From patchwork Thu Nov 3 18:38:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030841 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE082C433FE for ; Thu, 3 Nov 2022 18:39:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230089AbiKCSjZ (ORCPT ); Thu, 3 Nov 2022 14:39:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230183AbiKCSjY (ORCPT ); Thu, 3 Nov 2022 14:39:24 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28EB62638 for ; Thu, 3 Nov 2022 11:39:23 -0700 (PDT) Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IURVK001890; Thu, 3 Nov 2022 18:39:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=qxq90qBrR9pOtJArpqU39kMaPYesIl3zkGw8+LLsPUI=; b=JmFpU4y1Jg7QiVo9fhrcqriiHaeZW1LjGED+oyrn9DmjuhvpFuCOcpk5mrsAJSfB9v6Z L/ZIbdkWh43b7THb/SWBMtlmSxWsxv8r6MMcXh80Ovv7ZwSWOryWGKqxWz5v3X/0bIqZ rVneZkmePWuCqLDYv+kap3Vm8CTxgof96BhFMRVp/opE5YCFNHHA0i4ucvNguQL8sIw5 jscGfBW4rczXu6L9upfDwLLfv99BKDjeUI/j7fmn0cbZf3Gh2+D+78KLAl2AgbOsDGpb bArPz/GA7P3mbPsjR7zyNo3ncqSWeVokn1EXn2xVjh2LA18HRW40yhVVBRSwbiHmULvH Yw== Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kme7ykxjx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:18 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IZKlK019052; Thu, 3 Nov 2022 18:39:16 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma05fra.de.ibm.com with ESMTP id 3kjepecp98-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:16 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdnQm43778526 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:49 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C799A42042; Thu, 3 Nov 2022 18:39:12 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 17C2D4203F; Thu, 3 Nov 2022 18:39:12 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:11 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 01/17] Revert "Reset 'errno' after failure to open or access a file" Date: Thu, 3 Nov 2022 14:38:48 -0400 Message-Id: <20221103183904.103562-2-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 4tjzSz2ySt6_u-NNNJzAh-Op0YAHKm18 X-Proofpoint-ORIG-GUID: 4tjzSz2ySt6_u-NNNJzAh-Op0YAHKm18 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 adultscore=0 spamscore=0 impostorscore=0 phishscore=0 clxscore=1015 bulkscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org This reverts commit acb19d1894a4a95471b8d2346cd6c3ecf3385110. Signed-off-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Petr Vorel Reviewed-by: Petr Vorel --- src/evmctl.c | 18 ++---------------- src/libimaevm.c | 4 ---- 2 files changed, 2 insertions(+), 20 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 76e2561798fa..0412bc0ac2b0 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -182,7 +182,6 @@ static int bin2file(const char *file, const char *ext, const unsigned char *data fp = fopen(name, "w"); if (!fp) { log_err("Failed to open: %s\n", name); - errno = 0; return -1; } err = fwrite(data, len, 1, fp); @@ -208,7 +207,6 @@ static unsigned char *file2bin(const char *file, const char *ext, int *size) fp = fopen(name, "r"); if (!fp) { log_err("Failed to open: %s\n", name); - errno = 0; return NULL; } if (fstat(fileno(fp), &stats) == -1) { @@ -315,10 +313,8 @@ static int get_uuid(struct stat *st, char *uuid) sprintf(path, "blkid -s UUID -o value /dev/block/%u:%u", major, minor); fp = popen(path, "r"); - if (!fp) { - errno = 0; + if (!fp) goto err; - } len = fread(_uuid, 1, sizeof(_uuid), fp); pclose(fp); @@ -375,7 +371,6 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (fd < 0) { log_err("Failed to open: %s\n", file); - errno = 0; return -1; } if (ioctl(fd, FS_IOC_GETVERSION, &generation)) { @@ -1201,7 +1196,6 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h if (fd < 0) { log_err("Failed to open %s\n", file); - errno = 0; goto out; } if (ioctl(fd, FS_IOC_GETVERSION, &generation)) { @@ -1392,7 +1386,6 @@ static int ima_fix(const char *path) fd = open(path, O_RDONLY); if (fd < 0) { log_errno("Failed to open file: %s", path); - errno = 0; return -1; } @@ -1916,10 +1909,8 @@ static int read_sysfs_pcrs(int num_banks, struct tpm_bank_info *tpm_banks) int i, result; fp = fopen(pcrs, "r"); - if (!fp) { + if (!fp) fp = fopen(misc_pcrs, "r"); - errno = 0; - } if (!fp) return -1; @@ -1982,7 +1973,6 @@ static int read_file_pcrs(int num_banks, struct tpm_bank_info *tpm_banks) fp = fopen(path, "r"); if (!fp) { log_err("Could not open '%s'\n", path); - errno = 0; return -1; } @@ -2075,7 +2065,6 @@ static int ima_measurement(const char *file) fp = fopen(file, "rb"); if (!fp) { log_err("Failed to open measurement file: %s\n", file); - errno = 0; return -1; } @@ -2321,7 +2310,6 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) fp = fopen(file, "r"); if (!fp) { log_errno("Failed to open TPM 1.2 event log.\n"); - errno = 0; return 1; } @@ -2758,8 +2746,6 @@ int main(int argc, char *argv[]) unsigned long keyid; char *eptr; - errno = 0; /* initialize errno */ - #if !(OPENSSL_VERSION_NUMBER < 0x10100000) OPENSSL_init_crypto( #ifndef DISABLE_OPENSSL_CONF diff --git a/src/libimaevm.c b/src/libimaevm.c index e4b62b4989b2..611631c57f14 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -144,7 +144,6 @@ static int add_file_hash(const char *file, EVP_MD_CTX *ctx) fp = fopen(file, "r"); if (!fp) { log_err("Failed to open: %s\n", file); - errno = 0; return -1; } @@ -259,7 +258,6 @@ EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) if (!fp) { if (imaevm_params.verbose > LOG_INFO) log_info("Failed to open keyfile: %s\n", keyfile); - errno = 0; return NULL; } @@ -878,7 +876,6 @@ static int read_keyid_from_cert(uint32_t *keyid_be, const char *certfile, int tr if (!(fp = fopen(certfile, "r"))) { log_err("Cannot open %s: %s\n", certfile, strerror(errno)); - errno = 0; return -1; } if (!PEM_read_X509(fp, &x, NULL, NULL)) { @@ -970,7 +967,6 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) fp = fopen(keyfile, "r"); if (!fp) { log_err("Failed to open keyfile: %s\n", keyfile); - errno = 0; return NULL; } pkey = PEM_read_PrivateKey(fp, NULL, NULL, (void *)keypass); From patchwork Thu Nov 3 18:38:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030840 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13BC7C4332F for ; Thu, 3 Nov 2022 18:39:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229445AbiKCSjZ (ORCPT ); Thu, 3 Nov 2022 14:39:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230089AbiKCSjY (ORCPT ); Thu, 3 Nov 2022 14:39:24 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4CA152DE7 for ; Thu, 3 Nov 2022 11:39:23 -0700 (PDT) Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IAUYk026995; Thu, 3 Nov 2022 18:39:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=VZiTnDEE4sThFcQnHekhpoTB+Lipx63Bf2mxNtmEOh8=; b=OGdt8UuzYgf66pPKq5is9eTvvDxbuC/4w8oAsg+ZVVrmKATVuZYr1PqgC41rbyIO0hjq XVDjsOy6sNxq/6+WuNj/6T9v+nRfETJF79J2C0tV9DFo/kZtMOaESrHN6/AIjnNjLZSF vHi6lpoXc1RP28c5rPJThN9fJi+8CIWletx1yrc+StuvVwM2j3bKyRh0HWWm6ZJ8fGjb hP9/otRqBa/DmuwOg258FZkX13Z//RvRK7e0TLRzQXFXKQXRDneLNyr9TJg1IvTxOw9F dkjtNw0R1vdzAgt0G0ZAehkYRs/QHryhEKst9uEPnSCzoDqpoSQxsgi+znbgaVCSlBBm vA== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmfxyyr97-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:18 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3Iapqq005420; Thu, 3 Nov 2022 18:39:17 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9974k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:16 +0000 Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IXfRl50004404 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:33:41 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DA4A04203F; Thu, 3 Nov 2022 18:39:13 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 022D742042; Thu, 3 Nov 2022 18:39:13 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:12 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 02/17] log and reset 'errno' after failure to open non-critical files Date: Thu, 3 Nov 2022 14:38:49 -0400 Message-Id: <20221103183904.103562-3-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: nD8GvXotgowX1yuIG0ssvbff8Eepu3E- X-Proofpoint-ORIG-GUID: nD8GvXotgowX1yuIG0ssvbff8Eepu3E- X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 suspectscore=0 lowpriorityscore=0 bulkscore=0 phishscore=0 adultscore=0 priorityscore=1501 malwarescore=0 impostorscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Define a log_errno_reset macro to emit the errno string at or near the time of error, similar to the existing log_errno macro, but also reset errno to avoid dangling or duplicate errno messages on exit. The initial usage is for non-critical file open failures. Suggested-by: Vitaly Chikunov Signed-off-by: Mimi Zohar Reviewed-by: Vitaly Chikunov Reviewed-by: Petr Vorel --- src/evmctl.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 0412bc0ac2b0..54123bf20f03 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -166,6 +166,9 @@ struct tpm_bank_info { static char *pcrfile[MAX_PCRFILE]; static unsigned npcrfile; +#define log_errno_reset(level, fmt, args...) \ + {do_log(level, fmt " (errno: %s)\n", ##args, strerror(errno)); errno = 0; } + static int bin2file(const char *file, const char *ext, const unsigned char *data, int len) { FILE *fp; @@ -1911,8 +1914,10 @@ static int read_sysfs_pcrs(int num_banks, struct tpm_bank_info *tpm_banks) fp = fopen(pcrs, "r"); if (!fp) fp = fopen(misc_pcrs, "r"); - if (!fp) + if (!fp) { + log_errno_reset(LOG_DEBUG, "Failed to read TPM 1.2 PCRs"); return -1; + } result = read_one_bank(&tpm_banks[0], fp); fclose(fp); @@ -2055,7 +2060,6 @@ static int ima_measurement(const char *file) int err_padded = -1; int err = -1; - errno = 0; memset(zero, 0, MAX_DIGEST_SIZE); pseudo_padded_banks = init_tpm_banks(&num_banks); @@ -2072,6 +2076,8 @@ static int ima_measurement(const char *file) init_public_keys(imaevm_params.keyfile); else /* assume read pubkey from x509 cert */ init_public_keys("/etc/keys/x509_evm.der"); + if (errno) + log_errno_reset(LOG_DEBUG, "Failed to initialize public keys"); /* * Reading the PCRs before walking the IMA measurement list @@ -2746,6 +2752,8 @@ int main(int argc, char *argv[]) unsigned long keyid; char *eptr; + errno = 0; /* initialize global errno */ + #if !