From patchwork Wed Feb 28 16:14:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13575745 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B95993FB89 for ; Wed, 28 Feb 2024 16:14:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136872; cv=none; b=qanAEixWI9qPW6p/V1UgDwKMPCY2Qo2GULp4FsSQ2M11qw19dr5NbK7yaRZga++8RelDVwFN8foksPh/5f+we2/NcwwYHtc+RmO2/CL0RvN4YJ06QVzUJCicZPQrJel7qtKnQGGN6xhRCJFwtjrTjVKG5if1FiaG779mFMfqvuo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136872; c=relaxed/simple; bh=zMGAVGweC5y/MoocSFCaaMw0eIfXKNEOcdoa4FZ/GyQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NLxx0b/cX1oWXR20vXj5cv4+ICr0z+byizOjcKvJcN6fEwFhKlXvM7wIDbLiEtHBuv5tIj4z+tGq/t4OtcFyRv/w+mI6qydnBlFnfp/+3Ol/YDH2WG21TOg3qA8nPxSfnER37r/ZYblKrLru00hlsJZW3LXXj2zDKpGBoqQriwE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=oNeRGEPM; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="oNeRGEPM" Received: from pps.filterd (m0353727.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41SGCNZw029549; Wed, 28 Feb 2024 16:14:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=2Lz1yA32rQxf186cgFelNmMiudGyBBMc9qhYFADfnxg=; b=oNeRGEPMYM9BF8yZ73I6wXTfl/NywxSY22hhZ+ZhOx4XPP5rWSkRtWfUaCWG+y37frYR 057YKhmzHxxykbLV9exwEK8VJlVoISQAUtQUwjV+LqvHjR9ZfV3RcVF+IJ8aKx9bhCWh RnqaLESc+5A9iMAAIoQ+FAuz1wpccCdntcpqrqdpz7DOIFpS3oBw5tsSSWg0IDh7O3lU 2W6bHIkmV07/0RFKZwavSoBb5vkS/GV+BllZPw6urcQmuKgN2M5gJbTT+PA4noxNFwya C4x8T2SQSirXsivEiqcmIeTclVBlKXbmbFcFnHZuujRM9ylAaQ5T3TNXNuAQInZbH8OQ 5A== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wj850r2jr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:22 +0000 Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41SET1es008189; Wed, 28 Feb 2024 16:14:21 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3wfv9mf6dx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:21 +0000 Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41SGEIsX15336086 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 28 Feb 2024 16:14:20 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 232F45805E; Wed, 28 Feb 2024 16:14:18 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BD4BB58060; Wed, 28 Feb 2024 16:14:17 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 28 Feb 2024 16:14:17 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v4 ima-evm-utils 1/7] tests: Skip pkcs11 test if no engine support in evmctl Date: Wed, 28 Feb 2024 11:14:01 -0500 Message-ID: <20240228161408.284098-2-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240228161408.284098-1-stefanb@linux.ibm.com> References: <20240228161408.284098-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: Iy_EtdfYz2dAyx7XmuJKRMxGfB_d-sk5 X-Proofpoint-GUID: Iy_EtdfYz2dAyx7XmuJKRMxGfB_d-sk5 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-28_08,2024-02-27_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 adultscore=0 mlxscore=0 impostorscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 priorityscore=1501 mlxlogscore=831 bulkscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402280127 Check the evmctl help screen for engine support and skip the pkcs11 test if no engine support is compiled into evmctl. Fixes: c1635add22af ("Disable use of OpenSSL "engine" support") Signed-off-by: Stefan Berger --- tests/sign_verify.test | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 1b6cf2a..16c7ada 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -439,8 +439,14 @@ expect_fail \ # Test signing with key described by pkcs11 URI _softhsm_setup "${WORKDIR}" if [ -n "${PKCS11_KEYURI}" ]; then - expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_KEYURI}" ALG=sha256 PREFIX=0x030204aabbccdd0100 OPTS=--keyid=aabbccdd - expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_KEYURI}" ALG=sha1 PREFIX=0x030202aabbccdd0100 OPTS=--keyid=aabbccdd + if evmctl --help 2>/dev/null | grep -q engine; then + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_KEYURI}" ALG=sha256 PREFIX=0x030204aabbccdd0100 OPTS="--keyid=aabbccdd --engine pkcs11" + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_KEYURI}" ALG=sha1 PREFIX=0x030202aabbccdd0100 OPTS="--keyid=aabbccdd --engine pkcs11" + else + __skip() { echo "pkcs11 test with engine is skipped since there is no engine support"; return "$SKIP"; } + expect_pass __skip + expect_pass __skip + fi else # to have a constant number of tests, skip these two tests __skip() { echo "pkcs11 test is skipped: could not setup softhsm"; return $SKIP; } From patchwork Wed Feb 28 16:14:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13575748 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D89173FB91 for ; Wed, 28 Feb 2024 16:14:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136874; cv=none; b=G0fj+AKf7nK2IFD0dIqvyzC5nVB9d+XPT1dDcsxtcRbFGe54LqDRcYNe0NnAHIYGishwT6UTAr6ERlzYCXgaz5kUYnsTwEq6vHrxuPYud3sJkHTifsC13V+vLUiOqii+EdF4pmc2YLajILOSIP59MV/uYLg2s3ddwl1fmTPZoJo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136874; c=relaxed/simple; bh=lqHtadbXbj6O5W5AQD2ro+GnD+oelkK4JLiRkxslWuA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bHIQYdcdNuff/3W4E5rGtEtSJFvU4SRae8thzaXq/oblnfAvL4NNj5/AJ7RPhPfnK9Dw06YD4QYsoc9fcinL1ejMUlJ5YJmNetDZpc32OB/YMUalTfWwUTGBhjnroxBPwmXY6YdyTol/abXmF7crc3KMEFk/zeXmv/Wkf//8IdU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=N0IeVR8g; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="N0IeVR8g" Received: from pps.filterd (m0353724.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41SG0R93019568; Wed, 28 Feb 2024 16:14:22 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=iiMpBjvXD/UR8dpbjUgqM+fMQVZYnjiYq+nxrAF/NWY=; b=N0IeVR8gzlExKlmKON0jZCARPg2WwBvxajG1KpdDsRmdnkDlFFhSg9WltusRCGTB71GF 0vwOpuaJidifsUuJe3fxocdi3fUPQfIl2ZCe+tuO7zli/erUD3UPQprlJM78Cb83bjrH UuBM6NPhY6sctopFumtu2eSwSiLQiERE/wZ9QC7C/5hdTmaO19XFw57h/v+t4sgRcBlm UI4/wjND0dt5YXudMaotBJCOO4Ro5KCA07T7LaNQhtOgpX5EokBqnps/M84LWFag7CEA HHMmPCoNzBsLEO7VphrERzYXszyMyvEf1GV4kGRODxF1FxjnidA/neMOZAkglfNHRvzq Dg== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wj7yfrfrt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:22 +0000 Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41SDKqcd012332; Wed, 28 Feb 2024 16:14:21 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 3wfwg2euxn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:21 +0000 Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41SGEIdT17171102 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 28 Feb 2024 16:14:20 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9D14158065; Wed, 28 Feb 2024 16:14:18 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3AC7858060; Wed, 28 Feb 