From patchwork Mon Sep 13 22:18:05 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490865 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55BF1C433EF for ; Mon, 13 Sep 2021 22:18:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2569F61130 for ; Mon, 13 Sep 2021 22:18:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235133AbhIMWTk (ORCPT ); Mon, 13 Sep 2021 18:19:40 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:10674 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S234971AbhIMWTk (ORCPT ); Mon, 13 Sep 2021 18:19:40 -0400 Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DLRBOG011389 for ; Mon, 13 Sep 2021 18:18:23 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=UaalS2r22WhdD/r8737Is/aW7BvuJpNTRAHHqhGcYIU=; b=aZEj8DokKxjfFNYjVR2QJAYwRr22ixDTUa+lDRXMve5smSpWqJUW8X/x/p6VYxd1joG9 blZZWWKa0dYb2ryJajAx8W9IR5kG65rBJymY+3MAkMI7PoXGBZE3j3vPq4t/NT80+VGN ecdiTA1YCKf4jG2yzGFJrfMumSGNuK7Iv3znkEQFqL1KQtU3UA9rD+41LMNkwMoy8II1 hq6dT4wq2S4PKoqLWrKF6U92p2juvq/q5SC4ylo6NmPrr/7+mmJp5n8TvAAGayTSlO3Q oXnUZyAIRUPkML6Dk7D5uKwZdgiWS+wkt2ULzzq1b1zlcOTF8KmFTjLEtkSArYHRvzfL iw== Received: from ppma03dal.us.ibm.com (b.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.11]) by mx0b-001b2d01.pphosted.com with ESMTP id 3b232akacs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:23 -0400 Received: from pps.filterd (ppma03dal.us.ibm.com [127.0.0.1]) by ppma03dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMHkG0020845 for ; Mon, 13 Sep 2021 22:18:22 GMT Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by ppma03dal.us.ibm.com with ESMTP id 3b0m3adawu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:22 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMILaQ51577312 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:21 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1D72CBE058; Mon, 13 Sep 2021 22:18:21 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CB5D7BE05D; Mon, 13 Sep 2021 22:18:20 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:20 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 1/9] evmctl: Implement support for EVMCTL_KEY_PASSWORD environment variable Date: Mon, 13 Sep 2021 18:18:05 -0400 Message-Id: <20210913221813.2554880-2-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: jD2dw7k690TNvs0BSodwGHbGE4953idw X-Proofpoint-ORIG-GUID: jD2dw7k690TNvs0BSodwGHbGE4953idw X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 adultscore=0 spamscore=0 impostorscore=0 mlxscore=0 mlxlogscore=999 lowpriorityscore=0 malwarescore=0 bulkscore=0 priorityscore=1501 clxscore=1015 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130042 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org If the user did not use the --pass option to provide a key password, get the key password from the EVMCTL_KEY_PASSWORD environment variable. Signed-off-by: Stefan Berger --- README | 4 ++++ src/evmctl.c | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/README b/README index 87cd3b5..1cc027f 100644 --- a/README +++ b/README @@ -70,6 +70,10 @@ OPTIONS -v increase verbosity level -h, --help display this help and exit +Environment variables: + +EVMCTL_KEY_PASSWORD : Private key password to use; do not use --pass option + INTRODUCTION ------------ diff --git a/src/evmctl.c b/src/evmctl.c index a8065bb..58f8e66 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2530,6 +2530,9 @@ static void usage(void) " --ignore-violations ignore ToMToU measurement violations\n" " -v increase verbosity level\n" " -h, --help display this help and exit\n" + "\n" + "Environment variables:\n\n" + "EVMCTL_KEY_PASSWORD : Private key password to use; do not use --pass option\n" "\n"); } @@ -2813,6 +2816,9 @@ int main(int argc, char *argv[]) } } + if (!imaevm_params.keypass) + imaevm_params.keypass = getenv("EVMCTL_KEY_PASSWORD"); + if (argv[optind] == NULL) usage(); else From patchwork Mon Sep 13 22:18:06 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490861 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31CE8C433FE for ; Mon, 13 Sep 2021 22:18:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F3783606A5 for ; Mon, 13 Sep 2021 22:18:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234858AbhIMWTk (ORCPT ); Mon, 13 Sep 2021 18:19:40 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:56470 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235133AbhIMWTk (ORCPT ); Mon, 13 Sep 2021 18:19:40 -0400 Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DLMvB1000423 for ; Mon, 13 Sep 2021 18:18:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=N+QaTzX4Nnf6KGCI81/2NJF8rX9m8g9w8NR+FWs/0R8=; b=VJYUOxTqdyHQJ8mYYvjREhFvm7TVci3JNcg58F1cwmlbw8apB7IWae3ZGjYsUlcXpT34 A4u2pyD3Bl6u69tVQD3Kv4dvLBnwBSLVc4ijwvmf2evtoJd2Kh7TvWssf6rlSXKS0u0t Y5HkufEu5d87wFBNvDoeIXfLqH3XC8g8ACCI+ZT1zGyLpiTsPsBOhdI3suDWavQrfBBJ ire31mxn46oHg4H7CdMuyiCuILoZwU4r6EAD2OznhhoWZ5hg+1+S6noN58e5Dj+b6IUv AVfNYT7t1I4qUlC3VwPjJgii7m/XFvmUMOIR0aJroIG+nbYJJAO0IinabfcU3Mvzonaa 7Q== Received: from ppma03wdc.us.ibm.com (ba.79.3fa9.ip4.static.sl-reverse.com [169.63.121.186]) by mx0a-001b2d01.pphosted.com with ESMTP id 3b23hwakxq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:23 -0400 Received: from pps.filterd (ppma03wdc.us.ibm.com [127.0.0.1]) by ppma03wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMHKSN019348 for ; Mon, 13 Sep 2021 22:18:22 GMT Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by ppma03wdc.us.ibm.com with ESMTP id 3b0m3aawq6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:22 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMIL3T53150020 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:21 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7BB16BE05D; Mon, 13 Sep 2021 22:18:21 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 35FA9BE054; Mon, 13 Sep 2021 22:18:21 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:21 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 2/9] evmctl: Handle failure to initialize the openssl engine Date: Mon, 13 Sep 2021 18:18:06 -0400 Message-Id: <20210913221813.2554880-3-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: r7L-FpqGLrPkJQlvbMiju8J7xCaefE19 X-Proofpoint-GUID: r7L-FpqGLrPkJQlvbMiju8J7xCaefE19 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 bulkscore=0 spamscore=0 mlxscore=0 priorityscore=1501 phishscore=0 clxscore=1015 lowpriorityscore=0 mlxlogscore=498 impostorscore=0 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130048 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Handle failure to initialize the openssl engine. For example, $ ./src/evmctl --engine foo engine foo isn't available 140322992015168:error:25066067:DSO support routines:dlfcn_load:could not load the shared library:crypto/dso/dso_dlfcn.c:118:filename(/usr/lib64/engines-1.1/foo.so): /usr/lib64/engines-1.1/foo.so: cannot open shared object file: No such file or directory 140322992015168:error:25070067:DSO support routines:DSO_load:could not load the shared library:crypto/dso/dso_lib.c:162: 140322992015168:error:260B6084:engine routines:dynamic_load:dso not found:crypto/engine/eng_dyn.c:414: 140322992015168:error:2606A074:engine routines:ENGINE_by_id:no such engine:crypto/engine/eng_list.c:334:id=foo Segmentation fault (core dumped) Signed-off-by: Stefan Berger --- src/evmctl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index 58f8e66..ed0ece3 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2765,7 +2765,10 @@ int main(int argc, char *argv[]) ENGINE_free(eng); eng = NULL; } - ENGINE_set_default(eng, ENGINE_METHOD_ALL); + if (eng) + ENGINE_set_default(eng, ENGINE_METHOD_ALL); + else + goto error; break; case 140: /* --xattr-user */ xattr_ima = "user.ima"; @@ -2839,6 +2842,7 @@ int main(int argc, char *argv[]) err = 125; } +error: if (eng) { ENGINE_finish(eng); ENGINE_free(eng); From patchwork Mon Sep 13 22:18:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490863 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 888B5C4332F for ; Mon, 13 Sep 2021 22:18:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6518D610FB for ; Mon, 13 Sep 2021 22:18:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235603AbhIMWTl (ORCPT ); Mon, 13 Sep 2021 18:19:41 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:41246 "EHLO mx0b-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235332AbhIMWTk (ORCPT ); Mon, 13 Sep 2021 18:19:40 -0400 Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DKcgZ9033402 for ; Mon, 13 Sep 2021 18:18:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=hd4ugYZpp2RpvNlnH5eyWkmmkNTfw9p3KghcP9bNUsg=; b=TcvW8HZjr7SD2KgzfItvboGcDXb/p0fXiEcXj9FEY9kQBVRQcctQUOJEhTTpYDw6YJ6O HdPDvm087/IHhd7GU8pCIX2E7jiynWuLq/6+kkZsWVDo1yAERbAB35H7Ape9QB1IYBTt nZzIxHR7r/gEibifnsuTUk5abnmqK5Rgm3EvIF5Xh9gTAr62cYTHDa6izaPvq2EBE7f2 8C/KSxAT4efqxDmnjQqJ5mYuumD1aKptfz06ePBvJWiSBJxHWA7Cpq/g3fHpeh2UnmGy G2r8FZJRFirVeaUnTjb+1amIqfsd2xWEKdebSmyW1R1Mq7ALHwWQud24l1EuvY+J9dw9 ag== Received: from ppma03dal.us.ibm.com (b.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.11]) by mx0a-001b2d01.pphosted.com with ESMTP id 3b232jaqjj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:24 -0400 Received: from pps.filterd (ppma03dal.us.ibm.com [127.0.0.1]) by ppma03dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMHkPc020837 for ; Mon, 13 Sep 2021 22:18:23 GMT Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by ppma03dal.us.ibm.com with ESMTP id 3b0m3adawx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:23 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMILTC54198778 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:22 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DDA6ABE054; Mon, 13 Sep 2021 22:18:21 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9376BBE058; Mon, 13 Sep 2021 22:18:21 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:21 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 3/9] evmctl: Implement function for setting up an OpenSSL engine Date: Mon, 13 Sep 2021 18:18:07 -0400 Message-Id: <20210913221813.2554880-4-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: bsUE4NaFuGynjfefnfXQ9hCAlrtvyUCE X-Proofpoint-ORIG-GUID: bsUE4NaFuGynjfefnfXQ9hCAlrtvyUCE X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 adultscore=0 bulkscore=0 suspectscore=0 impostorscore=0 lowpriorityscore=0 phishscore=0 mlxscore=0 mlxlogscore=854 malwarescore=0 clxscore=1015 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130046 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Move the code that sets up an OpenSSL engine into its own function. Signed-off-by: Stefan Berger --- src/evmctl.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index ed0ece3..4b6f3fb 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2631,6 +2631,23 @@ static char *get_password(void) return pwd; } +static ENGINE *setup_engine(const char *engine_id) +{ + ENGINE *eng = ENGINE_by_id(engine_id); + if (!eng) { + log_err("engine %s isn't available\n", optarg); + ERR_print_errors_fp(stderr); + } else if (!ENGINE_init(eng)) { + log_err("engine %s init failed\n", optarg); + ERR_print_errors_fp(stderr); + ENGINE_free(eng); + eng = NULL; + } + if (eng) + ENGINE_set_default(eng, ENGINE_METHOD_ALL); + return eng; +} + int main(int argc, char *argv[]) { int err = 0, c, lind; @@ -2755,19 +2772,8 @@ int main(int argc, char *argv[]) verify_list_sig = 1; break; case 139: /* --engine e */ - eng = ENGINE_by_id(optarg); - if (!eng) { - log_err("engine %s isn't available\n", optarg); - ERR_print_errors_fp(stderr); - } else if (!ENGINE_init(eng)) { - log_err("engine %s init failed\n", optarg); - ERR_print_errors_fp(stderr); - ENGINE_free(eng); - eng = NULL; - } - if (eng) - ENGINE_set_default(eng, ENGINE_METHOD_ALL); - else + eng = setup_engine(optarg); + if (!eng) goto error; break; case 140: /* --xattr-user */ From patchwork Mon Sep 13 22:18:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490867 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2C75C433F5 for ; Mon, 13 Sep 2021 22:18:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D3EAD610D2 for ; Mon, 13 Sep 2021 22:18:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235332AbhIMWTl (ORCPT ); Mon, 13 Sep 2021 18:19:41 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:33040 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S234971AbhIMWTl (ORCPT ); Mon, 13 Sep 