(OPENSSL_VERSION_NUMBER < 0x10100000) OPENSSL_init_crypto( #ifndef DISABLE_OPENSSL_CONF From patchwork Thu Nov 3 18:38:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030843 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2DA4C43217 for ; Thu, 3 Nov 2022 18:39:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230183AbiKCSj0 (ORCPT ); Thu, 3 Nov 2022 14:39:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36928 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230244AbiKCSjZ (ORCPT ); Thu, 3 Nov 2022 14:39:25 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0973B2638 for ; Thu, 3 Nov 2022 11:39:25 -0700 (PDT) Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3I4OXT030520; Thu, 3 Nov 2022 18:39:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=n/JiJBLrPuaClsy5G+OlJVO7MQUePKn8+v2ekw+9h88=; b=NsdXckT04AyCP0vLPllnr8lKFBVSRt/f/DLUMhKs1jemxaHcS3AmQoO/Da987BnHPyOD b0IH3bkZ75PUUgag2unU49k0i7ktxWiLh/Xy1mKGZCHWf6JZwc/Yd7pQcijubeZyrnmg k6a5S9gss+H7OUsokN34yobHdJIvWKNAgG0X7Vd0kcJ64CVHVo7cjtKVxPeT2N09+VJt kdAaJOH+WaG1fNXcqwaRxgNQy1t8qDOPOHbTGK0kEnL2uk9GAgmXLcV2w1w3Kwlg0CBh rlpv/0yjKQIH5bdi8Xw08eufGVK0/1WBjpvtT0Vt8u35PZ7Ofv6INaFjiaVUYGsUyWHJ tA== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmcac11gm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:20 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IbCjl005474; Thu, 3 Nov 2022 18:39:18 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9974n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:18 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdF0619137278 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:15 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1A61F42045; Thu, 3 Nov 2022 18:39:15 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 14D2E4203F; Thu, 3 Nov 2022 18:39:14 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:13 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 03/17] Log and reset 'errno' on lsetxattr failure Date: Thu, 3 Nov 2022 14:38:50 -0400 Message-Id: <20221103183904.103562-4-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: _OZIWl6NGeqCvgneIX2q1fFES2WCWID3 X-Proofpoint-GUID: _OZIWl6NGeqCvgneIX2q1fFES2WCWID3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 priorityscore=1501 malwarescore=0 lowpriorityscore=0 suspectscore=0 phishscore=0 impostorscore=0 adultscore=0 mlxscore=0 mlxlogscore=949 spamscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Writing either security.ima hashes or security.evm hmacs from userspace will fail regardless of the IMA or EVM fix mode. In fix mode, 'touch' will force security.ima and security.evm to be updated. Make the setxattr error messages more explicit and clear errno. Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 54123bf20f03..53af4d2cb961 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -572,7 +572,8 @@ static int sign_evm(const char *file, const char *key) if (xattr) { err = lsetxattr(file, xattr_evm, sig, len, 0); if (err < 0) { - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, "Setting EVM xattr failed: %s", + file); return err; } } @@ -615,7 +616,9 @@ static int hash_ima(const char *file) if (xattr) { err = lsetxattr(file, xattr_ima, hash, len, 0); if (err < 0) { - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, + "Setting IMA hash xattr failed: %s", + file); return err; } } @@ -652,7 +655,9 @@ static int sign_ima(const char *file, const char *key) if (xattr) { err = lsetxattr(file, xattr_ima, sig, len, 0); if (err < 0) { - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, + "Setting IMA sig xattr failed: %s", + file); return err; } } @@ -1125,7 +1130,8 @@ static int setxattr_ima(const char *file, char *sig_file) err = lsetxattr(file, xattr_ima, sig, len, 0); if (err < 0) - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, "Setting IMA sig xattr failed: %s", + file); free(sig); return err; } @@ -1323,7 +1329,9 @@ static int hmac_evm(const char *file, const char *key) sig[0] = EVM_XATTR_HMAC; err = lsetxattr(file, xattr_evm, sig, len + 1, 0); if (err < 0) { - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, + "Setting EVM hmac xattr failed: %s", + file); return err; } } From patchwork Thu Nov 3 18:38:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030842 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44889C43219 for ; Thu, 3 Nov 2022 18:39:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230187AbiKCSj1 (ORCPT ); Thu, 3 Nov 2022 14:39:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230262AbiKCSj0 (ORCPT ); Thu, 3 Nov 2022 14:39:26 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 890122DE7 for ; Thu, 3 Nov 2022 11:39:25 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IJ5dl020806; Thu, 3 Nov 2022 18:39:22 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=Y//fm9Dgzbk+PFjbKzqhMOboUHD60qTJUUpmKo88SPU=; b=EF7M6i/iINR+H076B8ugi/ZwbT1Ip8K1PkU1w4XE3cfGI50cSkKV4drlHFUVc9SyO3Ge tehu7GuMZ//Pu/dyeN45ttXeK2qtvu+tUKiZGUl7qq4pymY7w60jDbuGQB1jsuDhE9WA 462svcdj7TK3grHX1RU6keUG/o8QX2bE9EYsOYPcQ0kRORJSKlWXywJtj508NWT3obyd tUGJUB2yR+9wnwTNwiliDvNZuThTFp1P4z2ZtC6T3p0NF5FJzTFOyVv7QRLeXXYkyAzj NyndaEimAeDlJODedxjllaY+gG8W9KvEd4bN13HuOmNeorRLuiLWQFK3/FnDJ8bT7usS Uw== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmfr0s2gm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:21 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IZuS3019577; Thu, 3 Nov 2022 18:39:19 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma03ams.nl.ibm.com with ESMTP id 3kgut918e7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:19 +0000 Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdGXI7865012 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:16 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5875E42041; Thu, 3 Nov 2022 18:39:16 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 93C614203F; Thu, 3 Nov 2022 18:39:15 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:15 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 04/17] travis: update dist=focal Date: Thu, 3 Nov 2022 14:38:51 -0400 Message-Id: <20221103183904.103562-5-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 25V7L5af-tCc8u-QanK9aK2T7mmO6C9a X-Proofpoint-ORIG-GUID: 25V7L5af-tCc8u-QanK9aK2T7mmO6C9a X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 spamscore=0 bulkscore=0 phishscore=0 mlxscore=0 suspectscore=0 priorityscore=1501 malwarescore=0 adultscore=0 clxscore=1015 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Although Github Actions is available on Github Enterprise Server 3.x single server edition, as well as the unpaid version, it is not available in Github Enterprise Server 3.x cluster edition[1]. Continue updating travis.yml. [1] https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#github-packages Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 5741116e418a..edd2a21b83d3 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,6 @@ # Copyright (c) 2017-2021 Petr Vorel -dist: bionic +dist: focal language: C services: - docker From patchwork Thu Nov 3 18:38:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030850 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7122C43219 for ; Thu, 3 Nov 2022 18:39:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230244AbiKCSjb (ORCPT ); Thu, 3 Nov 2022 14:39:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230295AbiKCSj2 (ORCPT ); Thu, 3 Nov 2022 14:39:28 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0A6292638 for ; Thu, 3 Nov 2022 11:39:28 -0700 (PDT) Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3HObpq029608; Thu, 3 Nov 2022 18:39:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=bniy1ulIUzo3NXXzZuvQMD4AY5vSfcSUm9l7WXv7ZwA=; b=ZOOIREhB7PXzd73kPWTAVc8BE2Zel0r5tXvwIi3GRAu40Ca3yiefvjih/gaymof6KRZy Nr9imbgbGti+5lSi+LiSZfL97KTZlHTniTj4/SE0cHilIHtkcHf7LoID9FLEVTlk4GB1 U8nTSIwQy9sEVRSfCOaHPctVONV8aCdEmoDiCNwjwnM+H0W5onGzNYjVw62wZIRA6V5e k2gXI1g0gIYtNA75FSv6BW+CTAZXeV4bdC/L9i+k3qmi+4tKKYQR6uVACqdUgfvhJke2 aGHZsVC0e+xJY7LbOSo4UcBFv+oKooGCEwoHtPssU/aLq8ru6s9R/AiZd8Tqrf2n1hhn 8A== Received: from ppma04fra.de.ibm.com (6a.4a.5195.ip4.static.sl-reverse.com [149.81.74.106]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kme7ykxn3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:23 +0000 Received: from pps.filterd (ppma04fra.de.ibm.com [127.0.0.1]) by ppma04fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3Ia7m4025079; Thu, 3 Nov 2022 18:39:20 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma04fra.de.ibm.com with ESMTP id 3kgut8xw2t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:20 +0000 Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdHXr5374504 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:17 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 46D0742042; Thu, 3 Nov 2022 18:39:17 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 86C4942041; Thu, 3 Nov 2022 18:39:16 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:16 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 05/17] Update configure.ac to address a couple of obsolete warnings Date: Thu, 3 Nov 2022 14:38:52 -0400 Message-Id: <20221103183904.103562-6-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: L5eVPKMzEd7zSqy8HRHm1zcyheufxMwD X-Proofpoint-ORIG-GUID: L5eVPKMzEd7zSqy8HRHm1zcyheufxMwD X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 adultscore=0 spamscore=0 impostorscore=0 phishscore=0 clxscore=1015 bulkscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Remove AC_PROG_LIBTOOL and AC_HEAD_STDC. Replace AC_HELP_STRING with AS_HELP_STRING. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- acinclude.m4 | 2 +- configure.ac | 4 ---- m4/manpage-docbook-xsl.m4 | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/acinclude.m4 b/acinclude.m4 index dd430d4f0565..bb962f81a9c0 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -2,7 +2,7 @@ AC_DEFUN([PKG_ARG_ENABLE], [ AC_MSG_CHECKING(whether to enable $1) - AC_ARG_ENABLE([$1], AC_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), + AC_ARG_ENABLE([$1], AS_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), [pkg_cv_enable_$1=$enableval], [AC_CACHE_VAL([pkg_cv_enable_$1], [pkg_cv_enable_$1=$2])]) if test $pkg_cv_enable_$1 = yes; then diff --git a/configure.ac b/configure.ac index 1a0f093df562..9d3b23ff8def 100644 --- a/configure.ac +++ b/configure.ac @@ -15,16 +15,12 @@ AM_PROG_CC_C_O #AC_PROG_CXX #AC_PROG_CPP AC_PROG_INSTALL -AC_PROG_LIBTOOL #AC_PROG_LN_S LT_INIT # FIXME: Replace `main' with a function in `-lpthread': #AC_CHECK_LIB([pthread], [main]) -# Checks for header files. -AC_HEADER_STDC - PKG_CHECK_MODULES(LIBCRYPTO, [libcrypto >= 0.9.8 ]) AC_SUBST(KERNEL_HEADERS) AC_CHECK_HEADER(unistd.h) diff --git a/m4/manpage-docbook-xsl.m4 b/m4/manpage-docbook-xsl.m4 index 25c8ce54b068..f2ee912ed1be 100644 --- a/m4/manpage-docbook-xsl.m4 +++ b/m4/manpage-docbook-xsl.m4 @@ -7,7 +7,7 @@ AC_DEFUN([EVMCTL_MANPAGE_DOCBOOK_XSL], [ AC_PATH_PROGS(XMLCATALOG, xmlcatalog) AC_ARG_WITH([xml-catalog], - AC_HELP_STRING([--with-xml-catalog=CATALOG], + AS_HELP_STRING([--with-xml-catalog=CATALOG], [path to xml catalog to use]),, [with_xml_catalog=/etc/xml/catalog]) XML_CATALOG_FILE="$with_xml_catalog" From patchwork Thu Nov 3 18:38:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030845 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 831C7C4332F for ; Thu, 3 Nov 2022 18:39:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230324AbiKCSja (ORCPT ); Thu, 3 Nov 2022 14:39:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36944 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230244AbiKCSj2 (ORCPT ); Thu, 3 Nov 2022 14:39:28 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 100EA100 for ; Thu, 3 Nov 2022 11:39:27 -0700 (PDT) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3ILNDW001178; Thu, 3 Nov 2022 18:39:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=6IVDMobT2NnrgRjuuPS3ER41B25HTwj+Rp5F8yJbL7E=; b=MUV2aBOpgDFueqWvk/DxJnEHRnm3fLBdgdgj/gOe2zbNL9MJ6OdFa/dlNwDnkymrRGyk z7hOlL+h8YKa8kYAgBLPpMhevnNfVoi3K1Fo/Emtrbnmt9ICxh9lTrJJfqJai3J86DAI pd9QM+/1CFfTB4dN/QJ1m2xH06lNiuPx3I6aALaZ4Wv92muNvP4CYezY9AwhASYdhGZg rQvo0B7DHQzFNC0Zu5kONON9KkmHsr2srD4BTbq8LcsFZluBuJT4b5dwKrNKzoSxxmon 9yBQTPlOv1wGTY/czsZTVP7+NHf/6V8UNKisKOaLAYdtrbPOCBKRQm2CRQshrNKEoaId Gg== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmemwtukt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:23 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IbQAf005507; Thu, 3 Nov 2022 18:39:21 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9974t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:21 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdIME57409896 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:18 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4FE7342042; Thu, 3 Nov 2022 18:39:18 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 767E44203F; Thu, 3 Nov 2022 18:39:17 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:17 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 06/17] Deprecate IMA signature version 1 Date: Thu, 3 Nov 2022 14:38:53 -0400 Message-Id: <20221103183904.103562-7-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: c_tFEuoAXYlr37wUn9ShYEJBT2BevCmr X-Proofpoint-GUID: c_tFEuoAXYlr37wUn9ShYEJBT2BevCmr X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 phishscore=0 impostorscore=0 adultscore=0 bulkscore=0 priorityscore=1501 clxscore=1015 spamscore=0 lowpriorityscore=0 mlxlogscore=999 suspectscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The original IMA file signatures were based on a SHA1 hash. Kernel support for other hash algorithms was subsequently upstreamed. Deprecate "--rsa" support. Define "--enable-sigv1" option to configure signature v1 support. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- configure.ac | 6 ++++++ src/Makefile.am | 10 ++++++++++ src/evmctl.c | 20 ++++++++++++++++---- src/libimaevm.c | 22 +++++++++++++++++++--- tests/sign_verify.test | 21 +++++++++++++++------ 5 files changed, 66 insertions(+), 13 deletions(-) diff --git a/configure.ac b/configure.ac index 9d3b23ff8def..dc666f2bb1fa 100644 --- a/configure.ac +++ b/configure.ac @@ -49,6 +49,11 @@ AC_ARG_ENABLE([openssl_conf], AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by evmctl.]) fi], [enable_openssl_conf=yes]) +AC_ARG_ENABLE(sigv1, + AS_HELP_STRING([--enable-sigv1], [Build ima-evm-utils with signature v1 support])) + AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) + AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -83,5 +88,6 @@ echo " openssl-conf: $enable_openssl_conf" echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" +echo " sigv1: $enable_sigv1" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 396496bb439d..90c7249020cf 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -7,6 +7,10 @@ libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) libimaevm_la_LDFLAGS = -version-info 3:0:0 libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS) +if CONFIG_SIGV1 +libimaevm_la_CFLAGS = -DCONFIG_SIGV1 +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -22,6 +26,12 @@ evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) evmctl_LDFLAGS = $(LDFLAGS_READLINE) evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la +# Enable IMA signature version 1 +if CONFIG_SIGV1 +evmctl_CFLAGS = -DCONFIG_SIGV1 +endif + + # USE_PCRTSS uses the Intel TSS if USE_PCRTSS evmctl_SOURCES += pcr_tss.c diff --git a/src/evmctl.c b/src/evmctl.c index 53af4d2cb961..b2560aae0905 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -990,7 +990,6 @@ static int cmd_verify_ima(struct command *cmd) init_public_keys("/etc/keys/x509_evm.der"); } - errno = 0; if (!file) { log_err("Parameters missing\n"); print_usage(cmd); @@ -1007,6 +1006,7 @@ static int cmd_verify_ima(struct command *cmd) return fails > 0; } +#if CONFIG_SIGV1 static int cmd_convert(struct command *cmd) { char *inkey; @@ -1037,6 +1037,7 @@ static int cmd_convert(struct command *cmd) RSA_free(key); return err; } +#endif static int cmd_import(struct command *cmd) { @@ -1091,6 +1092,7 @@ static int cmd_import(struct command *cmd) calc_keyid_v2((uint32_t *)keyid, name, pkey); EVP_PKEY_free(pkey); } else { +#if CONFIG_SIGV1 RSA *key = read_pub_key(inkey, imaevm_params.x509); if (!key) @@ -1098,6 +1100,10 @@ static int cmd_import(struct command *cmd) len = key2bin(key, pub); calc_keyid_v1(keyid, name, pub, len); RSA_free(key); +#else + log_info("Importing public RSA key is not supported\n"); + return 1; +#endif } log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); @@ -2600,7 +2606,9 @@ static void usage(void) " -d, --imahash make IMA hash\n" " -f, --sigfile store IMA signature in .sig file instead of xattr\n" " --xattr-user store xattrs in user namespace (for testing purposes)\n" - " --rsa use RSA key type and signing scheme v1\n" +#if CONFIG_SIGV1 + " --rsa use RSA key type and signing scheme v1 (deprecated)\n" +#endif " -k, --key path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n" " or a pkcs11 URI\n" " --keyid n overwrite signature keyid with a 32-bit value in hex (for signing)\n" @@ -2639,8 +2647,12 @@ static void usage(void) struct command cmds[] = { {"--version", NULL, 0, ""}, {"help", cmd_help, 0, ""}, - {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring.\n"}, - {"convert", cmd_convert, 0, "key", "convert public key into the keyring.\n"}, +#if CONFIG_SIGV1 + {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring. ([--rsa] deprecated)\n"}, + {"convert", cmd_convert, 0, "key", "convert public key into the keyring. (deprecated)\n"}, +#else + {"import", cmd_import, 0, "pubkey keyring", "Import public key into the keyring.\n"}, +#endif {"sign", cmd_sign_evm, 0, "[-r] [--imahash | --imasig ] [--key key] [--pass [password] file", "Sign file metadata.\n"}, {"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"}, {"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--key key] [--pass [password] file", "Make file content signature.\n"}, diff --git a/src/libimaevm.c b/src/libimaevm.c index 611631c57f14..b12b7ff14d95 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -290,6 +290,7 @@ out: return pkey; } +#if CONFIG_SIGV1 RSA *read_pub_key(const char *keyfile, int x509) { EVP_PKEY *pkey; @@ -349,6 +350,7 @@ static int verify_hash_v1(const char *file, const unsigned char *hash, int size, return 0; } +#endif /* CONFIG_SIGV1 */ struct public_key_entry { struct public_key_entry *next; @@ -684,6 +686,7 @@ int verify_hash(const char *file, const unsigned char *hash, int size, { /* Get signature type from sig header */ if (sig[1] == DIGSIG_VERSION_1) { +#if CONFIG_SIGV1 const char *key = NULL; /* Read pubkey from RSA key */ @@ -693,6 +696,10 @@ int verify_hash(const char *file, const unsigned char *hash, int size, key = imaevm_params.keyfile; return verify_hash_v1(file, hash, size, sig + 1, siglen - 1, key); +#else + log_info("Signature version 1 deprecated."); + return -1; +#endif } else if (sig[1] == DIGSIG_VERSION_2) { return verify_hash_v2(file, hash, size, sig, siglen); } else if (sig[1] == DIGSIG_VERSION_3) { @@ -740,6 +747,7 @@ int ima_verify_signature(const char *file, unsigned char *sig, int siglen, return verify_hash(file, hash, hashlen, sig, siglen); } +#if CONFIG_SIGV1 /* * Create binary key representation suitable for kernel */ @@ -798,6 +806,7 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len if (imaevm_params.verbose > LOG_INFO) log_info("keyid-v1: %s\n", str); } +#endif /* CONFIG_SIGV1 */ /* * Calculate keyid of the public_key part of EVP_PKEY @@ -986,6 +995,7 @@ err_engine: return NULL; } +#if CONFIG_SIGV1 static RSA *read_priv_key(const char *keyfile, const char *keypass) { EVP_PKEY *pkey; @@ -1096,6 +1106,7 @@ out: RSA_free(key); return len; } +#endif /* CONFIG_SIGV1 */ /* * @sig is assumed to be of (MAX_SIGNATURE_SIZE - 1) size @@ -1210,9 +1221,14 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c if (keypass) imaevm_params.keypass = keypass; - return imaevm_params.x509 ? - sign_hash_v2(hashalgo, hash, size, keyfile, sig) : - sign_hash_v1(hashalgo, hash, size, keyfile, sig); + if (imaevm_params.x509) + return sign_hash_v2(hashalgo, hash, size, keyfile, sig); +#if CONFIG_SIGV1 + else + return sign_hash_v1(hashalgo, hash, size, keyfile, sig); +#endif + log_info("Signature version 1 deprecated."); + return -1; } static void libinit() diff --git a/tests/sign_verify.test b/tests/sign_verify.test index c56290aa4932..3e9548e1aeb7 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -17,6 +17,10 @@ cd "$(dirname "$0")" || exit 1 PATH=../src:$PATH + +# set the env SIGV1=1 to execute the signature v1 tests +SIGV1=${SIGV1:-0} + source ./functions.sh _require cmp evmctl getfattr openssl xxd @@ -368,13 +372,18 @@ try_different_sigs() { ## Test v1 signatures # Signature v1 only supports sha1 and sha256 so any other should fail -expect_fail \ - check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa +if [ $SIGV1 -eq 0 ]; then + __skip() { echo "IMA signature v1 tests are skipped: not supported"; return $SKIP; } + expect_pass __skip +else + expect_fail \ + check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa -sign_verify rsa1024 sha1 0x0301 --rsa -sign_verify rsa1024 sha256 0x0301 --rsa - try_different_keys - try_different_sigs + sign_verify rsa1024 sha1 0x0301 --rsa + sign_verify rsa1024 sha256 0x0301 --rsa + try_different_keys + try_different_sigs +fi ## Test v2 signatures with RSA PKCS#1 # List of allowed hashes much greater but not all are supported. From patchwork Thu Nov 3 18:38:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030846 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80B68C43217 for ; Thu, 3 Nov 2022 18:39:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230388AbiKCSjb (ORCPT ); Thu, 3 Nov 2022 14:39:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36958 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230262AbiKCSj3 (ORCPT ); Thu, 3 Nov 2022 14:39:29 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 30F7A2638 for ; Thu, 3 Nov 2022 11:39:29 -0700 (PDT) Received: from pps.filterd (m0187473.