2024 16:14:18 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 28 Feb 2024 16:14:18 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v4 ima-evm-utils 2/7] headers: Remove usage of CONFIG_IMA_EVM_ENGINE from public header Date: Wed, 28 Feb 2024 11:14:02 -0500 Message-ID: <20240228161408.284098-3-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240228161408.284098-1-stefanb@linux.ibm.com> References: <20240228161408.284098-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 2SBGpo5u6tkNWNYA2k7vjtROYE8kBR2- X-Proofpoint-ORIG-GUID: 2SBGpo5u6tkNWNYA2k7vjtROYE8kBR2- X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-28_08,2024-02-27_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 clxscore=1015 bulkscore=0 priorityscore=1501 lowpriorityscore=0 phishscore=0 mlxlogscore=879 adultscore=0 malwarescore=0 spamscore=0 impostorscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402280127 An application including the public header imaevm.h won't know whether CONFIG_IMA_EVM_ENGINE was set during compilation of the library, so remove the usage of CONFIG_IMA_EVM_ENGINE from it. An application wanting to use the engine will have to find out whether engine support is compiled-in by invoking library functions and possibly dealing with errors if there's no engine support . Signed-off-by: Stefan Berger --- src/imaevm.h | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/imaevm.h b/src/imaevm.h index 8e24f08..6a52afb 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -48,12 +48,10 @@ #include #include #include -#ifdef CONFIG_IMA_EVM_ENGINE -#include -#endif +#include -#if defined(OPENSSL_NO_ENGINE) || defined(OPENSSL_NO_DYNAMIC_ENGINE) -#undef CONFIG_IMA_EVM_ENGINE +#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) +#include #endif #ifdef USE_FPRINTF From patchwork Wed Feb 28 16:14:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13575744 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 581C53FB88 for ; Wed, 28 Feb 2024 16:14:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136871; cv=none; b=RlbePWhl/lcq24v3lEyL2sJY7bDy7tjoyeppWbPPH3prbld4ffZHPzZA9DpAVLsNdRyloz9gfvZcseFwqYk0Jwipv/6NFNA0CgM/PhFQ29i4KNeAuGMRjKeM/gENF6k8JZQHW0HL+ktHorHjIIA2tDbsKZVWUqxp6ToTvvFRbr8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136871; c=relaxed/simple; bh=B03b7k929AEAfhYUVRh5wP9gHAhUMsy6uQM5ZIHRDN4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ve4p6+DZmOV26Tk1woc+1Mxuu+hljdBfo9UfxK3Tm/qkt5Q0QfI2IIth7YBFTyrCJec9uudelZfzIduYDDfRNbWz1TF5fiiV9W9JuMyxTvP1ZMMAeTAyXi6rDlPxKWwtcos1oMGDj7E1/ePobF5g/zgXAZQLvlMJ/liuG91lsBQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=ZkjWjRFf; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="ZkjWjRFf" Received: from pps.filterd (m0353726.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41SF2LsC010942; Wed, 28 Feb 2024 16:14:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=CPknRpOa10wFam8pn2xknR2UhWgpdeDi5V/GsW5IuVg=; b=ZkjWjRFfDHbrCMebe7oHTUf4/KePKShiyXHbyOthY345IvWojAlbTLb2rmjYAupdRkdV iy8YnUn4HR6I15GLZs0fIxSCT0bdlJfogghx+Du79OtMo3u8FPjP5K3zqmIHdXjmqQqy 47t3o8ov9SJAKW7gAsdCUXw2ZJjQNQv5Z2xRkAkoRFtPKct9mZYVmTWSKOabJGOTYNUL nSTIEk82aNbqELjXV2m+eGnGPP16WGgcswpiajzxQOCcvNpx6awZ86eBBtt4loBYzctv 4pyMbX1rI4n865ORp83+oHtIz0I6/V+JyabKLaYth0tmlxa4vM16i9piqN8/ku3QrdjS Hg== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wj7492s0t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:22 +0000 Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41SDtIVa008802; Wed, 28 Feb 2024 16:14:21 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 3wftstqm1f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:21 +0000 Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41SGEJYH19202604 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 28 Feb 2024 16:14:21 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1D02C58043; Wed, 28 Feb 2024 16:14:19 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B583B58060; Wed, 28 Feb 2024 16:14:18 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 28 Feb 2024 16:14:18 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v4 ima-evm-utils 3/7] Implement imaevm_signhash library function and deprecate sign_hash Date: Wed, 28 Feb 2024 11:14:03 -0500 Message-ID: <20240228161408.284098-4-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240228161408.284098-1-stefanb@linux.ibm.com> References: <20240228161408.284098-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: o1tP0lz66BaCP8qA2MzO50k3O8O10rjP X-Proofpoint-GUID: o1tP0lz66BaCP8qA2MzO50k3O8O10rjP X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-28_08,2024-02-27_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 malwarescore=0 phishscore=0 spamscore=0 adultscore=0 lowpriorityscore=0 suspectscore=0 priorityscore=1501 impostorscore=0 mlxlogscore=999 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402280127 Instead of relying on imaevm_params.engine and imaevm_params.keyid global variables, which are not concurrency-safe, define a new library function imaevm_signhash() function with the engine and keyid as parameters. Pass the ENGINE and keyid all the way through to the function that is using them and deprecate sign_hash since it needs to pass these parameters from the global imaevm_params. In preparation of support for OpenSSL providers, wrap the ENGINE in a union inside a struct imaevm_ossl_access and add a type for the selection of the ENGINE or (OpenSSL) 'provider' later on. Signed-off-by: Stefan Berger --- src/imaevm.h | 26 ++++++++- src/libimaevm.c | 152 +++++++++++++++++++++++++++++++++++------------- 2 files changed, 135 insertions(+), 43 deletions(-) diff --git a/src/imaevm.h b/src/imaevm.h index 6a52afb..6764604 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -51,7 +51,10 @@ #include #if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) -#include +# include +#else +struct engine_st; +typedef struct engine_st ENGINE; /* unused when no engine support */ #endif #ifdef USE_FPRINTF @@ -250,7 +253,9 @@ void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey); int key2bin(RSA *key, unsigned char *pub); uint32_t imaevm_read_keyid(const char *certfile); -int sign_hash(const char *algo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, unsigned char *sig); +IMAEVM_DEPRECATED int sign_hash(const char *algo, const unsigned char *hash, + int size, const char *keyfile, const char *keypass, + unsigned char *sig); IMAEVM_DEPRECATED int ima_calc_hash(const char *file, uint8_t *hash); IMAEVM_DEPRECATED int verify_hash(const char *file, const unsigned char *hash, int size, unsigned char *sig, int siglen); @@ -259,7 +264,24 @@ IMAEVM_DEPRECATED int ima_verify_signature(const char *file, unsigned char *sig, int digestlen); IMAEVM_DEPRECATED void init_public_keys(const char *keyfiles); +struct imaevm_ossl_access { + int type; +#define IMAEVM_OSSL_ACCESS_TYPE_NONE 0 +#define IMAEVM_OSSL_ACCESS_TYPE_ENGINE 1 /* also: engine field exists */ + union { + ENGINE *engine; + } u; +}; + +#define IMAEVM_SIGFLAG_SIGNATURE_V1 (1 << 0) /* v1 signature; deprecated */ +#define IMAEVM_SIGFLAGS_SUPPORT (1 << 0) /* mask of all supported flags */ + int ima_calc_hash2(const char *file, const char *hash_algo, uint8_t *hash); +int imaevm_signhash(const char *hashalgo, const unsigned char *hash, int size, + const char *keyfile, const char *keypass, + unsigned char *sig, long sigflags, + const struct imaevm_ossl_access *access_info, + uint32_t keyid); int imaevm_verify_hash(struct public_key_entry *public_keys, const char *file, const char *hash_algo, const unsigned char *hash, int size, unsigned char *sig, int siglen); diff --git a/src/libimaevm.c b/src/libimaevm.c index ce4f6f7..9dd164e 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -1031,33 +1031,53 @@ uint32_t imaevm_read_keyid(const char *certfile) return ntohl(keyid_be); } -static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) +static EVP_PKEY *read_priv_pkey_engine(ENGINE *e, const char *keyfile, + const char *keypass, uint32_t keyid) { - FILE *fp; - EVP_PKEY *pkey = NULL; - - if (!strncmp(keyfile, "pkcs11:", 7)) { #ifdef CONFIG_IMA_EVM_ENGINE - if (!imaevm_params.keyid) { - log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); - return NULL; - } + EVP_PKEY *pkey; - if (keypass) { - if (!ENGINE_ctrl_cmd_string(imaevm_params.eng, "PIN", keypass, 0)) { - log_err("Failed to set the PIN for the private key\n"); - goto err_engine; - } - } - pkey = ENGINE_load_private_key(imaevm_params.eng, keyfile, NULL, NULL); - if (!pkey) { - log_err("Failed to load private key %s\n", keyfile); + if (!keyid) { + log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); + return NULL; + } + + if (keypass) { + if (!ENGINE_ctrl_cmd_string(e, "PIN", keypass, 0)) { + log_err("Failed to set the PIN for the private key\n"); goto err_engine; } -#else - log_err("OpenSSL \"engine\" support is disabled\n"); + } + pkey = ENGINE_load_private_key(e, keyfile, NULL, NULL); + if (!pkey) { + log_err("Failed to load private key %s\n", keyfile); goto err_engine; + } + return pkey; + +err_engine: + output_openssl_errors(); + return NULL; +#else + log_err("OpenSSL \"engine\" support is disabled\n"); + return NULL; #endif +} + +static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) +{ + FILE *fp; + EVP_PKEY *pkey = NULL; + + if (!strncmp(keyfile, "pkcs11:", 7)) { + switch (access_info->type) { + case IMAEVM_OSSL_ACCESS_TYPE_ENGINE: + pkey = read_priv_pkey_engine(access_info->u.engine, + keyfile, keypass, keyid); + break; + } } else { fp = fopen(keyfile, "r"); if (!fp) { @@ -1076,18 +1096,17 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) return pkey; -err_engine: - output_openssl_errors(); - return NULL; } #if CONFIG_SIGV1 -static RSA *read_priv_key(const char *keyfile, const char *keypass) +static RSA *read_priv_key(const char *keyfile, const char *keypass, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) { EVP_PKEY *pkey; RSA *key; - pkey = read_priv_pkey(keyfile, keypass); + pkey = read_priv_pkey(keyfile, keypass, access_info, keyid); if (!pkey) return NULL; key = EVP_PKEY_get1_RSA(pkey); @@ -1113,7 +1132,9 @@ static int get_hash_algo_v1(const char *algo) static int sign_hash_v1(const char *hashalgo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, - unsigned char *sig) + unsigned char *sig, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) { int len = -1, hashalgo_idx; SHA_CTX ctx; @@ -1147,7 +1168,7 @@ static int sign_hash_v1(const char *hashalgo, const unsigned char *hash, log_info("hash(%s): ", hashalgo); log_dump(hash, size); - key = read_priv_key(keyfile, keypass); + key = read_priv_key(keyfile, keypass, access_info, keyid); if (!key) return -1; @@ -1201,7 +1222,9 @@ out: */ static int sign_hash_v2(const char *algo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, - unsigned char *sig) + unsigned char *sig, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) { struct signature_v2_hdr *hdr; int len = -1; @@ -1211,7 +1234,6 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash, const EVP_MD *md; size_t sigsize; const char *st; - uint32_t keyid; if (!hash) { log_err("sign_hash_v2: hash is null\n"); @@ -1236,7 +1258,7 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash, log_info("hash(%s): ", algo); log_dump(hash, size); - pkey = read_priv_pkey(keyfile, keypass); + pkey = read_priv_pkey(keyfile, keypass, access_info, keyid); if (!pkey) return -1; @@ -1259,8 +1281,8 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash, } #endif - if (imaevm_params.keyid) - keyid = htonl(imaevm_params.keyid); + if (keyid) + keyid = htonl(keyid); else { int keyid_read_failed = read_keyid_from_cert(&keyid, keyfile, false); @@ -1303,20 +1325,68 @@ err: return len; } +static int check_ossl_access(const struct imaevm_ossl_access *access_info) +{ + switch (access_info->type) { + case IMAEVM_OSSL_ACCESS_TYPE_NONE: +#ifdef CONFIG_IMA_EVM_ENGINE + case IMAEVM_OSSL_ACCESS_TYPE_ENGINE: +#endif + return 0; -int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, unsigned char *sig) + default: + errno = EINVAL; + return -1; + } +} + +int imaevm_signhash(const char *hashalgo, const unsigned char *hash, int size, + const char *keyfile, const char *keypass, + unsigned char *sig, long sigflags, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) { - if (!keypass) /* Avoid breaking existing libimaevm usage */ - keypass = imaevm_params.keypass; + int rc; - if (imaevm_params.x509) - return sign_hash_v2(hashalgo, hash, size, keyfile, keypass, sig); + if (access_info) { + rc = check_ossl_access(access_info); + if (rc) + return rc; + } + if (sigflags & ~IMAEVM_SIGFLAGS_SUPPORT) { + /* unsupported flag */ + errno = EINVAL; + return -1; + } + + if (sigflags & IMAEVM_SIGFLAG_SIGNATURE_V1) { #if CONFIG_SIGV1 - else - return sign_hash_v1(hashalgo, hash, size, keyfile, keypass, sig); + return sign_hash_v1(hashalgo, hash, size, keyfile, keypass, sig, + access_info, keyid); +#else + log_info("Signature version 1 deprecated."); + return -1; #endif - log_info("Signature version 1 deprecated."); - return -1; + } + + return sign_hash_v2(hashalgo, hash, size, keyfile, keypass, sig, + access_info, keyid); +} + + +int sign_hash(const char *hashalgo, const unsigned char *hash, int size, + const char *keyfile, const char *keypass, unsigned char *sig) +{ + const struct imaevm_ossl_access access_info = { + .type = IMAEVM_OSSL_ACCESS_TYPE_ENGINE, + .u.engine = imaevm_params.eng, + }; + int sigflags = imaevm_params.x509 ? 