2021 18:19:41 -0400 Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DKxkQt016237 for ; Mon, 13 Sep 2021 18:18:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=wjHGJfLFp5MELLimnys9VLNA1Buz2chGceJe2ZWXMEs=; b=N0LWZOxttIZe5Kmj5mo27yEMGEvVpHDjqiRmGX0BdipqzMlBz4VDD4UF4EWmMhTl86ej fIIdCaHvo2elRymfbZ1CoSB3N5VKqvyU45AeaNzHji7klwIto7jx/HvV7jSxwZfHoJsI ptzqeAPVNnQZTmua//uYAWd63FwZVsAXcDCieBHzvUCnE1ZTri6g0HYNn7153VbgR5X3 cwEtGN0krqEPjA8kfoJe7sVEOTdTu1dnuRBO2LZxTqb3Qd+WyEJJc8pXAVvwq7wP59eG f/I6hufM0aH+x88/WyxbX72Mkq09m2W8btRwq7r7KnGrJKGVjG8uzb9eIWxRiBJo/7pG 4Q== Received: from ppma04wdc.us.ibm.com (1a.90.2fa9.ip4.static.sl-reverse.com [169.47.144.26]) by mx0b-001b2d01.pphosted.com with ESMTP id 3b23jaamnw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:24 -0400 Received: from pps.filterd (ppma04wdc.us.ibm.com [127.0.0.1]) by ppma04wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMHMEP016618 for ; Mon, 13 Sep 2021 22:18:23 GMT Received: from b03cxnp08026.gho.boulder.ibm.com (b03cxnp08026.gho.boulder.ibm.com [9.17.130.18]) by ppma04wdc.us.ibm.com with ESMTP id 3b0m3ajw47-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:23 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp08026.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMIMEC17695164 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:22 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 58D8DBE054; Mon, 13 Sep 2021 22:18:22 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0622DBE06F; Mon, 13 Sep 2021 22:18:22 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:21 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 4/9] evmctl: Define and use an ENGINE field in libimaevm_params Date: Mon, 13 Sep 2021 18:18:08 -0400 Message-Id: <20210913221813.2554880-5-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: pe0jw2u8Z_Lww-ftyKR9qb5axGWk9Gxq X-Proofpoint-ORIG-GUID: pe0jw2u8Z_Lww-ftyKR9qb5axGWk9Gxq X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 phishscore=0 suspectscore=0 impostorscore=0 adultscore=0 spamscore=0 mlxscore=0 bulkscore=0 lowpriorityscore=0 malwarescore=0 clxscore=1015 mlxlogscore=789 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130048 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Extend the global libimaevm_params structure with an ENGINE field 'eng' and use it in place of the local ENGINE variable in main(). Signed-off-by: Stefan Berger --- src/evmctl.c | 11 +++++------ src/imaevm.h | 2 ++ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 4b6f3fb..625a511 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2651,7 +2651,6 @@ static ENGINE *setup_engine(const char *engine_id) int main(int argc, char *argv[]) { int err = 0, c, lind; - ENGINE *eng = NULL; unsigned long keyid; char *eptr; @@ -2772,8 +2771,8 @@ int main(int argc, char *argv[]) verify_list_sig = 1; break; case 139: /* --engine e */ - eng = setup_engine(optarg); - if (!eng) + imaevm_params.eng = setup_engine(optarg); + if (!imaevm_params.eng) goto error; break; case 140: /* --xattr-user */ @@ -2849,9 +2848,9 @@ int main(int argc, char *argv[]) } error: - if (eng) { - ENGINE_finish(eng); - ENGINE_free(eng); + if (imaevm_params.eng) { + ENGINE_finish(imaevm_params.eng); + ENGINE_free(imaevm_params.eng); #if OPENSSL_API_COMPAT < 0x10100000L ENGINE_cleanup(); #endif diff --git a/src/imaevm.h b/src/imaevm.h index 491f136..8792aa2 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -48,6 +48,7 @@ #include #include #include +#include #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ @@ -197,6 +198,7 @@ struct libimaevm_params { const char *keyfile; const char *keypass; uint32_t keyid; /* keyid overriding value, unless 0. (Host order.) */ + ENGINE *eng; }; struct RSA_ASN1_template { From patchwork Mon Sep 13 22:18:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490869 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6719C433EF for ; Mon, 13 Sep 2021 22:18:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BC5DC610E6 for ; Mon, 13 Sep 2021 22:18:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236437AbhIMWTo (ORCPT ); Mon, 13 Sep 2021 18:19:44 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:12632 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235826AbhIMWTm (ORCPT ); Mon, 13 Sep 2021 18:19:42 -0400 Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DItvT8018771 for ; Mon, 13 Sep 2021 18:18:25 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=zhmRYdcCcVsIcOpbpUFCUxi6e2NtUKHwhpB1aId5qxI=; b=KHq1u4FepK8AHGCpAJx+LhEhkkv0bhE+vmoB81tSSgTqyfqhns6UxFD9X0kf0kM7wzDH MdTUSaTmd5E7iZh3AdDuDllh3sXkmlbLZPXwu4EpRsxunNaeE7YUbaYy7GhdGmLF7lpk iGIPxOxmMhYqlYhqQGYd1N28IkiTIVwfZbfm3IES9S8APw1qsOMxxrOmsObcxiVJSdLe KtCZ3KE+FYrZl78a4Df7kpAjSBA99T57n3ThFnZi9t/sntMwvxSVqAh9lWY76xXxkCXr 00TW78+0P6A8looLGMlJb6kJZQAEDKhFSMruc4ycSIDEdrhzSTtBTcNQ6Kn4aBJP39ue 8w== Received: from ppma02dal.us.ibm.com (a.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.10]) by mx0a-001b2d01.pphosted.com with ESMTP id 3b23ha2m5s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:25 -0400 Received: from pps.filterd (ppma02dal.us.ibm.com [127.0.0.1]) by ppma02dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMGoZn032016 for ; Mon, 13 Sep 2021 22:18:24 GMT Received: from b03cxnp08026.gho.boulder.ibm.com (b03cxnp08026.gho.boulder.ibm.com [9.17.130.18]) by ppma02dal.us.ibm.com with ESMTP id 3b0m3ad8dc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:24 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp08026.