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IDjnt012938; Thu, 3 Nov 2022 18:39:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=2lks0BnQgohoUaJq+G7PgwAF8lcM/g9KviusbcUfL6Y=; b=UdHmNwsAT0wzZN541q1h2FHP+mGQUs3Z7Dpy9P1NJY6yChcOJ+9gJMyxpi5GLNILQsfU 8Q+m4f91yiH/GwXyrrB2893BY6W48nWMvSMGpUQL2KccZYVbVgq/zORFg7KJmjIMfDBm MBUsFyqBuVNUWqXxRLUAAcibjFELZLOcvV11lw8hBwkHDxzO28yvXwshNcf+YOWQ9hR8 j+DILeVQID/tdHc9QkLWbf1LlNyDWHvn+cDQ/3k3IZVLOv7acGMasS07/AYID31+zYAu aPg+0FwwtfaMkFXsz96wdKwoJxzlc1bjb7JqGJIaV1CG/pK68W1IF7A8MKJeW108m5zG aw== Received: from ppma03fra.de.ibm.com (6b.4a.5195.ip4.static.sl-reverse.com [149.81.74.107]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kme16ctkw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:24 +0000 Received: from pps.filterd (ppma03fra.de.ibm.com [127.0.0.1]) by ppma03fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3Ia9BE030432; Thu, 3 Nov 2022 18:39:22 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma03fra.de.ibm.com with ESMTP id 3kgut8pvwa-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:22 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3Idtro47841736 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:56 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 49A194203F; Thu, 3 Nov 2022 18:39:19 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7E1E642042; Thu, 3 Nov 2022 18:39:18 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:18 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 07/17] Replace the low level SHA1 calls when calculating the TPM 1.2 PCRs Date: Thu, 3 Nov 2022 14:38:54 -0400 Message-Id: <20221103183904.103562-8-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: BP_k68KT4k8xTenJOemV4jrriMvCDlXm X-Proofpoint-ORIG-GUID: BP_k68KT4k8xTenJOemV4jrriMvCDlXm X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 mlxscore=0 phishscore=0 lowpriorityscore=0 mlxlogscore=999 bulkscore=0 clxscore=1015 adultscore=0 priorityscore=1501 impostorscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 emits deprecated warnings for SHA1 functions. Use the EVP_ functions when walking the TPM 1.2 binary bios measurements to calculate the TPM 1.2 PCRs. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 78 ++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 63 insertions(+), 15 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index b2560aae0905..35842b72a494 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2298,6 +2298,11 @@ static int cmd_ima_measurement(struct command *cmd) return ima_measurement(file); } +/* + * read_binary_bios_measurements - read the TPM 1.2 event log + * + * Returns 0 on success, 1 on failure. + */ #define MAX_EVENT_DATA_SIZE 200000 static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) { @@ -2310,17 +2315,22 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } header; unsigned char data[MAX_EVENT_DATA_SIZE]; } event; + EVP_MD_CTX *mdctx; + const EVP_MD *md; + unsigned int mdlen; + int evp_err = 1; /* success */ struct stat s; FILE *fp; - SHA_CTX c; int err = 0; int len; int i; +#if OPENSSL_VERSION_NUMBER < 0x10100000 + EVP_MD_CTX ctx; + mdctx = &ctx; +#endif - if (stat(file, &s) == -1) { - errno = 0; + if (stat(file, &s) == -1) return 1; - } if (!S_ISREG(s.st_mode)) { log_info("Bios event log: not a regular file or link to regular file\n"); @@ -2328,13 +2338,27 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } fp = fopen(file, "r"); - if (!fp) { - log_errno("Failed to open TPM 1.2 event log.\n"); + if (!fp) return 1; - } if (imaevm_params.verbose > LOG_INFO) - log_info("Reading the TPM 1.2 event log %s.\n", file); + log_info("Reading the TPM 1.2 event log (%s)\n", file); + + md = EVP_get_digestbyname(bank->algo_name); + if (!md) { + log_err("Unknown message digest %s\n", bank->algo_name); + fclose(fp); + return 1; + } + +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + mdctx = EVP_MD_CTX_new(); + if (!mdctx) { + log_err("EVP_MD_CTX_new failed\n"); + fclose(fp); + return 1; + } +#endif /* Extend the pseudo TPM PCRs with the event digest */ while (fread(&event, sizeof(event.header), 1, fp) == 1) { @@ -2344,13 +2368,30 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } if (event.header.pcr >= NUM_PCRS) { log_err("Invalid PCR %d.\n", event.header.pcr); - err = 1; break; } - SHA1_Init(&c); - SHA1_Update(&c, bank->pcr[event.header.pcr], 20); - SHA1_Update(&c, event.header.digest, 20); - SHA1_Final(bank->pcr[event.header.pcr], &c); + + evp_err = EVP_DigestInit(mdctx, md); + if (evp_err == 0) { + log_err("EVP_DigestInit() failed\n"); + break; + } + + evp_err = EVP_DigestUpdate(mdctx, bank->pcr[event.header.pcr], 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestUpdate(mdctx, event.header.digest, 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestFinal(mdctx, bank->pcr[event.header.pcr], &mdlen); + if (evp_err == 0) { + log_err("EVP_DigestFinal() failed\n"); + break; + } if (event.header.len > MAX_EVENT_DATA_SIZE) { log_err("Event data event too long.\n"); err = 1; @@ -2359,10 +2400,17 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) len = fread(event.data, event.header.len, 1, fp); if (len != 1) { log_errno("Failed reading event data (short read)\n"); + err = 1; break; } } + + if (evp_err == 0) /* EVP_ functions return 1 on success, 0 on failure */ + err = 1; fclose(fp); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(mdctx); +#endif if (imaevm_params.verbose <= LOG_INFO) return err; @@ -2486,8 +2534,8 @@ static int cmd_ima_bootaggr(struct command *cmd) err = read_binary_bios_measurements(file, tpm_banks); if (err) { - log_info("Failed reading the TPM 1.2 event log %s.\n", - file); + log_err("Failed reading the TPM 1.2 event log (%s)\n", + file); return -1; } } else { From patchwork Thu Nov 3 18:38:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030847 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23A6FC433FE for ; Thu, 3 Nov 2022 18:39:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230262AbiKCSjc (ORCPT ); Thu, 3 Nov 2022 14:39:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36986 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230295AbiKCSjb (ORCPT ); Thu, 3 Nov 2022 14:39:31 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4C5065DD for ; Thu, 3 Nov 2022 11:39:30 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IMgcR028142; Thu, 3 Nov 2022 18:39:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=cxEQacXlCJelhn20OuySjBP8rT07SbOxdvyDl25jqc8=; b=KwjYJe/RCue4AiENYu+MJnP67tWxUi9kJcOyF76DVwSdn4CvUgoce3c7X1R7Bx3+JzeK GSYLa45edLM+xkYTW5ztVjGqm6mqsOr029aa/Xo5ihy46JAUprzn8F+Lw4suYiWqWOla faKdp5iGA8wnQxmUff6jLQmzJlQO6EaBq7AE47ezmiobnwQ4TFgmnkpL7fiILhOO6dDZ tLzeFAR5cQnMhm8f4zFMfW06fXmRXe0WrkmIpu/YN/fADjFcESGXxHc/1wVftD4U328/ dIM1fSxPBSfqR5ujRgvQ3gwWLiPvfCL+pNRXb0grjiGcDkLcqAZOng7TVH957kbRtwS+ jg== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmeuwk761-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:25 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3Iaxd9020060; Thu, 3 Nov 2022 18:39:23 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma03ams.nl.ibm.com with ESMTP id 3kgut918e8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:23 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IXl5i50332142 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:33:47 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4532F42041; Thu, 3 Nov 2022 18:39:20 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 796984203F; Thu, 3 Nov 2022 18:39:19 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:19 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 08/17] Replace the low level HMAC calls when calculating the EVM HMAC Date: Thu, 3 Nov 2022 14:38:55 -0400 Message-Id: <20221103183904.103562-9-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: SYevO4_Mqqq_pAkR0UKpem5jRaNSiba2 X-Proofpoint-ORIG-GUID: SYevO4_Mqqq_pAkR0UKpem5jRaNSiba2 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 impostorscore=0 suspectscore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 spamscore=0 mlxlogscore=999 mlxscore=0 phishscore=0 priorityscore=1501 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Calculating the EVM HMAC and labeling the filesystem was originally included in ima-evm-utils for debugging purposes only. For now, instead of removing EVM HMAC support just replace the low level HMAC_ calls with EVP_ calls. The '-a, --hashalgo' specifies the IMA hash or signature algorithm. The kernel EVM HMAC is limited to SHA1. Fix ima-evm-utils by hard coding the EVM HMAC algorithm to SHA1. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 57 +++++++++++++++++++++++++++++----------------------- 1 file changed, 32 insertions(+), 25 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 35842b72a494..763a48267075 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -61,6 +61,7 @@ #include #include #include +#include #include #include #include @@ -1163,12 +1164,12 @@ static int cmd_setxattr_ima(struct command *cmd) static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash) { - const EVP_MD *md; + size_t mdlen; + EVP_MD_CTX *pctx; + EVP_PKEY *pkey = NULL; struct stat st; int err = -1; uint32_t generation = 0; - HMAC_CTX *pctx; - unsigned int mdlen; char **xattrname; unsigned char xattr_value[1024]; unsigned char *key; @@ -1179,10 +1180,8 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h struct h_misc_64 hmac_misc; int hmac_size; #if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX ctx; + EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = HMAC_CTX_new(); #endif key = file2bin(keyfile, NULL, &keylen); @@ -1229,19 +1228,26 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h goto out; } - md = EVP_get_digestbyname(imaevm_params.hash_algo); - if (!md) { - log_err("EVP_get_digestbyname(%s) failed\n", - imaevm_params.hash_algo); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new failed\n"); goto out; } +#endif - err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL); - if (err) { + pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, evmkey, sizeof(evmkey)); + if (!pkey) { log_err("HMAC_Init() failed\n"); goto out; } + err = EVP_DigestSignInit(pctx, NULL, EVP_sha1(), NULL, pkey); + if (err != 1) { + log_err("EVP_DigestSignInit() failed\n"); + goto out; + } + for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value)); if (err < 0) { @@ -1252,12 +1258,12 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_info("skipping xattr: %s\n", *xattrname); continue; } - /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ log_info("name: %s, size: %d\n", *xattrname, err); log_debug_dump(xattr_value, err); - err = !HMAC_Update(pctx, xattr_value, err); - if (err) { - log_err("HMAC_Update() failed\n"); + + err = EVP_DigestSignUpdate(pctx, xattr_value, err); + if (err != 1) { + log_err("EVP_DigestSignUpdate() failed\n"); goto out_ctx_cleanup; } } @@ -1296,23 +1302,24 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_debug("hmac_misc (%d): ", hmac_size); log_debug_dump(&hmac_misc, hmac_size); - err = !HMAC_Update(pctx, (const unsigned char *)&hmac_misc, hmac_size); - if (err) { + err = EVP_DigestSignUpdate(pctx, &hmac_misc, hmac_size); + if (err != 1) { log_err("HMAC_Update() failed\n"); goto out_ctx_cleanup; } - err = !HMAC_Final(pctx, hash, &mdlen); - if (err) + err = EVP_DigestSignFinal(pctx, hash, &mdlen); + if (err != 1) log_err("HMAC_Final() failed\n"); out_ctx_cleanup: -#if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX_cleanup(pctx); -#else - HMAC_CTX_free(pctx); + EVP_PKEY_free(pkey); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); #endif out: free(key); - return err ?: mdlen; + if (err == 1) + return mdlen; + return err; } static int hmac_evm(const char *file, const char *key) From patchwork Thu Nov 3 18:38:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030848 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8435C4321E for ; Thu, 3 Nov 2022 18:39:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230338AbiKCSjd (ORCPT ); Thu, 3 Nov 2022 14:39:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230377AbiKCSjb (ORCPT ); Thu, 3 Nov 2022 14:39:31 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A0CA02638 for ; Thu, 3 Nov 2022 11:39:30 -0700 (PDT) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3He2dw000925; Thu, 3 Nov 2022 18:39:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=mmLEi2Rs+L/pVe/HbKN8/K6Bqiv8992iCqd1RsZk9WY=; b=EOdfSGLpvStMXWOgOOVANYC3NgPSR944+snVfMtjzyhxEHZ+PtmCSr0T219ymRXAPZey n2GwOUnukdeY+a2rsrA9MBHkYg9XfrRrYJU3yAF+TX5U3R8RXpV+Kl7IAAlKlIbYMDIg Obt+26uHjnaTVkZ337b6anE90MrI1j4Vkr87Gyt5jlTpNqW9wNMmzZpIbM6gCq6Lh+tN uKzJ5XpzI+Hyd5VhecpJEg+xtI1+bGvgjatkRkMn5/fg/JrtDlx36dWkJRf+KwtSTd3Q cDwL8ydCohsNmph865EMDhUe/jc7IJ9lkQW5CvZvP7h8lfR3XKRbQCEuJWG0eITkUU8v Fw== Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmemwtumj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:26 +0000 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IZW7U016890; Thu, 3 Nov 2022 18:39:24 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma06ams.nl.ibm.com with ESMTP id 3kguej187h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:24 +0000 Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdLxT54919646 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:21 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2D0DC42045; Thu, 3 Nov 2022 18:39:21 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 73CEB4203F; Thu, 3 Nov 2022 18:39:20 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:20 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 09/17] Add missing EVP_MD_CTX_free() call in calc_evm_hash() Date: Thu, 3 Nov 2022 14:38:56 -0400 Message-Id: <20221103183904.103562-10-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: pruzArd3hW-CKc38Zip8HK2963d_PXfY X-Proofpoint-GUID: pruzArd3hW-CKc38Zip8HK2963d_PXfY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 phishscore=0 impostorscore=0 adultscore=0 bulkscore=0 priorityscore=1501 clxscore=1015 spamscore=0 lowpriorityscore=0 mlxlogscore=999 suspectscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org When EVP_MD_CTX_new() call was added, the corresponding EVP_MD_CTX_free() was never called. Properly free it. Fixes: 81010f0d87ef ("ima-evm-utils: Add backward compatible support for openssl 1.1") Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 58 +++++++++++++++++++++++++++++++++++----------------- 1 file changed, 39 insertions(+), 19 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 763a48267075..66eea481d115 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -331,11 +331,17 @@ err: return -1; } +/* + * calc_evm_hash - calculate the file metadata hash + * + * Returns 0 for EVP_ function failures. Return -1 for other failures. + * Return hash algorithm size on success. + */ static int calc_evm_hash(const char *file, unsigned char *hash) { const EVP_MD *md; struct stat st; - int err; + int err = -1; uint32_t generation = 0; EVP_MD_CTX *pctx; unsigned int mdlen; @@ -349,12 +355,10 @@ static int calc_evm_hash(const char *file, unsigned char *hash) #if OPENSSL_VERSION_NUMBER < 0x10100000 EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = EVP_MD_CTX_new(); #endif if (lstat(file, &st)) { - log_err("Failed to stat: %s\n", file); + log_errno_reset(LOG_ERR, "Failed to stat: %s", file); return -1; } @@ -389,21 +393,30 @@ static int calc_evm_hash(const char *file, unsigned char *hash) list_size = llistxattr(file, list, sizeof(list)); if (list_size < 0) { - log_err("llistxattr() failed\n"); + log_errno_reset(LOG_ERR, "llistxattr() failed"); return -1; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new() failed\n"); + return 0; + } +#endif + md = EVP_get_digestbyname(imaevm_params.hash_algo); if (!md) { log_err("EVP_get_digestbyname(%s) failed\n", imaevm_params.hash_algo); - return 1; + err = 0; + goto out; } err = EVP_DigestInit(pctx, md); if (!err) { log_err("EVP_DigestInit() failed\n"); - return 1; + goto out; } for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { @@ -414,7 +427,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("selinux[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, selinux_str); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && ima_str) { @@ -422,7 +436,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("ima[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } hex2bin(xattr_value, ima_str, err); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && evm_portable){ @@ -431,7 +446,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err < 0) { log_err("EVM portable sig: %s required\n", xattr_ima); - return -1; + goto out; } use_xattr_ima = 1; } else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) { @@ -441,7 +456,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err >= sizeof(xattr_value)) { log_err("caps[%u] value is too long to fit into xattr[%zu]\n", err + 1, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, caps_str); } else { @@ -462,7 +478,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, xattr_value, err); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } @@ -516,29 +532,33 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } if (!evm_immutable && !evm_portable && !(hmac_flags & HMAC_FLAG_NO_UUID)) { err = get_uuid(&st, uuid); if (err) - return -1; + goto out; err = EVP_DigestUpdate(pctx, (const unsigned char *)uuid, sizeof(uuid)); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } err = EVP_DigestFinal(pctx, hash, &mdlen); - if (!err) { + if (!err) log_err("EVP_DigestFinal() failed\n"); - return 1; - } - return mdlen; +out: +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); +#endif + if (err == 1) + return mdlen; + return err; } static int sign_evm(const char *file, const char *key) From patchwork Thu Nov 3 18:38:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030852 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF2B4C43217 for ; Thu, 3 Nov 2022 18:39:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230377AbiKCSje (ORCPT ); Thu, 3 Nov 2022 14:39:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37018 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230222AbiKCSjd (ORCPT ); Thu, 3 Nov 2022 14:39:33 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 05C83100 for ; Thu, 3 Nov 2022 11:39:33 -0700 (PDT) Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3INon0013793; Thu, 3 Nov 2022 18:39:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=SuRsjrLBVChUvlGpGGXOhsf1Td3xQRf0l7oANmeeAdk=; b=TDVgTbwiFm+VBWgOfo9XTn5k2WWc1ek+e3hSigzHu9T3sAWveGOcAwWbdrupSTDzxdSD Z9OEHjk9ZmkbzRGuZJtSJOMdYGRwmIyjzsb8o1wnqBWZW1J8WtCzk1QgDd+nwYpwQqVv 6vXNuzt2T+k2P9Z0GKVhGMEVF5B6BClJG3EXVnsmhUTKTRjlsT/0S2J9aTL80UEpVVBz Y3YdT+Bv2zxK1DuPHup/SosOwXydBxUhfGTNe9hgWxOggmDNZylUIh3HRmYP9HmGtq0Y D2MY617V8sVfNHNNmkbKQgR1+KN9dujBThtQ+WJq+Rcyqm/J8LPPHc8WVy/Ki8Y6ut+Z Nw== Received: from ppma01fra.de.ibm.com (46.49.7a9f.ip4.static.sl-reverse.com [159.122.73.70]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmf9r9udu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:28 +0000 Received: from pps.filterd (ppma01fra.de.ibm.com [127.0.0.1]) by ppma01fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IZl9S027182; Thu, 3 Nov 2022 18:39:25 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma01fra.de.ibm.com with ESMTP id 3kgut9ew12-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:25 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdMZx23003808 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:22 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1977C42042; Thu, 3 Nov 2022 18:39:22 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5FE834203F; Thu, 3 Nov 2022 18:39:21 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:21 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 10/17] Disable use of OpenSSL "engine" support Date: Thu, 3 Nov 2022 14:38:57 -0400 Message-Id: <20221103183904.103562-11-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: hf7ZGaPoqIk8KkFt7miC8kMJvUyBzjVh X-Proofpoint-ORIG-GUID: hf7ZGaPoqIk8KkFt7miC8kMJvUyBzjVh X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 malwarescore=0 bulkscore=0 impostorscore=0 spamscore=0 mlxscore=0 priorityscore=1501 mlxlogscore=999 suspectscore=0 phishscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 "engine" support is deprecated and replaced with "providers". Engine support will continue to work for a while, but results in deprecated declaration and other messages. One option is simply to hide them ("-Wno-deprecated-declarations"). The other alternative is to conditionally build ima-evm-utils without OpenSSL