0 : IMAEVM_SIGFLAG_SIGNATURE_V1; + if (!keypass) /* Avoid breaking existing libimaevm usage */ + keypass = imaevm_params.keypass; + + return imaevm_signhash(hashalgo, hash, size, keyfile, keypass, sig, + sigflags, &access_info, imaevm_params.keyid); } static void libinit() From patchwork Wed Feb 28 16:14:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13575747 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48A273FB92 for ; Wed, 28 Feb 2024 16:14:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136874; cv=none; b=f/L2LVgTQ/ebda8srD9M1oHYayr3kAQe0iBLfa6P0nI2x6w7B+Sn7zQS+3I65GSQ6k/AxrQ78aF3FwP/8SktvAEVfwuLPxAFQCGZsRMLo6lqQhCfnJ+e3sArUGgEqSscf6onbTrK42zgnxHqSSZMuoe0AjNBvhnJLPNF8aGNNco= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136874; c=relaxed/simple; bh=7aDDw6axSZhIXmeyVJ5X0Ga7FLRTIgt8eeWrnJ8ibFk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pVJg3sJ4d86qrVPe4h9tfs8n+uHFxJsSQzse3pfglUGmSum/OMvNQoIl8OnmXh5crLKaFdAcWH44To88X9jOZYwh7/AxYJHVelhkRIH3ob6SrMVsdN8AnQv7Jyl8f8m14ZSFQHjogBuGxW+8xR34PsMSEE4TBTBvD1zE/2J3Cok= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=XoKdQXvQ; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="XoKdQXvQ" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41SFxJu2008364; Wed, 28 Feb 2024 16:14:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=IjmbAeuFVX32mVIappYWX81tArzk3M87IaPnLUIZL8I=; b=XoKdQXvQvdG+3IgvTk1fJCdA52h+LNfz0geFCXPEj8X8smPvOXma2owjHQ9IuMSBHL3a N1gqa09prCyUUoqKblUs0VTzx59pJiRapu5tqVXiZzXcvlNFRKgWep8PD3Fm+f33XSta k5rgYOh/jPTGd2qOq3hPSN4ypWsalAx3XDa0S+WINUvrcv5Ry3+MTwCrEBjr79sCXzfE ttDiHeY1mXB9iuY9vhBSqYN+IdaMQaeQO561Tna81xk2glQo0GHBa1j5gmt3RxIba1uT C0t4K0lWS4w0hP6ihUCUV3lgVyN9tsLb0gVkyKEp0ikzza+KdaL8Qt98p88IJ4SZoOCC Vg== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wj5epx5tw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:23 +0000 Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41SFlKuc024151; Wed, 28 Feb 2024 16:14:22 GMT Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 3wfw0kf09k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:22 +0000 Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41SGEJu722741664 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 28 Feb 2024 16:14:21 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8E9985805D; Wed, 28 Feb 2024 16:14:19 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3534458055; Wed, 28 Feb 2024 16:14:19 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 28 Feb 2024 16:14:19 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v4 ima-evm-utils 4/7] evmctl: Replace deprecated sign_hash with imaevm_signhash Date: Wed, 28 Feb 2024 11:14:04 -0500 Message-ID: <20240228161408.284098-5-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240228161408.284098-1-stefanb@linux.ibm.com> References: <20240228161408.284098-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: iIub2zbazjihbtF4Yn4RMH2SCvUDDNCF X-Proofpoint-GUID: iIub2zbazjihbtF4Yn4RMH2SCvUDDNCF X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-28_08,2024-02-27_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 clxscore=1015 mlxscore=0 suspectscore=0 bulkscore=0 mlxlogscore=845 adultscore=0 spamscore=0 phishscore=0 malwarescore=0 lowpriorityscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402280127 Replace the deprecated sign_hash with imaevm_signhash. Define local variables to pass the choice of signature version, key id, and whether to use an OpenSSL engine to imaevm_signhash. Signed-off-by: Stefan Berger --- src/evmctl.c | 75 +++++++++++++++++++++++++++++++--------------------- 1 file changed, 45 insertions(+), 30 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index d050b5e..20f34dd 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -147,6 +147,14 @@ static char *g_keypass; #define HMAC_FLAG_CAPS_SET 0x0002 static unsigned long hmac_flags; +static uint32_t imaevm_keyid; +static struct imaevm_ossl_access access_info; +static long sigflags; + +static inline bool use_x509(long sigflags) +{ + return (sigflags & IMAEVM_SIGFLAG_SIGNATURE_V1) == 0; +} typedef int (*find_cb_t)(const char *path); static int find(const char *path, int dts, find_cb_t func); @@ -577,7 +585,8 @@ static int sign_evm(const char *file, char *hash_algo, const char *key) return len; assert(len <= sizeof(hash)); - len = sign_hash(hash_algo, hash, len, key, g_keypass, sig + 1); + len = imaevm_signhash(hash_algo, hash, len, key, g_keypass, + sig + 1, sigflags, &access_info, imaevm_keyid); if (len <= 1) return len; assert(len < sizeof(sig)); @@ -663,7 +672,8 @@ static int sign_ima(const char *file, char *hash_algo, const char *key) return len; assert(len <= sizeof(hash)); - len = sign_hash(hash_algo, hash, len, key, g_keypass, sig + 1); + len = imaevm_signhash(hash_algo, hash, len, key, g_keypass, + sig + 1, sigflags, &access_info, imaevm_keyid); if (len <= 1) return len; assert(len < sizeof(sig)); @@ -844,8 +854,9 @@ static int cmd_sign_hash(struct command *cmd) continue; } - siglen = sign_hash(algo, sigv3_hash, hashlen / 2, - key, g_keypass, sig + 1); + siglen = imaevm_signhash(algo, sigv3_hash, hashlen / 2, + key, g_keypass, sig + 1, sigflags, + &access_info, imaevm_keyid); sig[0] = IMA_VERITY_DIGSIG; sig[1] = DIGSIG_VERSION_3; /* sigv3 */ @@ -856,8 +867,10 @@ static int cmd_sign_hash(struct command *cmd) assert(hashlen / 2 <= sizeof(hash)); hex2bin(hash, line, hashlen / 2); - siglen = sign_hash(g_hash_algo, hash, - hashlen / 2, key, g_keypass, sig + 1); + siglen = imaevm_signhash(g_hash_algo, hash, + hashlen / 2, key, g_keypass, + sig + 1, sigflags, + &access_info, imaevm_keyid); sig[0] = EVM_IMA_XATTR_DIGSIG; } @@ -963,7 +976,7 @@ static int cmd_verify_evm(struct command *cmd) return -1; } - if (imaevm_params.x509) { + if (use_x509(sigflags)) { if (imaevm_params.keyfile) /* Support multiple public keys */ err = imaevm_init_public_keys(imaevm_params.keyfile, &public_keys); @@ -1026,7 +1039,7 @@ static int cmd_verify_ima(struct command *cmd) return -1; } - if (imaevm_params.x509) { + if (use_x509(sigflags)) { if (imaevm_params.keyfile) /* Support multiple public keys */ err = imaevm_init_public_keys(imaevm_params.keyfile, &public_keys); @@ -1061,15 +1074,12 @@ static int cmd_convert(struct command *cmd) uint8_t keyid[8]; RSA *key; - imaevm_params.x509 = 0; - inkey = g_argv[optind++]; if (!inkey) { - inkey = imaevm_params.x509 ? "/etc/keys/x509_evm.der" : - "/etc/keys/pubkey_evm.pem"; + inkey = "/etc/keys/pubkey_evm.pem"; } - key = read_pub_key(inkey, imaevm_params.x509); + key = read_pub_key(inkey, 0); if (!key) return 1; @@ -1094,7 +1104,7 @@ static int cmd_import(struct command *cmd) inkey = g_argv[optind++]; if (!inkey) { - inkey = imaevm_params.x509 ? "/etc/keys/x509_evm.der" : + inkey = use_x509(sigflags) ? "/etc/keys/x509_evm.der" : "/etc/keys/pubkey_evm.pem"; } else ring = g_argv[optind++]; @@ -1124,8 +1134,8 @@ static int cmd_import(struct command *cmd) } } - if (imaevm_params.x509) { - EVP_PKEY *pkey = read_pub_pkey(inkey, imaevm_params.x509); + if (use_x509(sigflags)) { + EVP_PKEY *pkey = read_pub_pkey(inkey, 1); if (!pkey) return 1; @@ -1138,7 +1148,7 @@ static int cmd_import(struct command *cmd) EVP_PKEY_free(pkey); } else { #if CONFIG_SIGV1 - RSA *key = read_pub_key(inkey, imaevm_params.x509); + RSA *key = read_pub_key(inkey, 0); if (!key) return 1; @@ -1153,8 +1163,8 @@ static int cmd_import(struct command *cmd) log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); - id = add_key(imaevm_params.x509 ? "asymmetric" : "user", - imaevm_params.x509 ? NULL : name, pub, len, id); + id = add_key(use_x509(sigflags) ? "asymmetric" : "user", + use_x509(sigflags) ? NULL : name, pub, len, id); if (id < 0) { log_err("add_key failed\n"); err = id; @@ -3106,7 +3116,7 @@ int main(int argc, char *argv[]) hmac_flags |= HMAC_FLAG_NO_UUID; break; case '1': - imaevm_params.x509 = 0; + sigflags |= IMAEVM_SIGFLAG_SIGNATURE_V1; break; case 'k': imaevm_params.keyfile = optarg; @@ -3172,11 +3182,12 @@ int main(int argc, char *argv[]) break; #if CONFIG_IMA_EVM_ENGINE case 139: /* --engine e */ - imaevm_params.eng = setup_engine(optarg); - if (!imaevm_params.eng) { + access_info.u.engine = setup_engine(optarg); + if (!access_info.u.engine) { log_info("setup_engine failed\n"); goto error; } + access_info.type = IMAEVM_OSSL_ACCESS_TYPE_ENGINE; break; #endif case 140: /* --xattr-user */ @@ -3210,7 +3221,7 @@ int main(int argc, char *argv[]) log_err("Invalid keyid value.\n"); exit(1); } - imaevm_params.keyid = keyid; + imaevm_keyid = keyid; break; case 145: keyid = imaevm_read_keyid(optarg); @@ -3218,7 +3229,7 @@ int main(int argc, char *argv[]) log_err("Error reading keyid.\n"); exit(1); } - imaevm_params.keyid = keyid; + imaevm_keyid = keyid; break; case 146: veritysig = 1; @@ -3241,12 +3252,16 @@ int main(int argc, char *argv[]) g_keypass = getenv("EVMCTL_KEY_PASSWORD"); if (imaevm_params.keyfile != NULL && - imaevm_params.eng == NULL && + access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE && !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { #if CONFIG_IMA_EVM_ENGINE - imaevm_params.eng = setup_engine("pkcs11"); + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE) { + access_info.u.engine = setup_engine("pkcs11"); + if (access_info.u.engine) + access_info.type = IMAEVM_OSSL_ACCESS_TYPE_ENGINE; + } #endif - if (!imaevm_params.eng) + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE) goto error; } @@ -3272,9 +3287,9 @@ int main(int argc, char *argv[]) error: #if CONFIG_IMA_EVM_ENGINE - if (imaevm_params.eng) { - ENGINE_finish(imaevm_params.eng); - ENGINE_free(imaevm_params.eng); + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_ENGINE) { + ENGINE_finish(access_info.u.engine); + ENGINE_free(access_info.u.engine); #if OPENSSL_API_COMPAT < 0x10100000L ENGINE_cleanup(); #endif From patchwork Wed Feb 28 16:14:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13575750 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C4F9815DBBB for ; Wed, 28 Feb 2024 16:14:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136875; cv=none; b=siYKRatoAy46sX3sVK7obAe8Zm83PL1uXwyImyLuo1nZhVK6Dxoh91dBM+SdX5VTN/jhzHQxWPbNY5JeJeyR7/BDafK8rMoabaj3PD9cmnan6NA5ZjIDZiSb+VvFXqRRvncq9JPygS41h7s6oFgHBfvyniWjYORSDDaI6SxGWZc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136875; c=relaxed/simple; bh=UFiRbqGYIOkL8jLbqUv3giPfevAuoEOz8SmFW6USPXE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ewNrTMDUcBq5HzOfjMTUyJNxpsig+rHDnVwPW1QhZrktZeyv3picvorT4AVYHIpz++PAUYWIa9HiJsZ3Z1RA8zLDLItO/VmaxskrjVrMHiDGUIb+Lfg7BPQ50WcGCg3DPRSE9pQp4Rr0NlrIxZ7/5v1wCNvji9RoPe0VX1I0zEE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=nZRD8KJ6; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="nZRD8KJ6" Received: from pps.filterd (m0353722.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41SFxOXL017666; Wed, 28 Feb 2024 16:14:24 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=RBKPAFEoRnYfL/G8nQ6qizYGzwXYDByU4hXu/bP2T08=; b=nZRD8KJ6tU3pkg35gFfwG/6lD8FXddX0oLRQ/2hNAZQKpWV6ch4/QcWgHSn+mLs1BzwU 0aEzyuxKettxKEz5eXE4EasmXv8rK1YY5IwU3mloMBuujb/lbPgjelB6KKUciucvN/EM STCvNeRGMFurS1tsE/eIrzkakPjBCDXg6QN25Hkargh1nlw8JWwWdd56h/vquukR0VTQ JYRUbVBK/kRalIWfWG6wQo5CeLdiFg/Z/oGx90/Pe6vjubORwyvK3yppCC8PQFLXaLVw gnX3VV78RcmPgehtR/7r9eDJIUJW8wnsomUou8NXQSKVcLzkeXccGkgAwjMVi36dDdOA Zw== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wj7y4ggek-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:23 +0000 Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41SFlKud024151; Wed, 28 Feb 2024 16:14:23 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 3wfw0kf09m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:22 +0000 Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41SGEKin8127190 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 28 Feb 2024 16:14:22 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0E06D58059; Wed, 28 Feb 2024 16:14:20 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A6A6858055; Wed, 28 Feb 2024 16:14:19 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 28 Feb 2024 16:14:19 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v4 ima-evm-utils 5/7] Add support for OpenSSL provider to the library and evmctl Date: Wed, 28 Feb 2024 11:14:05 -0500 Message-ID: <20240228161408.284098-6-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240228161408.284098-1-stefanb@linux.ibm.com> References: <20240228161408.284098-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: i_t52dGJRxXp1D2VbGdoHIkLRIBpJscv X-Proofpoint-ORIG-GUID: i_t52dGJRxXp1D2VbGdoHIkLRIBpJscv X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-28_08,2024-02-27_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 spamscore=0 mlxlogscore=999 lowpriorityscore=0 impostorscore=0 malwarescore=0 phishscore=0 bulkscore=0 suspectscore=0 priorityscore=1501 clxscore=1015 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402280127 Also implement the --provider option that is useful for testing with provider. It also helps a user to select whether to use an engine or a provider. Update the README with the new option. Signed-off-by: Stefan Berger --- README | 5 ++-- configure.ac | 6 ++++ src/Makefile.am | 21 +++++++++++--- src/evmctl.c | 49 +++++++++++++++++++++++++++++++++ src/imaevm.h | 9 ++++++ src/libimaevm.