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMIM1k35717610 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:23 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E153FBE06F; Mon, 13 Sep 2021 22:18:22 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 82C1EBE05D; Mon, 13 Sep 2021 22:18:22 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:22 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 5/9] evmctl: use the pkcs11 engine for pkcs11: prefixed URIs Date: Mon, 13 Sep 2021 18:18:09 -0400 Message-Id: <20210913221813.2554880-6-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: JztyWFDJPvOcE3HyQT1npBVzPrDayY5_ X-Proofpoint-ORIG-GUID: JztyWFDJPvOcE3HyQT1npBVzPrDayY5_ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 clxscore=1015 impostorscore=0 adultscore=0 suspectscore=0 phishscore=0 bulkscore=0 mlxscore=0 mlxlogscore=621 malwarescore=0 spamscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130047 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org If the key has the pkcs11: URI prefix then setup the pkcs11 engine if the user hasn't chosen a specific engine already. Signed-off-by: Stefan Berger --- src/evmctl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index 625a511..5178643 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2827,6 +2827,14 @@ int main(int argc, char *argv[]) if (!imaevm_params.keypass) imaevm_params.keypass = getenv("EVMCTL_KEY_PASSWORD"); + if (imaevm_params.keyfile != NULL && + imaevm_params.eng == NULL && + !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { + imaevm_params.eng = setup_engine("pkcs11"); + if (!imaevm_params.eng) + goto error; + } + if (argv[optind] == NULL) usage(); else From patchwork Mon Sep 13 22:18:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490871 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5553BC433FE for ; Mon, 13 Sep 2021 22:18:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3DE0D610D2 for ; Mon, 13 Sep 2021 22:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234971AbhIMWTo (ORCPT ); Mon, 13 Sep 2021 18:19:44 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:25842 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235916AbhIMWTm (ORCPT ); Mon, 13 Sep 2021 18:19:42 -0400 Received: from pps.filterd (m0098393.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DLEnOk029521 for ; Mon, 13 Sep 2021 18:18:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=TIeTJaxwIkIrl4wrTeOV+87sxLJZ2nQUCDb/tSHV6B8=; b=OK6+/5g0YrdLBgMP0yJq2x4NdRqK46X6YJyQLMCL23TCDsRdVkdPqME1YfXzuGFsR20k vvDQxYCXI2egfPbfJsNqPhLkEWuluVpMdUij54TN1QeEzlKui1pDD49nBQEQiM3CLtyT 9mILCCV3DdOc8jaNNseINFwlAsuFgaRhLGcPYFTMvAYsxB2gbGXpLkVvqgfW0+uNxOkF wZyqkGjfFNEs/VTLRUk+MZBXv8naPLc5ftJINBiCkEPRTeml1cQm9iDjSydGHSIWXK/u dA9Wc54WvFwTpRVn8/dUo/BYNr/6MUudqAieRZeIfADkn0iGL1aGZuoDbgxYpxTod9o/ iA== Received: from ppma01wdc.us.ibm.com (fd.55.37a9.ip4.static.sl-reverse.com [169.55.85.253]) by mx0a-001b2d01.pphosted.com with ESMTP id 3b24779d1f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:25 -0400 Received: from pps.filterd (ppma01wdc.us.ibm.com [127.0.0.1]) by ppma01wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMHkMc030307 for ; Mon, 13 Sep 2021 22:18:24 GMT Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by ppma01wdc.us.ibm.com with ESMTP id 3b0m392y9v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:24 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMINu645285690 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:23 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5AB4ABE05D; Mon, 13 Sep 2021 22:18:23 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 06C7ABE061; Mon, 13 Sep 2021 22:18:23 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:22 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 6/9] libimaevm: Add support for pkcs11 private keys for signing a v2 hash Date: Mon, 13 Sep 2021 18:18:10 -0400 Message-Id: <20210913221813.2554880-7-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 06pZnJ7-amwpgjszupLN7ePdaSV4MQfm X-Proofpoint-ORIG-GUID: 06pZnJ7-amwpgjszupLN7ePdaSV4MQfm X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 malwarescore=0 mlxlogscore=999 suspectscore=0 adultscore=0 mlxscore=0 priorityscore=1501 spamscore=0 impostorscore=0 bulkscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130063 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Add support for pkcs11 private keys for signing a v2 hash. Signed-off-by: Stefan Berger --- README | 1 + src/evmctl.c | 1 + src/libimaevm.c | 47 ++++++++++++++++++++++++++++++++++++----------- 3 files changed, 38 insertions(+), 11 deletions(-) diff --git a/README b/README index 1cc027f..2bb363c 100644 --- a/README +++ b/README @@ -48,6 +48,7 @@ OPTIONS --xattr-user store xattrs in user namespace (for testing purposes) --rsa use RSA key type and signing scheme v1 -k, --key path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem) + or a pkcs11 URI --keyid n overwrite signature keyid with a 32-bit value in hex (for signing) --keyid-from-cert file read keyid value from SKID of a x509 cert file diff --git a/src/evmctl.c b/src/evmctl.c index 5178643..0a54ac3 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2503,6 +2503,7 @@ static void usage(void) " --xattr-user store xattrs in user namespace (for testing purposes)\n" " --rsa use RSA key type and signing scheme v1\n" " -k, --key path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n" + " or a pkcs11 URI\n" " --keyid n overwrite signature keyid with a 32-bit value in hex (for signing)\n" " --keyid-from-cert file\n" " read keyid value from SKID of a x509 cert file\n" diff --git a/src/libimaevm.c b/src/libimaevm.c index 8e96157..6855184 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -60,6 +60,7 @@ #include #include #include +#include #include "imaevm.h" #include "hash_info.h" @@ -804,20 +805,44 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) FILE *fp; EVP_PKEY *pkey; - fp = fopen(keyfile, "r"); - if (!fp) { - log_err("Failed to open keyfile: %s\n", keyfile); - return NULL; - } - pkey = PEM_read_PrivateKey(fp, NULL, NULL, (void *)keypass); - if (!pkey) { - log_err("Failed to PEM_read_PrivateKey key file: %s\n", - keyfile); - output_openssl_errors(); + if (!strncmp(keyfile, "pkcs11:", 7)) { + if (!imaevm_params.keyid) { + log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); + return NULL; + } + + if (keypass) { + if (!ENGINE_ctrl_cmd_string(imaevm_params.eng, "PIN", keypass, 0)) { + log_err("Failed to set the PIN for the private key\n"); + goto err_engine; + } + } + pkey = ENGINE_load_private_key(imaevm_params.eng, keyfile, NULL, NULL); + if (!pkey) { + log_err("Failed to load private key %s\n", keyfile); + goto err_engine; + } + } else { + fp = fopen(keyfile, "r"); + if (!fp) { + log_err("Failed to open keyfile: %s\n", keyfile); + return NULL; + } + pkey = PEM_read_PrivateKey(fp, NULL, NULL, (void *)keypass); + if (!pkey) { + log_err("Failed to PEM_read_PrivateKey key file: %s\n", + keyfile); + output_openssl_errors(); + } + + fclose(fp); } - fclose(fp); return pkey; + +err_engine: + output_openssl_errors(); + return NULL; } static RSA *read_priv_key(const char *keyfile, const char *keypass) From patchwork Mon Sep 13 22:18:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490873 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-21.