evmctl.c b/src/evmctl.c index d3f8eac26362..2e21da67c444 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2989,8 +2989,10 @@ int main(int argc, char *argv[]) #if CONFIG_ENGINE case 139: /* --engine e */ imaevm_params.eng = setup_engine(optarg); - if (!imaevm_params.eng) + if (!imaevm_params.eng) { + log_info("setup_engine failed\n"); goto error; + } break; #endif case 140: /* --xattr-user */ diff --git a/tests/install-openssl3.sh b/tests/install-openssl3.sh index 1b634681a760..911c32bcf87c 100755 --- a/tests/install-openssl3.sh +++ b/tests/install-openssl3.sh @@ -13,7 +13,14 @@ wget --no-check-certificate https://github.com/openssl/openssl/archive/refs/tags tar --no-same-owner -xzf ${version}.tar.gz cd openssl-${version} -./Configure --prefix=/opt/openssl3 --openssldir=/opt/openssl3/ssl +if [ "$VARIANT" = "i386" ]; then + echo "32-bit compilation" + FLAGS="-m32 linux-generic32" +fi + +./Configure $FLAGS no-engine no-dynamic-engine --prefix=/opt/openssl3 --openssldir=/opt/openssl3 +# Uncomment for debugging +# perl configdata.pm --dump | grep engine make -j$(nproc) # only install apps and library sudo make install_sw From patchwork Wed Sep 14 02:29:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12975509 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09B2BC6FA8D for ; Wed, 14 Sep 2022 02:30:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229484AbiINCa2 (ORCPT ); Tue, 13 Sep 2022 22:30:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34458 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229846AbiINCaZ (ORCPT ); Tue, 13 Sep 2022 22:30:25 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07EBA51A02 for ; Tue, 13 Sep 2022 19:30:23 -0700 (PDT) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 28E1Ipf6032068; Wed, 14 Sep 2022 02:30:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=k1ezI43RjQMiDMDS10MXydcAdQFfueOvwdZ34Zexh/M=; b=IXPqsLBOfuX8TTePYFsXuY92Q6CVyMqCyMPTjL5+LF8eym9wE3bSsbxlsL+OeRlwkXy2 5mtxIDIyID7VC2oGr1L+tytkY/9uggq9B3RCKDzqkBfTk6SnUBsBjTjsaaWQXssBAlsU Kmpeqr+loj5iu3B3b/vUKH7W4IAJlpJ+JYYRlpuVZZq4BuQGRpAQjENjnB/bT2wCQ/S0 tw/ZbS9UZLwQGBERj52z/zabIeDr/Ykf3ZFAHD08vN5liv88oPh0y9kuiE41keUwc+OC oT+YUGUIk8oii84yrcpdcyif0bIvD1eAAgnpith6QGpMPswGl6PhnXgkZ6YyRKb7Pl7/ Aw== Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3jk56e1q01-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:20 +0000 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 28E2M73X028229; Wed, 14 Sep 2022 02:30:18 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma06ams.nl.ibm.com with ESMTP id 3jjyfr8bfj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Sep 2022 02:30:18 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 28E2UFaD39453072 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 14 Sep 2022 02:30:15 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3514DA4040; Wed, 14 Sep 2022 02:30:15 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 69495A404D; Wed, 14 Sep 2022 02:30:14 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.29.234]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 14 Sep 2022 02:30:14 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v3 15/15] Fix d2i_x509_fp failure Date: Tue, 13 Sep 2022 22:29:56 -0400 Message-Id: <20220914022956.1359218-16-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220914022956.1359218-1-zohar@linux.ibm.com> References: <20220914022956.1359218-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: WvaMjI3eWmIZ8l7WE_OoOBRnmEY6U5I9 X-Proofpoint-GUID: WvaMjI3eWmIZ8l7WE_OoOBRnmEY6U5I9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1 definitions=2022-09-13_12,2022-09-13_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 phishscore=0 priorityscore=1501 mlxlogscore=950 impostorscore=0 malwarescore=0 clxscore=1015 mlxscore=0 suspectscore=0 lowpriorityscore=0 spamscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000 definitions=main-2209140008 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Before calling d2i_x509_fp(), make sure the keyfile is a regular file. Signed-off-by: Mimi Zohar --- src/libimaevm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/libimaevm.c b/src/libimaevm.c index 5d05f1bc1720..7adfa2101373 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -251,6 +251,7 @@ EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) { FILE *fp; EVP_PKEY *pkey = NULL; + struct stat st; if (!keyfile) return NULL; @@ -264,6 +265,16 @@ EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) } if (x509) { + if (fstat(fileno(fp), &st) == -1) + goto out; + + if ((st.st_mode & S_IFMT) != S_IFREG) { + if (imaevm_params.verbose > LOG_INFO) + log_err("Keyfile is not regular file: %s\n", + keyfile); + goto out; + } + X509 *crt = d2i_X509_fp(fp, NULL); if (!crt) {