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 157 insertions(+), 6 deletions(-) diff --git a/README b/README index 54746ef..815b555 100644 --- a/README +++ b/README @@ -69,7 +69,6 @@ OPTIONS --smack use extra SMACK xattrs for EVM --m32 force EVM hmac/signature for 32 bit target system --m64 force EVM hmac/signature for 64 bit target system - --engine e preload OpenSSL engine e (such as: gost) is deprecated --ino use custom inode for EVM --uid use custom UID for EVM --gid use custom GID for EVM @@ -79,9 +78,11 @@ OPTIONS --selinux use custom Selinux label for EVM --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use) --pcrs file containing TPM pcrs, one per hash-algorithm/bank - --ignore-violations ignore ToMToU measurement violations --verify-sig verify the file signature based on the file hash, both stored in the template data. + --engine e preload OpenSSL engine e (such as: gost) is deprecated + --provider p preload OpenSSL provider (such as: pkcs11) + --ignore-violations ignore ToMToU measurement violations --hmackey path to symmetric key (default: /etc/keys/evm-key-plain) -v increase verbosity level -h, --help display this help and exit diff --git a/configure.ac b/configure.ac index 365aacf..d0d2e21 100644 --- a/configure.ac +++ b/configure.ac @@ -61,6 +61,11 @@ AC_ARG_ENABLE(engine, AC_CHECK_LIB([crypto], [ENGINE_init],, [enable_engine=no]) AM_CONDITIONAL([CONFIG_IMA_EVM_ENGINE], [test "x$enable_engine" = "xyes"]) +AC_ARG_ENABLE(provider, + [AS_HELP_STRING([--disable-provider], [build ima-evm-utils without OpenSSL providre support])],,[enable_provider=yes]) + AC_CHECK_LIB([crypto], [OSSL_PROVIDER_load],, [enable_provider=no]) + AM_CONDITIONAL([CONFIG_IMA_EVM_PROVIDER], [test "x$enable_provider" = "xyes"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -99,6 +104,7 @@ echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" echo " sigv1: $enable_sigv1" echo " engine: $enable_engine" +echo " provider: $enable_provider" echo " doc: $have_doc" echo " pandoc: $have_pandoc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 3bf742f..7c3f5fd 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -7,12 +7,18 @@ libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) libimaevm_la_LDFLAGS = -version-info 4:0:0 libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS) +libimaevm_la_CFLAGS = + if CONFIG_SIGV1 -libimaevm_la_CFLAGS = -DCONFIG_SIGV1 +libimaevm_la_CFLAGS += -DCONFIG_SIGV1 endif if CONFIG_IMA_EVM_ENGINE -libimaevm_la_CFLAGS = -DCONFIG_IMA_EVM_ENGINE +libimaevm_la_CFLAGS += -DCONFIG_IMA_EVM_ENGINE +endif + +if CONFIG_IMA_EVM_PROVIDER +libimaevm_la_CFLAGS += -DCONFIG_IMA_EVM_PROVIDER endif include_HEADERS = imaevm.h @@ -30,14 +36,21 @@ evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) evmctl_LDFLAGS = $(LDFLAGS_READLINE) evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la +evmctl_CFLAGS = + # Enable IMA signature version 1 if CONFIG_SIGV1 -evmctl_CFLAGS = -DCONFIG_SIGV1 +evmctl_CFLAGS += -DCONFIG_SIGV1 endif # Enable "--engine" support if CONFIG_IMA_EVM_ENGINE -evmctl_CFLAGS = -DCONFIG_IMA_EVM_ENGINE +evmctl_CFLAGS += -DCONFIG_IMA_EVM_ENGINE +endif + +# Enable "--provider" support +if CONFIG_IMA_EVM_PROVIDER +evmctl_CFLAGS += -DCONFIG_IMA_EVM_PROVIDER endif # USE_PCRTSS uses the Intel TSS diff --git a/src/evmctl.c b/src/evmctl.c index 20f34dd..ffe2fc9 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -68,6 +68,9 @@ #if CONFIG_IMA_EVM_ENGINE #include #endif +#if CONFIG_IMA_EVM_PROVIDER +#include +#endif #include #include "hash_info.h" #include "pcr.h" @@ -2914,6 +2917,9 @@ static void usage(void) " --verify-sig verify measurement list signatures\n" #if CONFIG_IMA_EVM_ENGINE " --engine e preload OpenSSL engine e (such as: gost) is deprecated\n" +#endif +#if CONFIG_IMA_EVM_PROVIDER + " --provider p preload OpenSSL provider (such as: pkcs11)\n" #endif " --ignore-violations ignore ToMToU measurement violations\n" #ifdef DEBUG @@ -2991,6 +2997,9 @@ static struct option opts[] = { {"veritysig", 0, 0, 146}, {"hwtpm", 0, 0, 147}, {"hmackey", 1, 0, 148}, +#if CONFIG_IMA_EVM_PROVIDER + {"provider", 1, 0, 149}, +#endif {} }; @@ -3036,6 +3045,25 @@ static char *get_password(void) return password; } + +#if CONFIG_IMA_EVM_PROVIDER +static OSSL_PROVIDER *setup_provider(const char *name) +{ + OSSL_PROVIDER *p = OSSL_PROVIDER_load(NULL, name); + + if (!p) { + log_err("provider %s isn't available\n", optarg); + ERR_print_errors_fp(stderr); + } else if (!OSSL_PROVIDER_self_test(p)) { + log_err("provider %s self test failed\n", optarg); + ERR_print_errors_fp(stderr); + OSSL_PROVIDER_unload(p); + p = NULL; + } + return p; +} +#endif + #if CONFIG_IMA_EVM_ENGINE static ENGINE *setup_engine(const char *engine_id) { @@ -3240,6 +3268,16 @@ int main(int argc, char *argv[]) case 148: imaevm_params.hmackeyfile = optarg; break; +#if CONFIG_IMA_EVM_PROVIDER + case 149: /* --provider p */ + access_info.u.provider = setup_provider(optarg); + if (!access_info.u.provider) { + log_info("setup_provider failed\n"); + goto error; + } + access_info.type = IMAEVM_OSSL_ACCESS_TYPE_PROVIDER; + break; +#endif case '?': exit(1); break; @@ -3254,6 +3292,13 @@ int main(int argc, char *argv[]) if (imaevm_params.keyfile != NULL && access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE && !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { +#if CONFIG_IMA_EVM_PROVIDER + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE) { + access_info.u.provider = setup_provider("pkcs11"); + if (access_info.u.provider) + access_info.type = IMAEVM_OSSL_ACCESS_TYPE_PROVIDER; + } +#endif #if CONFIG_IMA_EVM_ENGINE if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE) { access_info.u.engine = setup_engine("pkcs11"); @@ -3294,6 +3339,10 @@ error: ENGINE_cleanup(); #endif } +#endif +#if CONFIG_IMA_EVM_PROVIDER + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_PROVIDER) + OSSL_PROVIDER_unload(access_info.u.provider); #endif ERR_free_strings(); EVP_cleanup(); diff --git a/src/imaevm.h b/src/imaevm.h index 6764604..281a748 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -57,6 +57,13 @@ struct engine_st; typedef struct engine_st ENGINE; /* unused when no engine support */ #endif +#if OPENSSL_VERSION_NUMBER >= 0x30000000 +# include +#else +struct ossl_provider_st; +typedef struct