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD1D2C4332F for ; Mon, 13 Sep 2021 22:18:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A75F5610F9 for ; Mon, 13 Sep 2021 22:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235826AbhIMWTp (ORCPT ); Mon, 13 Sep 2021 18:19:45 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:9422 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237860AbhIMWTn (ORCPT ); Mon, 13 Sep 2021 18:19:43 -0400 Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DLTtQC018005 for ; Mon, 13 Sep 2021 18:18:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=CXrakC8ntfbOCHaCH7cb1zBVokug/IbiYdyLSVBC6Dg=; b=iR86E6UbEbWbcgGUzhFaqGez2YvfK6JzhunP6EkoMVgOlM6gbe2jx0vj1kD3LbBfRRD9 4xQkTtIYo3wni5Azx0ncVH1VJ1W+RLGDOghrDfUzGHEAMIFeZgTwBCYjfp7B42VvEi7Y 9i2pIXPuD16rbYlgthhawWPfvH978phuH6gc+Sz7s9dedAXcSaGHcwrD7YC9i/Ns1BE+ 1E45QN5UOv1UIPD6ia31vhdFxm425hZ0z/EuEjwa3ZJI60ugA3kPefOjkNw6W42wsl4y qn6UjhMo93j3sie5ruEjRjkjyL5MC+KTn+xI7xrDEo44kNwd3Y90LBfe19dPhdlKdaCJ QA== Received: from ppma02dal.us.ibm.com (a.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.10]) by mx0a-001b2d01.pphosted.com with ESMTP id 3b23hdtj3k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:26 -0400 Received: from pps.filterd (ppma02dal.us.ibm.com [127.0.0.1]) by ppma02dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMGprg032043 for ; Mon, 13 Sep 2021 22:18:25 GMT Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by ppma02dal.us.ibm.com with ESMTP id 3b0m3ad8df-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:25 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMINLJ45744396 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:23 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B3760BE054; Mon, 13 Sep 2021 22:18:23 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7683EBE05D; Mon, 13 Sep 2021 22:18:23 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:23 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 7/9] tests: Import softhsm_setup script to enable pkcs11 test case Date: Mon, 13 Sep 2021 18:18:11 -0400 Message-Id: <20210913221813.2554880-8-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: px1kk4ZHR94pbFxPItQsh6NF0Q0fdIXB X-Proofpoint-ORIG-GUID: px1kk4ZHR94pbFxPItQsh6NF0Q0fdIXB X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 mlxlogscore=999 suspectscore=0 mlxscore=0 priorityscore=1501 spamscore=0 impostorscore=0 bulkscore=0 adultscore=0 clxscore=1015 malwarescore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130048 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Import softhsm_setup script from my swtpm project and contribute it to this project under dual license BSD 3-clause and GLP 2.0. Signed-off-by: Stefan Berger --- tests/softhsm_setup | 293 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 293 insertions(+) create mode 100755 tests/softhsm_setup diff --git a/tests/softhsm_setup b/tests/softhsm_setup new file mode 100755 index 0000000..35b1754 --- /dev/null +++ b/tests/softhsm_setup @@ -0,0 +1,293 @@ +#!/usr/bin/env bash + +# SPDX-License-Identifier: GPL-2.0 and BSD-3-clause +# This program originates from 'swtpm' project (https://github.com/stefanberger/swtpm/) + +if [ -z "$(type -P p11tool)" ]; then + echo "Need p11tool from gnutls" + exit 77 +fi + +if [ -z "$(type -P softhsm2-util)" ]; then + echo "Need softhsm2-util from softhsm2 package" + exit 77 +fi + +MAJOR=$(softhsm2-util -v | cut -d '.' -f1) +MINOR=$(softhsm2-util -v | cut -d '.' -f2) +if [ ${MAJOR} -lt 2 ] || [ ${MAJOR} -eq 2 -a ${MINOR} -lt 2 ]; then + echo "Need softhsm v2.2.0 or later" + exit 77 +fi + +NAME=swtpm-test +PIN=${PIN:-1234} +SO_PIN=${SO_PIN:-1234} +SOFTHSM_SETUP_CONFIGDIR=${SOFTHSM_SETUP_CONFIGDIR:-~/.config/softhsm2} +export SOFTHSM2_CONF=${SOFTHSM_SETUP_CONFIGDIR}/softhsm2.conf + +UNAME_S="$(uname -s)" + +case "${UNAME_S}" in +Darwin) + msg=$(sudo -v -n) + if [ $? -ne 0 ]; then + echo "Need password-less sudo rights on OS X to change /etc/gnutls/pkcs11.conf" + exit 1 + fi + ;; +esac + +teardown_softhsm() { + local configdir=${SOFTHSM_SETUP_CONFIGDIR} + local configfile=${SOFTHSM2_CONF} + local bakconfigfile=${configfile}.bak + local tokendir=${configdir}/tokens + + softhsm2-util --token "${NAME}" --delete-token &>/dev/null + + case "${UNAME_S}" in + Darwin*) + if [ -f /etc/gnutls/pkcs11.conf.bak ]; then + sudo rm -f /etc/gnutls/pkcs11.conf + sudo mv /etc/gnutls/pkcs11.conf.bak \ + /etc/gnutls/pkcs11.conf &>/dev/null + fi + ;; + esac + + if [ -f "$bakconfigfile" ]; then + mv "$bakconfigfile" "$configfile" + else + rm -f "$configfile" + fi + if [ -d "$tokendir" ]; then + rm -rf "${tokendir}" + fi + return 0 +} + +setup_softhsm() { + local msg tokenuri keyuri + local configdir=${SOFTHSM_SETUP_CONFIGDIR} + local configfile=${SOFTHSM2_CONF} + local bakconfigfile=${configfile}.bak + local tokendir=${configdir}/tokens + local rc + + case "${UNAME_S}" in + Darwin*) + if [ -f /etc/gnutls/pkcs11.conf.bak ]; then + echo "/etc/gnutls/pkcs11.conf.bak already exists; need to 'teardown' first" + return 1 + fi + sudo mv /etc/gnutls/pkcs11.conf \ + /etc/gnutls/pkcs11.conf.bak &>/dev/null + if [ $(id -u) -eq 0 ]; then + SONAME="$(sudo -u nobody brew ls --verbose softhsm | \ + grep -E "\.so$")" + else + SONAME="$(brew ls --verbose softhsm | \ + grep -E "\.so$")" + fi + sudo mkdir -p /etc/gnutls &>/dev/null + sudo bash -c "echo "load=${SONAME}" > /etc/gnutls/pkcs11.conf" + ;; + esac + + if ! [ -d $configdir ]; then + mkdir -p $configdir + fi + mkdir -p ${tokendir} + + if [ -f $configfile ]; then + mv "$configfile" "$bakconfigfile" + fi + + if ! [ -f $configfile ]; then + cat <<_EOF_ > $configfile +directories.tokendir = ${tokendir} +objectstore.backend = file +log.level = DEBUG +slots.removable = false +_EOF_ + fi + + msg=$(p11tool --list-tokens 2>&1 | grep "token=${NAME}" | tail -n1) + if [ $? -ne 0 ]; then + echo "Could not list existing tokens" + echo "$msg" + fi + tokenuri=$(echo "$msg" | sed -n 's/.