engine support and without disabling deprecated declarations. Based on "--disable-engine" or "--enable-engine=no" configuration option, disable OpenSSL "engine" support. As suggested by Vitaly, - verify ENGINE_init symbol is defined in libcrypto - disable engine support if either OPENSSL_NO_DYNAMIC_ENGINE or OPENSSL_NO_ENGINE variables are defined Signed-off-by: Mimi Zohar Reviewed-by: Stefan Berger --- configure.ac | 6 ++++++ src/Makefile.am | 8 ++++++++ src/evmctl.c | 17 ++++++++++++++++- src/imaevm.h | 6 ++++++ src/libimaevm.c | 7 ++++++- 5 files changed, 42 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index dc666f2bb1fa..90646da22061 100644 --- a/configure.ac +++ b/configure.ac @@ -54,6 +54,11 @@ AC_ARG_ENABLE(sigv1, AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) +AC_ARG_ENABLE(engine, + [AS_HELP_STRING([--disable-engine], [build ima-evm-utils without OpenSSL engine support])],,[enable_engine=yes]) + AC_CHECK_LIB([crypto], [ENGINE_init],, [enable_engine=no]) + AM_CONDITIONAL([CONFIG_IMA_EVM_ENGINE], [test "x$enable_engine" = "xyes"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -89,5 +94,6 @@ echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" echo " sigv1: $enable_sigv1" +echo " engine: $enable_engine" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 90c7249020cf..0527a7b9df5c 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -11,6 +11,10 @@ if CONFIG_SIGV1 libimaevm_la_CFLAGS = -DCONFIG_SIGV1 endif +if CONFIG_IMA_EVM_ENGINE +libimaevm_la_CFLAGS = -DCONFIG_IMA_EVM_ENGINE +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -31,6 +35,10 @@ if CONFIG_SIGV1 evmctl_CFLAGS = -DCONFIG_SIGV1 endif +# Enable "--engine" support +if CONFIG_IMA_EVM_ENGINE +evmctl_CFLAGS = -DCONFIG_IMA_EVM_ENGINE +endif # USE_PCRTSS uses the Intel TSS if USE_PCRTSS diff --git a/src/evmctl.c b/src/evmctl.c index 66eea481d115..6f253bfcba19 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -65,7 +65,9 @@ #include #include #include +#if CONFIG_IMA_EVM_ENGINE #include +#endif #include #include "hash_info.h" #include "pcr.h" @@ -2709,7 +2711,9 @@ static void usage(void) " --selinux use custom Selinux label for EVM\n" " --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n" " --verify-sig verify measurement list signatures\n" - " --engine e preload OpenSSL engine e (such as: gost)\n" +#if CONFIG_IMA_EVM_ENGINE + " --engine e preload OpenSSL engine e (such as: gost) is deprecated\n" +#endif " --ignore-violations ignore ToMToU measurement violations\n" " -v increase verbosity level\n" " -h, --help display this help and exit\n" @@ -2771,7 +2775,9 @@ static struct option opts[] = { {"selinux", 1, 0, 136}, {"caps", 2, 0, 137}, {"verify-sig", 0, 0, 138}, +#if CONFIG_IMA_EVM_ENGINE {"engine", 1, 0, 139}, +#endif {"xattr-user", 0, 0, 140}, {"ignore-violations", 0, 0, 141}, {"pcrs", 1, 0, 142}, @@ -2824,9 +2830,11 @@ static char *get_password(void) return password; } +#if CONFIG_IMA_EVM_ENGINE static ENGINE *setup_engine(const char *engine_id) { ENGINE *eng = ENGINE_by_id(engine_id); + if (!eng) { log_err("engine %s isn't available\n", optarg); ERR_print_errors_fp(stderr); @@ -2840,6 +2848,7 @@ static ENGINE *setup_engine(const char *engine_id) ENGINE_set_default(eng, ENGINE_METHOD_ALL); return eng; } +#endif int main(int argc, char *argv[]) { @@ -2965,11 +2974,13 @@ int main(int argc, char *argv[]) case 138: verify_list_sig = 1; break; +#if CONFIG_IMA_EVM_ENGINE case 139: /* --engine e */ imaevm_params.eng = setup_engine(optarg); if (!imaevm_params.eng) goto error; break; +#endif case 140: /* --xattr-user */ xattr_ima = "user.ima"; xattr_evm = "user.evm"; @@ -3028,7 +3039,9 @@ int main(int argc, char *argv[]) if (imaevm_params.keyfile != NULL && imaevm_params.eng == NULL && !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { +#if CONFIG_IMA_EVM_ENGINE imaevm_params.eng = setup_engine("pkcs11"); +#endif if (!imaevm_params.eng) goto error; } @@ -3054,6 +3067,7 @@ int main(int argc, char *argv[]) } error: +#if CONFIG_IMA_EVM_ENGINE if (imaevm_params.eng) { ENGINE_finish(imaevm_params.eng); ENGINE_free(imaevm_params.eng); @@ -3061,6 +3075,7 @@ error: ENGINE_cleanup(); #endif } +#endif ERR_free_strings(); EVP_cleanup(); BIO_free(NULL); diff --git a/src/imaevm.h b/src/imaevm.h index afcf1e042014..884321670fa7 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -48,7 +48,13 @@ #include #include #include +#ifdef CONFIG_IMA_EVM_ENGINE #include +#endif + +#if defined(OPENSSL_NO_ENGINE) || defined(OPENSSL_NO_DYNAMIC_ENGINE) +#undef CONFIG_IMA_EVM_ENGINE +#endif #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ diff --git a/src/libimaevm.c b/src/libimaevm.c index b12b7ff14d95..8070ffd61a2c 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -953,9 +953,10 @@ uint32_t imaevm_read_keyid(const char *certfile) static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) { FILE *fp; - EVP_PKEY *pkey; + EVP_PKEY *pkey = NULL; if (!strncmp(keyfile, "pkcs11:", 7)) { +#ifdef CONFIG_IMA_EVM_ENGINE if (!imaevm_params.keyid) { log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); return NULL; @@ -972,6 +973,10 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) log_err("Failed to load private key %s\n", keyfile); goto err_engine; } +#else + log_err("OpenSSL \"engine\" support is disabled\n"); + goto err_engine; +#endif } else { fp = fopen(keyfile, "r"); if (!fp) { From patchwork Thu Nov 3 18:38:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030851 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB99BC4167D for ; Thu, 3 Nov 2022 18:39:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230340AbiKCSje (ORCPT ); Thu, 3 Nov 2022 14:39:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37004 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230433AbiKCSjc (ORCPT ); Thu, 3 Nov 2022 14:39:32 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 164042638 for ; Thu, 3 Nov 2022 11:39:32 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IJAxG020929; Thu, 3 Nov 2022 18:39:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=Z/X755wNvyGSDpT09ud90n7s3XuqpAqWmxpUXeAX+nk=; b=T/CBrbVfWgIB0Lck/hcTy4vlQ58Vsw1Nc+N+Fs37u7DUz00bWsrpJBFWUXp1EpMKDpf7 o0TH0r2H6mAlmX0rOEWvoSU6xK/wj+TGGcrh2i/LqjW7yRsjhdwc5snpyAFCs6tTDS25 cHwGT0u+5qJ0sEC8HiLHfskisL4QcadNu9N2csa/gpWqQR8Ke8VzfgiuD4nahshYpQPy yB1IhrFs53zzQzVWKpNOpFaCHQWUH86fF+g52fkbXfNidtWsohALD6ub2n68uIaZseys Wmafn7Hyc3BN0nUC1BNpoCCUQJB512bkrqz198gbBuOeY/zre7rxqQzeAYkLV/Gr9ezf NA== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmfr0s2kb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:28 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IarvZ005423; Thu, 3 Nov 2022 18:39:26 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9974w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:26 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdN1Q8978972 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:23 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 627F342041; Thu, 3 Nov 2022 18:39:23 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 920FE4203F; Thu, 3 Nov 2022 18:39:22 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:22 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 11/17] Fix potential use after free in read_tpm_banks() Date: Thu, 3 Nov 2022 14:38:58 -0400 Message-Id: <20221103183904.103562-12-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: bWmRh2l-opUTcXo4NPR0r1nBSA-r8euN X-Proofpoint-ORIG-GUID: bWmRh2l-opUTcXo4NPR0r1nBSA-r8euN X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 spamscore=0 bulkscore=0 phishscore=0 mlxscore=0 suspectscore=0 priorityscore=1501 malwarescore=0 adultscore=0 clxscore=1015 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On failure to read TPM 2.0 bank PCRs 'errmsg' is not properly set to NULL after being freed. Fix potential use after free. Fixes: 3472f9ba9c05 ("ima-evm-utils: read the PCRs for the requested TPM banks") Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/evmctl.c b/src/evmctl.c index 6f253bfcba19..6490b2a537a0 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2075,6 +2075,7 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank) log_debug("Failed to read %s PCRs: (%s)\n", bank[i].algo_name, errmsg); free(errmsg); + errmsg = NULL; bank[i].supported = 0; } } From patchwork Thu Nov 3 18:38:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030853 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B2C2C433FE for ; Thu, 3 Nov 2022 18:39:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230222AbiKCSjf (ORCPT ); Thu, 3 Nov 2022 14:39:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37028 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230410AbiKCSje (ORCPT ); Thu, 3 Nov 2022 14:39:34 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8EF97100 for ; Thu, 3 Nov 2022 11:39:34 -0700 (PDT) Received: from pps.filterd (m0187473.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IJaD3012573; Thu, 3 Nov 2022 18:39:30 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=26Tvz4ShnPM4roQmR2/1q1UjZHo18KTRkkNIPytvgZ4=; b=nb8siozSN00ncSnwK+kvR6tADqwqs50GIE0ESw2G63LjUcyJ9qpJXTMTjF0QcoMp9egp jtGGiHRIbb4slMd1Av5oN2vqVv/078UIccqgTS8BtcTicN9YCJmQvn6Azf7iU7miiMvk 3iN/ROspTDUHgXmHVX/b4AfcoF3ndnWuC6fgNi+o/GiqR1uMNL9uUwrkBuw8Flom0Y1H Sz5vTm/r7wFz0LGZ17aw6Whl1UaLtaPYcfmZ1Gsfz+wFsSrRDm11l/pOPy4xmAW0xZI7 X9ON37KxTq2RFQ9r0owm687F1MPvXA9MlMQgVYiF+X7k8RrKnm79O0XuOKMDLCPUlBZF 5Q== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kme16ctpa-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:30 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IYwd1023973; Thu, 3 Nov 2022 18:39:28 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma06fra.de.ibm.com with ESMTP id 3kguejewwk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:27 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdOxt63701430 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:24 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A178C42041; Thu, 3 Nov 2022 18:39:24 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 917014203F; Thu, 3 Nov 2022 18:39:23 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:23 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 12/17] Limit the file hash algorithm name length Date: Thu, 3 Nov 2022 14:38:59 -0400 Message-Id: <20221103183904.103562-13-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: rWuoE04NBytKFW32mCRBpiLTclwbZ-h6 X-Proofpoint-ORIG-GUID: rWuoE04NBytKFW32mCRBpiLTclwbZ-h6 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 mlxscore=0 phishscore=0 lowpriorityscore=0 mlxlogscore=999 bulkscore=0 clxscore=1015 adultscore=0 priorityscore=1501 impostorscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Instead of assuming the file hash algorithm is a properly NULL terminated string, properly limit the "algo:" field size. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index 6490b2a537a0..17472bf621f6 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1603,7 +1603,7 @@ void ima_ng_show(struct template_entry *entry) total_len -= sizeof(field_len); algo = (char *)fieldp; - len = strlen(algo) + 1; + len = strnlen(algo, field_len - 1) + 1; digest_len = field_len - len; digest = fieldp + len; From patchwork Thu Nov 3 18:39:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030849 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66F8FC4332F for ; Thu, 3 Nov 2022 18:39:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230295AbiKCSjd (ORCPT ); Thu, 3 Nov 2022 14:39:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230340AbiKCSjb (ORCPT ); Thu, 3 Nov 2022 14:39:31 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 63E12BC1D for ; Thu, 3 Nov 2022 11:39:31 -0700 (PDT) Received: from pps.filterd (m0187473.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3ITSCu039326 for ; Thu, 3 Nov 2022 18:39:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=vHgHfYGhrhSEt983xhDwAtQ7MvtOABjyvXFIU73aVjw=; b=tphcmQ/paifIdWvk3e4gxx2XbIzxWfb156ub+cTNyjffYfsySOVtgIim9yQBQvHs6MQ9 /XPg5XzJwaPIg2Au01xIRqFjtkEb2ZjMxB56XLJ0o1MO8AZCT6j9n3hHkwDGjrBfS1Zo Px7kcAz/c2gNotN2jEEYwEH60dRS2ch0TKPULSo54TebvCAlk29MCNlLN5grX9d9HSa4 4MZdu0oV6j4nipGEPwILDq2NioiLWVaO8XO7STUhjMYD3T8Ypz/ZYYX/pTuNTBIhJHJH ybeqRvgKcrS3mRuCnVhuI2nHcxXanTjVvm7+McLTOpoXMdPAsFucAPZ7AGxUWErEgL4E pA== Received: from ppma04fra.de.ibm.com (6a.4a.5195.ip4.static.sl-reverse.com [149.81.74.106]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kme16ctpg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 03 Nov 2022 18:39:30 +0000 Received: from pps.filterd (ppma04fra.de.ibm.com [127.0.0.1]) by ppma04fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IZfAE024831 for ; Thu, 3 Nov 2022 18:39:28 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma04fra.de.ibm.com with ESMTP id 3kgut8xw30-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 03 Nov 2022 18:39:28 +0000 Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3Ie2n347841746 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 3 Nov 2022 18:40:02 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E77B142041; Thu, 3 Nov 2022 18:39:25 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D0F114203F; Thu, 3 Nov 2022 18:39:24 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:24 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 13/17] Missing template data size lower bounds checking Date: Thu, 3 Nov 2022 14:39:00 -0400 Message-Id: <20221103183904.103562-14-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: hSZm1A8WEVRLzMCPJlMJo5Q8wQFhx3-C X-Proofpoint-ORIG-GUID: hSZm1A8WEVRLzMCPJlMJo5Q8wQFhx3-C X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 mlxscore=0 phishscore=0 lowpriorityscore=0 mlxlogscore=999 bulkscore=0 clxscore=1015 adultscore=0 priorityscore=1501 impostorscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Each record in the IMA measurement list must contain some template data. Ensure the template data is not zero length. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index 17472bf621f6..65e27e1681e7 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2188,6 +2188,10 @@ static int ima_measurement(const char *file) log_err("Unable to read template length\n"); goto out; } + if (entry.template_len == 0) { + log_err("Invalid template data len\n"); + goto out; + } } else { entry.template_len = SHA_DIGEST_LENGTH + TCG_EVENT_NAME_LEN_MAX + 1; From patchwork Thu Nov 3 18:39:01 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030854 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0094C433FE for ; Thu, 3 Nov 2022 18:39:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229567AbiKCSjh (ORCPT ); Thu, 3 Nov 2022 14:39:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37042 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230011AbiKCSjg (ORCPT ); Thu, 3 Nov 2022 14:39:36 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E3945100 for ; Thu, 3 Nov 2022 11:39:35 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3ILfYW017946; Thu, 3 Nov 2022 18:39:32 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=CiYsHNxdCzAvIhN7ZJXAN7xP8VTBAjAlo9sSpWve3MA=; b=eVveBsK5eX4QfEyuoD3WCRB7jKCdXaXC0dA4dKbWadH7uq2eDQJlbZFLk3+34nHPk3Pb hqlITdCnAXbVOmvlMVT80bEzWFUhDdv94bRva550HEuMp3idQPZoj9zy9vHbi3CegOjZ XV+rD2f3rIhcz56v+acuVhVcd0SICf7jAJvq9hx9yOUWpKFCJVjAxy9OKqw2a8itGoly Sb66dYjAV/FusG19YweHeYRg9fQ0Po4YeRbNus2fxV7czDMwATKB7DljnxAlcg69Iqwx btH00pCI1tsVZ4IEA4YVkOy2aSBaGkvHa6/b55D8+iFMrS9/zEwjGv2Fr3R8PHGQm0cN 5g== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmgtsngxf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:32 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IadUB005345; Thu, 3 Nov 2022 18:39:30 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9974y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:30 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IXsA545351256 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:33:54 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 368C142041; Thu, 3 Nov 2022 18:39:27 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 21FF44203F; Thu, 3 Nov 2022 18:39:26 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:26 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 14/17] Base sm2/sm3 test on openssl version installed Date: Thu, 3 Nov 2022 14:39:01 -0400 Message-Id: <20221103183904.103562-15-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: x-i918gknYJdY_HYVE-jGZ47cnqqyh4e X-Proofpoint-GUID: x-i918gknYJdY_HYVE-jGZ47cnqqyh4e X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 priorityscore=1501 mlxlogscore=999 mlxscore=0 bulkscore=0 impostorscore=0 phishscore=0 spamscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Since the distros are now shipping with OpenSSL 3, no need to build it. Limit the sm2/sm3 test to OpenSSL 3. Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- tests/sign_verify.test | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 3e9548e1aeb7..2bc365ab408d 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -416,9 +416,12 @@ sign_verify prime256v1 sha384 0x030205:K:004[345678] sign_verify prime256v1 sha512 0x030206:K:004[345678] # If openssl 3.0 is installed, test the SM2/3 algorithm combination -if [ -x /opt/openssl3/bin/openssl ]; then - PATH=/opt/openssl3/bin:$PATH LD_LIBRARY_PATH=/opt/openssl3/lib \ - sign_verify sm2 sm3 0x030211:K:004[345678] +ssl_major_version=$(openssl version | sed -n 's/^OpenSSL \([^\.]\).*/\1/p') +if [ "${ssl_major_version}" = 3 ]; then + sign_verify sm2 sm3 0x030211:K:004[345678] +else + __skip() { echo "sm2/sm3 tests are skipped (ssl version)"; return $SKIP; } + expect_pass __skip fi # Test v2 signatures with EC-RDSA From patchwork Thu Nov 3 18:39:02 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030855 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05493C4332F for ; Thu, 3 Nov 2022 18:39:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230410AbiKCSjj (ORCPT ); Thu, 3 Nov 2022 14:39:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37064 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230433AbiKCSji (ORCPT ); Thu, 3 Nov 2022 14:39:38 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4CE9C100 for ; Thu, 3 Nov 2022 11:39:37 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IIjcO020833; Thu, 3 Nov 2022 18:39:33 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=drT64InxfTIATQKuCRL+GopbslNgDcvCaBLvhsbs44Y=; b=RZzTc2BMihevRNHV23csroTWPZWLuUZEDb4NBfBedkZfprRR8nMmcjKbBrJl//9xluKb DbDT2KYXjDb+CR9QwzsDbMWJ6Q/Em3PrDI0sU30RXpiWn07kGLKcpKUEco2jZuM1ynWD K2zDhhdJegK7jJHHJtKXOb7KwjVSKAiLIvrgFX7U/pp0aaDl0MvUorYjpTB9u2vHtunR 5jR4ou/1IhKwt3QYAvCmGD69s8Fp2nx4QojTJ+hh5jhIDlvN0Np0SXZdr74Efx5+Y3WW kCGIX2kdDJCu82p54m+Q+U2A7EHgVFbslvhiaVz1Z+PWUpM5sKOCHhj0UfhTtdKcbOfh VA== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmfr0s2na-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:33 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IZkES019547; Thu, 3 Nov 2022 18:39:31 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma03ams.nl.ibm.com with ESMTP id 3kgut918eb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:31 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdSGJ197204 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:28 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3A5DA42041; Thu, 3 Nov 2022 18:39:28 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7F6124203F; Thu, 3 Nov 2022 18:39:27 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:27 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 15/17] Compile a newer version of OpenSSL Date: Thu, 3 Nov 2022 14:39:02 -0400 Message-Id: <20221103183904.103562-16-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: Rm3PTCa5hDRTHuC_0Gt-SPzN023Vd3vK X-Proofpoint-ORIG-GUID: Rm3PTCa5hDRTHuC_0Gt-SPzN023Vd3vK X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 spamscore=0 bulkscore=0 phishscore=0 mlxscore=0 suspectscore=0 priorityscore=1501 malwarescore=0 adultscore=0 clxscore=1015 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org With the distros shipping OpenSSL 3 with engine support, the original purpose for compiling OpenSSL 3 to test sm2/sm3 is no longer necessary and could be removed. Or, it could be re-purposed for building OpenSSL without engine support, which is needed for testing. For both travis and github actions, update openssl-3.0.0-beta1 with openssl-3.0.5. Signed-off-by: Mimi Zohar Reviewed-by: Stefan Berger --- .github/workflows/ci.yml | 6 +++--- .travis.