ossl_provider_st OSSL_PROVIDER; +#endif + #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ ({ if (level <= imaevm_params.verbose) fprintf(stderr, fmt, ##args); }) @@ -268,8 +275,10 @@ struct imaevm_ossl_access { int type; #define IMAEVM_OSSL_ACCESS_TYPE_NONE 0 #define IMAEVM_OSSL_ACCESS_TYPE_ENGINE 1 /* also: engine field exists */ +#define IMAEVM_OSSL_ACCESS_TYPE_PROVIDER 2 /* also: provider field exists */ union { ENGINE *engine; + OSSL_PROVIDER *provider; } u; }; diff --git a/src/libimaevm.c b/src/libimaevm.c index 9dd164e..89330c4 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -62,6 +62,12 @@ #include #include +#if CONFIG_IMA_EVM_PROVIDER +#include +#include +#include +#endif + #include "imaevm.h" #include "hash_info.h" @@ -1064,6 +1070,64 @@ err_engine: #endif } +#ifdef CONFIG_IMA_EVM_PROVIDER +static int ui_get_pin(UI *ui, UI_STRING *uis) +{ + return UI_set_result(ui, uis, UI_get0_user_data(ui)); +} + +static EVP_PKEY *read_priv_pkey_provider(OSSL_PROVIDER *p, const char *keyfile, + const char *keypass, uint32_t keyid) +{ + UI_METHOD *ui_method = NULL; + OSSL_STORE_INFO *info; + OSSL_STORE_CTX *store; + EVP_PKEY *pkey = NULL; + int typ; + + if (!keyid) { + log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); + return NULL; + } + + if (keypass) { + ui_method = UI_create_method("PIN reader"); + if (!ui_method) + return NULL; + UI_method_set_reader(ui_method, ui_get_pin); + } + store = OSSL_STORE_open_ex(keyfile, NULL, "provider=pkcs11", ui_method, + (void *)keypass, NULL, NULL, NULL); + if (!store) { + log_err("Failed to open store for provider=pkcs11\n"); + goto err_provider; + } + for (info = OSSL_STORE_load(store); + info != NULL && pkey == NULL; + info = OSSL_STORE_load(store)) { + typ = OSSL_STORE_INFO_get_type(info); + + switch (typ) { + case OSSL_STORE_INFO_PKEY: + pkey = OSSL_STORE_INFO_get1_PKEY(info); + break; + } + OSSL_STORE_INFO_free(info); + } + OSSL_STORE_close(store); + + if (!pkey) { + log_err("Failed to load private key %s\n", keyfile); + goto err_provider; + } + return pkey; + +err_provider: + output_openssl_errors(); + return NULL; +} +#endif + static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, const struct imaevm_ossl_access *access_info, uint32_t keyid) @@ -1077,6 +1141,12 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, pkey = read_priv_pkey_engine(access_info->u.engine, keyfile, keypass, keyid); break; +#ifdef CONFIG_IMA_EVM_PROVIDER + case IMAEVM_OSSL_ACCESS_TYPE_PROVIDER: + pkey = read_priv_pkey_provider(access_info->u.provider, + keyfile, keypass, keyid); + break; +#endif } } else { fp = fopen(keyfile, "r"); @@ -1331,6 +1401,9 @@ static int check_ossl_access(const struct imaevm_ossl_access *access_info) case IMAEVM_OSSL_ACCESS_TYPE_NONE: #ifdef CONFIG_IMA_EVM_ENGINE case IMAEVM_OSSL_ACCESS_TYPE_ENGINE: +#endif +#ifdef CONFIG_IMA_EVM_PROVIDER + case IMAEVM_OSSL_ACCESS_TYPE_PROVIDER: #endif return 0; From patchwork Wed Feb 28 16:14:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13575746 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8442415DBBB for ; Wed, 28 Feb 2024 16:14:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136873; cv=none; b=NO0mXNDvYJhQOwWq0r8wLFhEOlNge4iDoJAz6IodNFvpeakuc9l8dz4W7Hl3XkA1lqRRGna6K2mCEt3nFugEIEwnM9OIt7vJw7Lfw6qXMRBLg98PuaX66iX49saj1Kb80sJwvytkXHbT+3uixWZeKDokuxw1rutMAHb3bhr88TE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136873; c=relaxed/simple; bh=AtRW7jklFDL1ukZ9woG1s51F9RTHnmjb+EklXIyhK60=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gvFyTLVvrY6+H8joYNU7G2PqJChPBcSblHLVk73d0s+U+uNAvpgpT2k7lX1BWsphe+ZMSp33Yvc5Tqut84LO0tZQ2Nm7aFzR7AuOPq+RG+1mu1Vx5L8u1whLt2PLOlRB1MLzcAx9DPz0WfQHBU60r4waVSQNz6fiRntgreuXVZ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=MJlcuw5T; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="MJlcuw5T" Received: from pps.filterd (m0353726.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41SF2Knk010867; Wed, 28 Feb 2024 16:14:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=TYF72XV/UoIgUxdKwiHCq1RqywtiOaUr2MpnslvQlTU=; b=MJlcuw5TkiZgXHLvj9XJEcAmsWLuOgLGfuH4WSVNlL5qyylclX6+0Dsp8TswkyoMaEqT qW7711ELNNBEcOYmuXWN8Upu7vlyokl1/vmdlQfbHHVKLXCHeb2A+tv4rDHFwqXt1k/a T7oZF+XlLRp2Zada/yubIhcSzfwZYHGpua4mGP2vIuDmwa9P5SwXPUAOkwSvnOQ9wHB5 vvRy67IFgR5BHLqLbgC5tWn0p9YVo4n7JlaZEDJ7wsbA/ZVJOmFGxhePTBpisi1ieKsc dc/EpgF7aZBMIUvq8mKP6NmF2NwHjIJRtYAeamgc0dFtHZlM2omPGkz/vNCYMbMeQp2T 0A== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wj7492s1x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:25 +0000 Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41SFD6bD008170; Wed, 28 Feb 2024 16:14:23 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3wfv9mf6e4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:23 +0000 Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41SGEKHi9044872 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 28 Feb 2024 16:14:22 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7FC765805E; Wed, 28 Feb 2024 16:14:20 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2633958055; Wed, 28 Feb 2024 16:14:20 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 28 Feb 2024 16:14:20 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v4 ima-evm-utils 6/7] tests: Add pkcs11 test using provider Date: Wed, 28 Feb 2024 11:14:06 -0500 Message-ID: <20240228161408.284098-7-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240228161408.284098-1-stefanb@linux.ibm.com> References: <20240228161408.284098-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: EH6JoA_6z7G0VSPz1cnHtxwZ5boVFLAm X-Proofpoint-GUID: EH6JoA_6z7G0VSPz1cnHtxwZ5boVFLAm X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-28_08,2024-02-27_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0 malwarescore=0 phishscore=0 spamscore=0 adultscore=0 lowpriorityscore=0 suspectscore=0 priorityscore=1501 impostorscore=0 mlxlogscore=999 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402280127 Adjust the existing pkcs11 engine test cases to pass --engine pkcs11 via an option (OPTS) to evmctl rather than using a global variable. Then duplicate the pkcs11 engine tests and pass --provider pkcs11 to run the same tests using OpenSSL provider. Also check whether evmctl was compiled with provider support and if the pkcs11 provider is installed. Signed-off-by: Stefan Berger --- tests/functions.sh | 1 - tests/sign_verify.test | 20 +++++++++++++++++--- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/tests/functions.sh b/tests/functions.sh index c39b894..962a436 100755 --- a/tests/functions.sh +++ b/tests/functions.sh @@ -373,7 +373,6 @@ _softhsm_setup() { PKCS11_KEYURI=$(echo "$msg" | sed -n 's|^keyuri: \(.