*URL: \([[:print:]*]\)/\1/p') + + if [ -z "$tokenuri" ]; then + msg=$(softhsm2-util \ + --init-token --pin ${PIN} --so-pin ${SO_PIN} \ + --free --label ${NAME} 2>&1) + if [ $? -ne 0 ]; then + echo "Could not initialize token" + echo "$msg" + return 2 + fi + + slot=$(echo "$msg" | \ + sed -n 's/.* reassigned to slot \([0-9]*\)$/\1/p') + if [ -z "$slot" ]; then + slot=$(softhsm2-util --show-slots | \ + grep -E "^Slot " | head -n1 | + sed -n 's/Slot \([0-9]*\)/\1/p') + if [ -z "$slot" ]; then + echo "Could not parse slot number from output." + echo "$msg" + return 3 + fi + fi + + msg=$(p11tool --list-tokens 2>&1 | \ + grep "token=${NAME}" | tail -n1) + if [ $? -ne 0 ]; then + echo "Could not list existing tokens" + echo "$msg" + fi + tokenuri=$(echo "$msg" | sed -n 's/.*URL: \([[:print:]*]\)/\1/p') + if [ -z "${tokenuri}" ]; then + echo "Could not get tokenuri!" + return 4 + fi + + # more recent versions of p11tool have --generate-privkey ... + msg=$(GNUTLS_PIN=$PIN p11tool \ + --generate-privkey=rsa --bits 2048 --label mykey --login \ + "${tokenuri}" 2>&1) + if [ $? -ne 0 ]; then + # ... older versions have --generate-rsa + msg=$(GNUTLS_PIN=$PIN p11tool \ + --generate-rsa --bits 2048 --label mykey --login \ + "${tokenuri}" 2>&1) + if [ $? -ne 0 ]; then + echo "Could not create RSA key!" + echo "$msg" + return 5 + fi + fi + fi + + getkeyuri_softhsm $slot + rc=$? + if [ $rc -ne 0 ]; then + teardown_softhsm + fi + + return $rc +} + +_getkeyuri_softhsm() { + local msg tokenuri keyuri + + msg=$(p11tool --list-tokens 2>&1 | grep "token=${NAME}") + if [ $? -ne 0 ]; then + echo "Could not list existing tokens" + echo "$msg" + return 5 + fi + tokenuri=$(echo "$msg" | sed -n 's/.*URL: \([[:print:]*]\)/\1/p') + if [ -z "$tokenuri" ]; then + echo "Could not get token URL" + echo "$msg" + return 6 + fi + msg=$(p11tool --list-all ${tokenuri} 2>&1) + if [ $? -ne 0 ]; then + echo "Could not list object under token $tokenuri" + echo "$msg" + softhsm2-util --show-slots + return 7 + fi + + keyuri=$(echo "$msg" | sed -n 's/.*URL: \([[:print:]*]\)/\1/p') + if [ -z "$keyuri" ]; then + echo "Could not get key URL" + echo "$msg" + return 8 + fi + echo "$keyuri" + return 0 +} + +getkeyuri_softhsm() { + local keyuri rc + + keyuri=$(_getkeyuri_softhsm) + rc=$? + if [ $rc -ne 0 ]; then + return $rc + fi + echo "keyuri: $keyuri?pin-value=${PIN}" #&module-name=softhsm2" + return 0 +} + +getpubkey_softhsm() { + local keyuri rc + + keyuri=$(_getkeyuri_softhsm) + rc=$? + if [ $rc -ne 0 ]; then + return $rc + fi + GNUTLS_PIN=${PIN} p11tool --export-pubkey "${keyuri}" --login 2>/dev/null + return $? +} + +usage() { + cat <<_EOF_ +Usage: $0 [command] + +Supported commands are: + +setup : Setup the user's account for softhsm and create a + token and key with a test configuration + +getkeyuri : Get the key's URI; may only be called after setup + +getpubkey : Get the public key in PEM format; may only be called after setup + +teardown : Remove the temporary softhsm test configuration + +_EOF_ +} + +main() { + local ret + + if [ $# -lt 1 ]; then + usage $0 + echo -e "Missing command.\n\n" + return 1 + fi + case "$1" in + setup) + setup_softhsm + ret=$? + ;; + getkeyuri) + getkeyuri_softhsm + ret=$? + ;; + getpubkey) + getpubkey_softhsm + ret=$? + ;; + teardown) + teardown_softhsm + ret=$? + ;; + *) + echo -e "Unsupported command: $1\n\n" + usage $0 + ret=1 + esac + return $ret +} + +main "$@" +exit $? From patchwork Mon Sep 13 22:18:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490877 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 450C6C43217 for ; Mon, 13 Sep 2021 22:18:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2C354610F9 for ; Mon, 13 Sep 2021 22:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237930AbhIMWTp (ORCPT ); Mon, 13 Sep 2021 18:19:45 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:25584 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238079AbhIMWTn (ORCPT ); Mon, 13 Sep 2021 18:19:43 -0400 Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DLLQ12007398 for ; Mon, 13 Sep 2021 18:18:27 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=6UpEWSACWo3ZcR2iUCGT5FMxDSlvLpgtdl28kqBJ21o=; b=hUFvlksXDzqwuAZ1Qayaff+1AtGVnWdw9UQ7JNYZi0M+4i409pJKuFQpca/WxHqTyNX5 5k2klhSv2UZNZ9oKlrYZioH+nFOVX1sSd879XGm9ndrPfI6a+m/Bx2sIE4IVxivQCB8w lA5XBazJSGIEM3C8L+ODo/UOIX0T1gLRQHJlNsKbRXQ/Nt+NTg1VCaNM1Hm6BociyX6h dUohrdSstCPzu2Dfgc7DrB8omPwKC/SNW9dle6EBABg7+pnjn7EQJPId+KQqb7ECAxEd HGeELLax+wO/I0bQuLkWzkGsJOonwQ8eUQaCflyHxHtkCImdepDGPJJMtqzeafVU3OH3 vg== Received: from ppma01dal.us.ibm.com (83.d6.3fa9.ip4.static.sl-reverse.com [169.63.214.131]) by mx0a-001b2d01.pphosted.com with ESMTP id 3b23ha2m60-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:27 -0400 Received: from pps.filterd (ppma01dal.us.ibm.com [127.0.0.1]) by ppma01dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMHgR1019687 for ; Mon, 13 Sep 2021 22:18:26 GMT Received: from b03cxnp08027.gho.boulder.ibm.com (b03cxnp08027.gho.boulder.ibm.com [9.17.130.19]) by ppma01dal.us.ibm.com with ESMTP id 3b0m3c56ym-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:26 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp08027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMIOnS19858106 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:24 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 26B63BE05D; Mon, 13 Sep 2021 22:18:24 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D59C3BE065; Mon, 13 Sep 2021 22:18:23 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:23 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 8/9] tests: Extend sign_verify test with pkcs11-specific test Date: Mon, 13 Sep 2021 18:18:12 -0400 Message-Id: <20210913221813.2554880-9-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: Y5dXqdwgX2cWZfjfaib3sE6sZRMPvrlp X-Proofpoint-ORIG-GUID: Y5dXqdwgX2cWZfjfaib3sE6sZRMPvrlp