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dc06fce64ba5..5595855512e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: ARCH: i386 TSS: tpm2-tss VARIANT: i386 - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 # cross compilation builds - container: "debian:stable" @@ -52,7 +52,7 @@ jobs: env: CC: clang TSS: ibmtss - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 - container: "opensuse/leap" env: @@ -63,7 +63,7 @@ jobs: env: CC: gcc TSS: ibmtss - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 - container: "ubuntu:xenial" env: diff --git a/.travis.yml b/.travis.yml index edd2a21b83d3..09db401928f6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -9,7 +9,7 @@ matrix: include: # 32 bit build - os: linux - env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss COMPILE_SSL=openssl-3.0.5 compiler: gcc # cross compilation builds @@ -32,7 +32,7 @@ matrix: # glibc (gcc/clang) - os: linux - env: DISTRO=opensuse/tumbleweed TSS=ibmtss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host" COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=opensuse/tumbleweed TSS=ibmtss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host" COMPILE_SSL=openssl-3.0.5 compiler: clang - os: linux @@ -40,7 +40,7 @@ matrix: compiler: gcc - os: linux - env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.5 compiler: gcc - os: linux From patchwork Thu Nov 3 18:39:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030857 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C113C43219 for ; Thu, 3 Nov 2022 18:39:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230497AbiKCSjp (ORCPT ); Thu, 3 Nov 2022 14:39:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230481AbiKCSjo (ORCPT ); Thu, 3 Nov 2022 14:39:44 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90AE92BC2 for ; Thu, 3 Nov 2022 11:39:43 -0700 (PDT) Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IHJjg029525; Thu, 3 Nov 2022 18:39:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=0gg/PuoRA55xSJxr+V7684GuzWAsjxaZmXLbf5QuGo4=; b=O01e3uOz68JJvxZZUcf6vuWvAUewNsleHfL8O/9qnxlaB6qMEv/OLpwa1vlRkakV1cLy cozriRdA4rJquNno3DUvepHT79J9Ku4E9HKHU476IlZXAN79GL4E8/e1sc9NmwGSw7FE 2NSE9U3EjfDsYO+WhXR7qtw9TNeyngn0/NXbPWvZ5C9kcKlcxKrzZtGLvUnTRNYcom+5 NkYe+9JzijibzU3BafU5zJlrIaNbXnZgrIfoCHTL3RQfmtjOfxljAC7IgmtldQG+J7a8 Shf/e2ZseSBh24RaHJBAu8/+/lpnM5kNrb4MGYMcLPBxvqx3ul8Xj+g+rQEW92FQZ+u/ eA== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kme7ykxt3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:37 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3Ib2pN005468; Thu, 3 Nov 2022 18:39:32 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut99752-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:32 +0000 Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdT4n26411316 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:29 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 68D8842041; Thu, 3 Nov 2022 18:39:29 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A861F4203F; Thu, 3 Nov 2022 18:39:28 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:28 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 16/17] Build OpenSSL without engine support Date: Thu, 3 Nov 2022 14:39:03 -0400 Message-Id: <20221103183904.103562-17-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: f_CScl33ozEElZTlOyUSCphrkaCNFhVU X-Proofpoint-ORIG-GUID: f_CScl33ozEElZTlOyUSCphrkaCNFhVU X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 adultscore=0 spamscore=0 impostorscore=0 phishscore=0 clxscore=1015 bulkscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Fix COMPILE_SSL to build for the proper architecture, link with the appropriate library, and set up library path for evmctl. Compile OpenSSL with "no-engine" and "no-dynamic-engine" support. Signed-off-by: Mimi Zohar --- .github/workflows/ci.yml | 4 ++-- .travis.yml | 2 +- build.sh | 8 ++++++++ src/evmctl.c | 4 +++- tests/install-openssl3.sh | 9 ++++++++- 5 files changed, 22 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5595855512e4..8223b8767351 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -114,7 +114,7 @@ jobs: INSTALL="${INSTALL%%/*}" if [ "$VARIANT" ]; then ARCH="$ARCH" ./ci/$INSTALL.$VARIANT.sh; fi ARCH="$ARCH" CC="$CC" TSS="$TSS" ./ci/$INSTALL.sh - if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" ./tests/install-openssl3.sh; fi + if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" VARIANT="$VARIANT" ./tests/install-openssl3.sh; fi - name: Build swtpm run: | @@ -129,4 +129,4 @@ jobs: run: $CC --version - name: Compile - run: CC="$CC" VARIANT="$VARIANT" ./build.sh + run: CC="$CC" VARIANT="$VARIANT" COMPILE_SSL="$COMPILE_SSL" ./build.sh diff --git a/.travis.yml b/.travis.yml index 09db401928f6..faaa4b5d675b 100644 --- a/.travis.yml +++ b/.travis.yml @@ -95,4 +95,4 @@ script: - INSTALL="${DISTRO#${REPO}}" - INSTALL="${INSTALL%%:*}" - INSTALL="${INSTALL%%/*}" - - $CONTAINER run $CONTAINER_ARGS -t ima-evm-utils /bin/sh -c "if [ \"$VARIANT\" ]; then ARCH=\"$ARCH\" ./ci/$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./ci/$INSTALL.sh && if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" ./tests/install-openssl3.sh; fi && if [ ! \"$VARIANT\" ]; then which tpm_server || which swtpm || if which tssstartup; then ./tests/install-swtpm.sh; fi; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" ./build.sh" + - $CONTAINER run $CONTAINER_ARGS -t ima-evm-utils /bin/sh -c "if [ \"$VARIANT\" ]; then ARCH=\"$ARCH\" ./ci/$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./ci/$INSTALL.sh && if [ \"$COMPILE_SSL\" ]; then COMPILE_SSL=\"$COMPILE_SSL\" VARIANT=\"$VARIANT\" ./tests/install-openssl3.sh; fi && if [ ! \"$VARIANT\" ]; then which tpm_server || which swtpm || if which tssstartup; then ./tests/install-swtpm.sh; fi; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" COMPILE_SSL=\"$COMPILE_SSL\" ./build.sh" diff --git a/build.sh b/build.sh index c4d28f1302c6..0c2fdd9e995d 100755 --- a/build.sh +++ b/build.sh @@ -32,6 +32,14 @@ log_exit() cd `dirname $0` +if [ "$COMPILE_SSL" ]; then + echo "COMPILE_SSL: $COMPILE_SSL" + export CFLAGS="-I/opt/openssl3/include $CFLAGS" + export LD_LIBRARY_PATH="/opt/openssl3/lib64:/opt/openssl3/lib:$HOME/src/ima-evm-utils/src/.libs:$LD_LIBRARY_PATH" + export LDFLAGS="-L/opt/openssl3/lib64 -L/opt/openssl3/lib $LDFLAGS" + export PATH="/opt/openssl3/bin:$HOME/src/ima-evm-utils/src/.libs:$PATH" +fi + case "$VARIANT" in i386) echo "32-bit compilation" diff --git a/src/evmctl.c b/src/evmctl.c index 65e27e1681e7..a6965fde70c1 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2982,8 +2982,10 @@ int main(int argc, char *argv[]) #if CONFIG_IMA_EVM_ENGINE case 139: /* --engine e */ imaevm_params.eng = setup_engine(optarg); - if (!imaevm_params.eng) + if (!imaevm_params.eng) { + log_info("setup_engine failed\n"); goto error; + } break; #endif case 140: /* --xattr-user */ diff --git a/tests/install-openssl3.sh b/tests/install-openssl3.sh index 1b634681a760..911c32bcf87c 100755 --- a/tests/install-openssl3.sh +++ b/tests/install-openssl3.sh @@ -13,7 +13,14 @@ wget --no-check-certificate https://github.com/openssl/openssl/archive/refs/tags tar --no-same-owner -xzf ${version}.tar.gz cd openssl-${version} -./Configure --prefix=/opt/openssl3 --openssldir=/opt/openssl3/ssl +if [ "$VARIANT" = "i386" ]; then + echo "32-bit compilation" + FLAGS="-m32 linux-generic32" +fi + +./Configure $FLAGS no-engine no-dynamic-engine --prefix=/opt/openssl3 --openssldir=/opt/openssl3 +# Uncomment for debugging +# perl configdata.pm --dump | grep engine make -j$(nproc) # only install apps and library sudo make install_sw From patchwork Thu Nov 3 18:39:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13030856 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B1CEC4332F for ; Thu, 3 Nov 2022 18:39:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230433AbiKCSjl (ORCPT ); Thu, 3 Nov 2022 14:39:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229523AbiKCSjk (ORCPT ); Thu, 3 Nov 2022 14:39:40 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0258A100 for ; Thu, 3 Nov 2022 11:39:39 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A3IG2KB020838; Thu, 3 Nov 2022 18:39:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=GMQ7klPrAK8gIF8M2qKmMp7dg+LDA2WtNHFf9z1bTIY=; b=eXtS/IschSddJu50CCBhd8q+Rv9y7zINs51TQ111M1UqBUEfHOePOgr442nM//KygbwM IdfvSSNhvBlKy5t2iz2nXQs8G6WVo+GyTv30P+TSVoY5LAHd4o3H+QLJCGHmjC9HJA0N 9DX2CjCOPooG1yJTMtEXT7v9H7EFPkC6+9Xq4DKI/WfBNM+GAbMdVEi5QMKXETVNR5Sx hwVyeObY29Ix1IjQXd5JL7ekLhsHd2gQMzf09M+knGoEb6e4VMMOWjEJyqANjpANf4Ps 5Y95Ocr6mwTT6eZp67bTOYfyYtLiBMtcs9WuJwb8aaSmHg2/lzVXOvrZX7ybtqbOrfpo 7A== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kmfr0s2pf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:35 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A3IZuS5019577; Thu, 3 Nov 2022 18:39:33 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma03ams.nl.ibm.com with ESMTP id 3kgut918ed-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 03 Nov 2022 18:39:33 +0000 Received: from d06av24.portsmouth.uk.ibm.com (d06av24.portsmouth.uk.ibm.com [9.149.105.60]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A3IdUH58978980 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 3 Nov 2022 18:39:30 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5B16442049; Thu, 3 Nov 2022 18:39:30 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 980C54203F; Thu, 3 Nov 2022 18:39:29 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.20.100]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 3 Nov 2022 18:39:29 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v5 17/17] Make sure the key file is a regular file Date: Thu, 3 Nov 2022 14:39:04 -0400 Message-Id: <20221103183904.103562-18-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221103183904.103562-1-zohar@linux.ibm.com> References: <20221103183904.103562-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: bPPNAmhOCcBJy574DkV9JqxncvpO1woi X-Proofpoint-ORIG-GUID: bPPNAmhOCcBJy574DkV9JqxncvpO1woi X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-03_04,2022-11-03_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 spamscore=0 bulkscore=0 phishscore=0 mlxscore=0 suspectscore=0 priorityscore=1501 malwarescore=0 adultscore=0 clxscore=1015 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211030125 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Before attempting to use the key file, make sure it is a regular file. Signed-off-by: Mimi Zohar Reviewed-by: Stefan Berger --- src/libimaevm.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/libimaevm.c b/src/libimaevm.c index 8070ffd61a2c..c09ed98fe508 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -250,6 +250,7 @@ EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) { FILE *fp; EVP_PKEY *pkey = NULL; + struct stat st; if (!keyfile) return NULL; @@ -261,6 +262,17 @@ EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) return NULL; } + if (fstat(fileno(fp), &st) == -1) { + log_err("Failed to fstat key file: %s\n", keyfile); + goto out; + } + + if ((st.st_mode & S_IFMT) != S_IFREG) { + if (imaevm_params.verbose > LOG_INFO) + log_err("Key file is not regular file: %s\n", keyfile); + goto out; + } + if (x509) { X509 *crt = d2i_X509_fp(fp, NULL);