*\)|\1|p') export PKCS11_KEYURI - export EVMCTL_ENGINE="--engine pkcs11" export OPENSSL_ENGINE="-engine pkcs11" export OPENSSL_KEYFORM="-keyform engine" else diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 16c7ada..f9522e0 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -447,10 +447,24 @@ if [ -n "${PKCS11_KEYURI}" ]; then expect_pass __skip expect_pass __skip fi + + # provider may not be supported or pkcs11 provider not installed + if evmctl --help 2>/dev/null | grep -q provider && \ + openssl list -providers -provider pkcs11 2>/dev/null; then + PKCS11_PRIVKEYURI=${PKCS11_KEYURI//type=public/type=private} + + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_PRIVKEYURI}" ALG=sha256 PREFIX=0x030204aabbccdd0100 OPTS="--keyid=aabbccdd --provider pkcs11" + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_PRIVKEYURI}" ALG=sha1 PREFIX=0x030202aabbccdd0100 OPTS="--keyid=aabbccdd --provider pkcs11" + else + __skip() { echo "pkcs11 test with provider is skipped since no provider support or pkcs11 not installed"; return "$SKIP"; } + expect_pass __skip + expect_pass __skip + fi else # to have a constant number of tests, skip these two tests - __skip() { echo "pkcs11 test is skipped: could not setup softhsm"; return $SKIP; } - expect_pass __skip - expect_pass __skip + __skip() { echo "pkcs11 test is skipped: could not setup softhsm"; return "$SKIP"; } + for i in $(seq 0 3); do + expect_pass __skip + done fi _softhsm_teardown "${WORKDIR}" From patchwork Wed Feb 28 16:14:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13575751 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C52AC3FB97 for ; Wed, 28 Feb 2024 16:14:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136877; cv=none; b=m1PFbycEyWCl+5zEGTuwQUcs4uP+y4ejVV0py4LG5zhosCtDbaB6z8ovMjpB4Ivf/BKAC1dXizFmp78tyoS1PZ+M0VsRtR65BIGvtxF48DCSu4AgsdgSzTFTar4V5nkuAkbl+toYRKDF4r2bkXECcYKTfKbq/2hibIAa+BgIxiM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709136877; c=relaxed/simple; bh=iNA/kc7UPyjMMK2i3x91mmPz5yfBx9he3h/LXxVBrRQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Uq1goZMkh6zQ8OAP57+Vb8Zrdn2FtoXCZbmye+yjgdL5GvJNsw36OSI6kG6LiZo5IU1FO25QEnD68te7jfvcnNIELXsssfvjUdwMJcVBE7pKZvO9RiFz4MQchcr7R1/VdkRUmXbkxZkEfrgkFAwd1b+vl8uSkQ/QTWgsiMOczps= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=KIIh2e6P; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="KIIh2e6P" Received: from pps.filterd (m0353723.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41SFsmpa000418; Wed, 28 Feb 2024 16:14:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=g/mtk9QchJ3u9KHc8aPW5RPudytJFyvaugHvgkEX84A=; b=KIIh2e6PlCLDSi93CTJY7D7/5zJUS1OnH7XnzzQ+YXko0Au3/o6BMAdvRkX8hswXxisQ bHEP1+1a3Wy4sMubT7K6RFMo7Cl8QHzodHqORErm5IlRQqXj2LKphfDHlKY72RoQExgi RyqLmsw/zdLPqR1V9+O88lNSZ49J65IzGBUPMJ3ksZm0x+qx3QgwVMSpIk4TH4kg0uA4 I0Yo2jxAYPk2Ako7ibUAE8N8753dOGM9s18CCeuT3ezhVMFzOJ1guWtALv1lhUV0m1tf Me+ej8WXnzAKnqSfgmCCPEWUkzjU8EWqUe8zt8n451g1DYBpDBDHvG/ULl/5nlUbR+fN Dg== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wj74rtfcf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:24 +0000 Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41SEKc4F021728; Wed, 28 Feb 2024 16:14:24 GMT Received: from smtprelay07.dal12v.mail.ibm.com ([172.16.1.9]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3wfu607fur-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 16:14:24 +0000 Received: from smtpav06.dal12v.mail.ibm.com (smtpav06.dal12v.mail.ibm.com [10.241.53.105]) by smtprelay07.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41SGELc247907508 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 28 Feb 2024 16:14:23 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F16705805F; Wed, 28 Feb 2024 16:14:20 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9779758055; Wed, 28 Feb 2024 16:14:20 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Wed, 28 Feb 2024 16:14:20 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v4 ima-evm-utils 7/7] ci: Install pkcs11-provider where available Date: Wed, 28 Feb 2024 11:14:07 -0500 Message-ID: <20240228161408.284098-8-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240228161408.284098-1-stefanb@linux.ibm.com> References: <20240228161408.284098-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: aLE5tSCh_Yhs3fibUkX9uHu-fsins16c X-Proofpoint-GUID: aLE5tSCh_Yhs3fibUkX9uHu-fsins16c X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-28_08,2024-02-27_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 impostorscore=0 adultscore=0 spamscore=0 clxscore=1015 bulkscore=0 lowpriorityscore=0 phishscore=0 mlxscore=0 priorityscore=1501 mlxlogscore=841 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402280127 Install the pkcs11-provider package. For it to be useful softhsm and gnutls are also needed, so in some cases install them together so that if one of the packages cannot be installed then none of them are installed. Signed-off-by: Stefan Berger --- ci/alt.sh | 2 ++ ci/debian.sh | 1 + ci/fedora.sh | 1 + ci/tumbleweed.sh | 2 ++ 4 files changed, 6 insertions(+) diff --git a/ci/alt.sh b/ci/alt.sh index 36ff657..f86dcec 100755 --- a/ci/alt.sh +++ b/ci/alt.sh @@ -27,3 +27,5 @@ apt-get install -y \ xsltproc \ xxd \ && control openssl-gost enabled + +apt-get install -y pkcs11-provider || true diff --git a/ci/debian.sh b/ci/debian.sh index 7676191..740eb9e 100755 --- a/ci/debian.sh +++ b/ci/debian.sh @@ -59,3 +59,4 @@ $apt \ $apt xxd || $apt vim-common $apt libengine-gost-openssl1.1$ARCH || true $apt softhsm gnutls-bin libengine-pkcs11-openssl1.1$ARCH || true +$apt softhsm gnutls-bin pkcs11-provider || true diff --git a/ci/fedora.sh b/ci/fedora.sh index 1d17c6b..44fd956 100755 --- a/ci/fedora.sh +++ b/ci/fedora.sh @@ -60,6 +60,7 @@ if [ -f /etc/centos-release ]; then yum -y install epel-release fi yum -y install softhsm || true +yum -y install softhsm pkcs11-provider || true # haveged is available via EPEL on CentOS stream8. yum -y install haveged || true diff --git a/ci/tumbleweed.sh b/ci/tumbleweed.sh index bc111fe..a58c296 100755 --- a/ci/tumbleweed.sh +++ b/ci/tumbleweed.sh @@ -48,6 +48,8 @@ zypper --non-interactive install --force-resolution --no-recommends \ zypper --non-interactive install --force-resolution --no-recommends \ gnutls openssl-engine-libp11 softhsm || true +zypper --non-interactive install --force-resolution --no-recommends \ + gnutls pkcs11-provider softhsm || true if [ -f /usr/lib/ibmtss/tpm_server -a ! -e /usr/local/bin/tpm_server ]; then ln -s /usr/lib/ibmtss/tpm_server /usr/local/bin