X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 clxscore=1015 impostorscore=0 adultscore=0 suspectscore=0 phishscore=0 bulkscore=0 mlxscore=0 mlxlogscore=999 malwarescore=0 spamscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130047 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Extend the sign_verify test with a pkcs11-specific test. Since the openssl command line tool now needs to use a key provided by an engine, extend some command lines with the additional parameters '--keyform engine'. These parameters are passed using the global variable OPENSSL_KEYFORM, which is only set when pkcs11 URIs are used. Signed-off-by: Stefan Berger --- tests/functions.sh | 45 ++++++++++++++++++++++++++++++++++-- tests/ima_hash.test | 2 +- tests/sign_verify.test | 52 ++++++++++++++++++++++++++++++------------ 3 files changed, 82 insertions(+), 17 deletions(-) diff --git a/tests/functions.sh b/tests/functions.sh index 91cd5d9..8f6f02d 100755 --- a/tests/functions.sh +++ b/tests/functions.sh @@ -248,8 +248,12 @@ _enable_gost_engine() { } # Show test stats and exit into automake test system -# with proper exit code (same as ours). -_report_exit() { +# with proper exit code (same as ours). Do cleanups. +_report_exit_and_cleanup() { + if [ -n "${WORKDIR}" ]; then + rm -rf "${WORKDIR}" + fi + if [ $testsfail -gt 0 ]; then echo "=================================" echo " Run with FAILEARLY=1 $0 $*" @@ -272,3 +276,40 @@ _report_exit() { fi } +# Setup SoftHSM for local testing by calling the softhsm_setup script. +# Use the provided workdir as the directory where SoftHSM will store its state +# into. +# Upon successfully setting up SoftHSM, this function sets the global variables +# OPENSSL_ENGINE and OPENSSL_KEYFORM so that the openssl command line tool can +# use SoftHSM. Also the PKCS11_KEYURI global variable is set to the test key's +# pkcs11 URI. +_softhsm_setup() { + local workdir="$1" + + local msg + + export SOFTHSM_SETUP_CONFIGDIR="${workdir}/softhsm" + export SOFTHSM2_CONF="${workdir}/softhsm/softhsm2.conf" + + mkdir -p "${SOFTHSM_SETUP_CONFIGDIR}" + + msg=$(./softhsm_setup setup 2>&1) + if [ $? -eq 0 ]; then + echo "softhsm_setup setup succeeded: $msg" + PKCS11_KEYURI=$(echo $msg | sed -n 's|^keyuri: \(.*\)|\1|p') + + export EVMCTL_ENGINE="--engine pkcs11" + export OPENSSL_ENGINE="-engine pkcs11" + export OPENSSL_KEYFORM="-keyform engine" + else + echo "softhsm_setup setup failed: ${msg}" + fi +} + +# Tear down the SoftHSM setup and clean up the environment +_softhsm_teardown() { + ./softhsm_setup teardown &>/dev/null + rm -rf "${SOFTHSM_SETUP_CONFIGDIR}" + unset SOFTHSM_SETUP_CONFIGDIR SOFTHSM2_CONF PKCS11_KEYURI \ + EVMCTL_ENGINE OPENSSL_ENGINE OPENSSL_KEYFORM +} \ No newline at end of file diff --git a/tests/ima_hash.test b/tests/ima_hash.test index 6e0e463..e88fd59 100755 --- a/tests/ima_hash.test +++ b/tests/ima_hash.test @@ -20,7 +20,7 @@ PATH=../src:$PATH source ./functions.sh _require evmctl openssl getfattr -trap _report_exit EXIT +trap _report_exit_and_cleanup EXIT set -f # disable globbing check() { diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 3b42eec..c56290a 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -28,7 +28,8 @@ fi ./gen-keys.sh >/dev/null 2>&1 -trap _report_exit EXIT +trap _report_exit_and_cleanup EXIT +WORKDIR=$(mktemp -d) set -f # disable globbing # Determine keyid from a cert @@ -132,11 +133,16 @@ check_sign() { # OPTS (additional options for evmctl), # FILE (working file to sign). local "$@" - local KEY=${KEY%.*}.key + local key verifykey local FILE=${FILE:-$ALG.txt} - # Normalize key filename - KEY=test-${KEY#test-} + # Normalize key filename if it's not a pkcs11 URI + if [ ${KEY:0:7} != pkcs11: ]; then + key=${KEY%.*}.key + key=test-${key#test-} + else + key=${KEY} + fi # Append suffix to files for negative tests, because we may # leave only good files for verify tests. @@ -152,33 +158,33 @@ check_sign() { if _test_expected_to_pass; then # Can openssl work with this digest? - cmd="openssl dgst $OPENSSL_ENGINE -$ALG $FILE" + cmd="openssl dgst $OPENSSL_ENGINE $OPENSSL_KEYFORM -$ALG $FILE" echo - "$cmd" if ! $cmd >/dev/null; then - echo "${CYAN}$ALG ($KEY) test is skipped (openssl is unable to digest)$NORM" + echo "${CYAN}$ALG ($key) test is skipped (openssl is unable to digest)$NORM" return "$SKIP" fi - if [ ! -e "$KEY" ]; then - echo "${CYAN}$ALG ($KEY) test is skipped (key file not found)$NORM" + if [ "${key:0:7}" != pkcs11: ] && [ ! -e "$key" ]; then + echo "${CYAN}$ALG ($key) test is skipped (key file not found)$NORM" return "$SKIP" fi # Can openssl sign with this digest and key? - cmd="openssl dgst $OPENSSL_ENGINE -$ALG -sign $KEY -hex $FILE" + cmd="openssl dgst $OPENSSL_ENGINE $OPENSSL_KEYFORM -$ALG -sign $key -hex $FILE" echo - "$cmd" if ! $cmd >/dev/null; then - echo "${CYAN}$ALG ($KEY) test is skipped (openssl is unable to sign)$NORM" + echo "${CYAN}$ALG ($key) test is skipped (openssl is unable to sign)$NORM" return "$SKIP" fi fi # Insert keyid from cert into PREFIX in-place of marker `:K:' if [[ $PREFIX =~ :K: ]]; then - keyid=$(_keyid_from_cert "$KEY") + keyid=$(_keyid_from_cert "$key") if [ $? -ne 0 ]; then color_red - echo "Unable to determine keyid for $KEY" + echo "Unable to determine keyid for $key" color_restore return "$HARDFAIL" fi @@ -187,7 +193,7 @@ check_sign() { fi # Perform signing by evmctl - _evmctl_sign "$TYPE" "$KEY" "$ALG" "$FILE" "$OPTS" || return + _evmctl_sign "$TYPE" "$key" "$ALG" "$FILE" "$OPTS" || return # First simple pattern match the signature. ADD_TEXT_FOR=$ALG \ @@ -207,7 +213,13 @@ check_sign() { _extract_xattr "$FILE" "$(_xattr "$TYPE")" "$FILE.sig2" "$PREFIX" # Verify extracted signature with openssl - cmd="openssl dgst $OPENSSL_ENGINE -$ALG -verify ${KEY%.*}.pub \ + if [ "${key:0:7}" != pkcs11: ]; then + verifykey=${key%.*}.pub + else + verifykey=${key} + fi + + cmd="openssl dgst $OPENSSL_ENGINE $OPENSSL_KEYFORM -$ALG -verify ${verifykey} \ -signature $FILE.sig2 $FILE" echo - "$cmd" if ! $cmd; then @@ -413,3 +425,15 @@ expect_fail \ expect_fail \ check_sign TYPE=ima KEY=gost2012_256-B ALG=md_gost12_512 PREFIX=0x0302 OPTS= +# Test signing with key described by pkcs11 URI +_softhsm_setup "${WORKDIR}" +if [ -n "${PKCS11_KEYURI}" ]; then + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY=${PKCS11_KEYURI} ALG=sha256 PREFIX=0x030204aabbccdd0100 OPTS=--keyid=aabbccdd + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY=${PKCS11_KEYURI} ALG=sha1 PREFIX=0x030202aabbccdd0100 OPTS=--keyid=aabbccdd +else + # to have a constant number of tests, skip these two tests + __skip() { echo "pkcs11 test is skipped: could not setup softhsm"; return $SKIP; } + expect_pass __skip + expect_pass __skip +fi +_softhsm_teardown "${WORKDIR}" From patchwork Mon Sep 13 22:18:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 12490875 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 035A7C433F5 for ; Mon, 13 Sep 2021 22:18:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E1275606A5 for ; Mon, 13 Sep 2021 22:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237860AbhIMWTp (ORCPT ); Mon, 13 Sep 2021 18:19:45 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:34194 "EHLO mx0b-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235947AbhIMWTn (ORCPT ); Mon, 13 Sep 2021 18:19:43 -0400 Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.1.2/8.16.0.43) with SMTP id 18DM7gGK019883 for ; Mon, 13 Sep 2021 18:18:27 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=R8jxx4oEsfcaO/2zaTFo5GLEjSEe2gGwuMFrpAhgPlc=; b=tCrUCQY4ujmhSO1BC9WUF5d767cyYF69+qopcZTUNnN1QmjSwNlIEcITSM/Ln/2J054E U6yVqL80nGSyjCtEn0jDOB1IbbrT0G86JVm8arZPx3PBXajD7z6K4n6cZ6iS17i2hERH eVwnusfL4miq+WTDsTgrVuGdHsUdLbYTge6mCWFvQZCBawKCuaO0DyL4tRfeFHnXP8VI GtJbJfgazbutqAn/vcp4+fqTBr0UigjYHGgUbI7EStfyxMXkxIYLqnQ//VDTD8ojBJCS WMtuUqkkbitSYrsLkvlFGFJsT8R8Dy9U+zcjkcHiIcsdDjhvsYstpTWuwOnQA80X6p0u 0Q== Received: from ppma03dal.us.ibm.com (b.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.11]) by mx0a-001b2d01.pphosted.com with ESMTP id 3b232jaqjy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 18:18:26 -0400 Received: from pps.filterd (ppma03dal.us.ibm.com [127.0.0.1]) by ppma03dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 18DMHkF1021001 for ; Mon, 13 Sep 2021 22:18:26 GMT Received: from b03cxnp08027.gho.boulder.ibm.com (b03cxnp08027.gho.boulder.ibm.com [9.17.130.19]) by ppma03dal.us.ibm.com with ESMTP id 3b0m3adaxp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 13 Sep 2021 22:18:26 +0000 Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp08027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 18DMIOQ916777564 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 13 Sep 2021 22:18:24 GMT Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8DEDBBE054; Mon, 13 Sep 2021 22:18:24 +0000 (GMT) Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3E7FDBE053; Mon, 13 Sep 2021 22:18:24 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP; Mon, 13 Sep 2021 22:18:24 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, Stefan Berger Subject: [PATCH v4 9/9] tests: Get the packages for pkcs11 testing on the CI/CD system Date: Mon, 13 Sep 2021 18:18:13 -0400 Message-Id: <20210913221813.2554880-10-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210913221813.2554880-1-stefanb@linux.ibm.com> References: <20210913221813.2554880-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: iXceF0yaLmTN8PxXoFpXXYi8sSxkgrqG X-Proofpoint-ORIG-GUID: iXceF0yaLmTN8PxXoFpXXYi8sSxkgrqG X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.687,Hydra:6.0.235,FMLib:17.0.607.475 definitions=2020-10-13_15,2020-10-13_02,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 adultscore=0 bulkscore=0 suspectscore=0 impostorscore=0 lowpriorityscore=0 phishscore=0 mlxscore=0 mlxlogscore=999 malwarescore=0 clxscore=1015 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109130046 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Get the packages for pkcs11 testing on the CI/CD system, where available. On those system where it is not available, skip the two tests. The following distros cannot run the pkcs11 tests: - Alpine: package with pkcs11 engine not available - CentOS7: softhsm 2.1.0 is too old for tests to work; tests also fail when trying to sign with pkcs11 URI using openssl command line tool - OpenSuSE Leap: softhsm package not available in main repo Signed-off-by: Stefan Berger --- ci/alt.sh | 3 +++ ci/debian.sh | 3 ++- ci/fedora.sh | 8 ++++++++ ci/tumbleweed.sh | 3 +++ 4 files changed, 16 insertions(+), 1 deletion(-) diff --git a/ci/alt.sh b/ci/alt.sh index 884c995..65389be 100755 --- a/ci/alt.sh +++ b/ci/alt.sh @@ -12,12 +12,15 @@ apt-get install -y \ asciidoc \ attr \ docbook-style-xsl \ + gnutls-utils \ libattr-devel \ libkeyutils-devel \ + libp11 \ libssl-devel \ openssl \ openssl-gost-engine \ rpm-build \ + softhsm \ wget \ xsltproc \ xxd \ diff --git a/ci/debian.sh b/ci/debian.sh index ad7d2c0..ae5c9c1 100755 --- a/ci/debian.sh +++ b/ci/debian.sh @@ -48,7 +48,8 @@ $apt \ procps \ sudo \ wget \ - xsltproc \ + xsltproc $apt xxd || $apt vim-common $apt libengine-gost-openssl1.1$ARCH || true +$apt softhsm gnutls-bin libengine-pkcs11-openssl1.1$ARCH || true diff --git a/ci/fedora.sh b/ci/fedora.sh index 2d80915..0993607 100755 --- a/ci/fedora.sh +++ b/ci/fedora.sh @@ -25,6 +25,7 @@ yum -y install \ automake \ diffutils \ docbook-xsl \ + gnutls-utils \ gzip \ keyutils-libs-devel \ libattr-devel \ @@ -33,6 +34,7 @@ yum -y install \ make \ openssl \ openssl-devel \ + openssl-pkcs11 \ pkg-config \ procps \ sudo \ @@ -42,3 +44,9 @@ yum -y install \ yum -y install docbook5-style-xsl || true yum -y install swtpm || true + +# SoftHSM is available via EPEL on CentOS +if [ -f /etc/centos-release ]; then + yum -y install epel-release +fi +yum -y install softhsm || true \ No newline at end of file diff --git a/ci/tumbleweed.sh b/ci/tumbleweed.sh index dfc478b..4e3da0c 100755 --- a/ci/tumbleweed.sh +++ b/ci/tumbleweed.sh @@ -42,6 +42,9 @@ zypper --non-interactive install --force-resolution --no-recommends \ which \ xsltproc +zypper --non-interactive install --force-resolution --no-recommends \ + gnutls openssl-engine-libp11 softhsm || true + if [ -f /usr/lib/ibmtss/tpm_server -a ! -e /usr/local/bin/tpm_server ]; then ln -s /usr/lib/ibmtss/tpm_server /usr/local/bin fi