From patchwork Tue Aug 30 00:59:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958561 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8790ECAAD2 for ; Tue, 30 Aug 2022 01:00:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229566AbiH3BAH (ORCPT ); Mon, 29 Aug 2022 21:00:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33666 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229524AbiH3BAH (ORCPT ); Mon, 29 Aug 2022 21:00:07 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DE832AC67 for ; Mon, 29 Aug 2022 18:00:02 -0700 (PDT) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0hd0m004307; Tue, 30 Aug 2022 00:59:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=QDqEvRmx2sHEbvegINKQy9QE6tijY13tZK4S82sEnwg=; b=Ha6jFLuvCXcSa2Pfg6hJYXxDO9mVQfGWGRbVBoe7m4M7o9+Cs/pFJeTwa6P5VK+ypX+w ZgdPhfxj4uV39GRL6R5oK32D/XnQf+3BVFhPLr61nuDSRvS26zrgHGZPVuky8B9SbzGk 2J7jTU6eQgkv8jbfntXlMfRnusethohNvRMKYn399XZtwX+YMwrSgSGEqwpV9taCr5O+ aA8xs+YYSlrpB4GKdWnEAAMLIf9vRAAHjWW/Dy2PsL6jxWBdEq3Hnswboju6p4vs9zW9 /bA/vb0R8Mi5zwfcoossZMwQYZX74PrrfS9Q4oiq/I+Lin56WBZvjsVuvlamx6Bp4AVn rQ== Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3j988nrkyq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:53 +0000 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0qSIv016533; Tue, 30 Aug 2022 00:59:51 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma06ams.nl.ibm.com with ESMTP id 3j7ahj2yp3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:51 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U0xmF341222464 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 00:59:48 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F2D18A404D; Tue, 30 Aug 2022 00:59:47 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 87B84A4040; Tue, 30 Aug 2022 00:59:46 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:46 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 01/11] travis: use the distro OpenSSL version on jammy Date: Mon, 29 Aug 2022 20:59:26 -0400 Message-Id: <20220830005936.189922-2-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 9L1LxE_hV4fUSL3s_KWJSt0QmDUTc5qn X-Proofpoint-GUID: 9L1LxE_hV4fUSL3s_KWJSt0QmDUTc5qn X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 adultscore=0 suspectscore=0 mlxlogscore=950 spamscore=0 mlxscore=0 priorityscore=1501 malwarescore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Use the distro OpenSSL version on jammy, which is newer than OpenSSL 3-beta. Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 5741116e418a..b18c871be200 100644 --- a/.travis.yml +++ b/.travis.yml @@ -40,7 +40,7 @@ matrix: compiler: gcc - os: linux - env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=ubuntu:jammy TSS=ibmtss compiler: gcc - os: linux From patchwork Tue Aug 30 00:59:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958563 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC388ECAAD2 for ; Tue, 30 Aug 2022 01:00:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229535AbiH3BAJ (ORCPT ); Mon, 29 Aug 2022 21:00:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33662 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229536AbiH3BAH (ORCPT ); Mon, 29 Aug 2022 21:00:07 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62EC93AB1B for ; Mon, 29 Aug 2022 18:00:00 -0700 (PDT) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0i7vX019642; Tue, 30 Aug 2022 00:59:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=d2JRGttx4aLasheShakdOX5DSzAOzjQwpBFvgckoOZA=; b=iDr6NvwZmeKYk82og9Xh/4+1iJaJ6I7l2CknbSWGzSALFj/bNRlOFRMP7BC7z0TOdRYt UhN3c5vYHEGgQI+QpnOoakxf0y9y+ephGOJRVp9QTTbw+xkgiOl/iDaxqjJCIujt/HkZ N4ObyWwhZ+mBNiy7uoHCSzm5NiVUm8xa6oEdjn/q9gXuyLhSupW1A94yscGe9qndyShw R0c/5Rqp1NVpcT5pvRtbs3qrgOJilNgZFJOItVduI8B1+w/jkzcG/T21zRQOW0I/s/lM /pBHWylv2b/dy1jGJe6hpA3vG0Z30k2sv0GDbNbm8uFLIrbkTQBfeF/B0BfQYQ3QBrfE +w== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3j988urjvf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:55 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0pj56027789; Tue, 30 Aug 2022 00:59:53 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma04ams.nl.ibm.com with ESMTP id 3j7aw8txtw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:53 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U0xn7Q31195560 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 00:59:49 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9E16BA404D; Tue, 30 Aug 2022 00:59:49 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 61412A4040; Tue, 30 Aug 2022 00:59:48 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:48 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 02/11] travis: update dist=focal Date: Mon, 29 Aug 2022 20:59:27 -0400 Message-Id: <20220830005936.189922-3-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: XtEE-3zrefHlm7ncCrAz_tFSE4bz2JWG X-Proofpoint-ORIG-GUID: XtEE-3zrefHlm7ncCrAz_tFSE4bz2JWG X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 impostorscore=0 mlxscore=0 bulkscore=0 phishscore=0 clxscore=1015 mlxlogscore=870 suspectscore=0 adultscore=0 priorityscore=1501 spamscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Although Github Actions is GA within Github Enterprise Server 3.x single server edition, it is not available in Github Enterprise Server 3.x cluster edition[1]. Continue to support travis. [1] https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#github-packages Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index b18c871be200..cc76c0adb312 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,6 @@ # Copyright (c) 2017-2021 Petr Vorel -dist: bionic +dist: focal language: C services: - docker From patchwork Tue Aug 30 00:59:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958565 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14AC7C0502C for ; Tue, 30 Aug 2022 01:00:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229564AbiH3BAM (ORCPT ); Mon, 29 Aug 2022 21:00:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33780 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229572AbiH3BAI (ORCPT ); Mon, 29 Aug 2022 21:00:08 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6269532ED5 for ; Mon, 29 Aug 2022 18:00:00 -0700 (PDT) Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0oqNL018887; Tue, 30 Aug 2022 00:59:56 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=F6g08bstbjBYla0RuIzo0kuoPFSx0ABWOLUJfJob9Dw=; b=GFF3RZ33i4ngEwSD5P8JtQxa+LRgpjNSyD9ZOGtNYRu+eIds45rmp7EPLQvP+jWLVOdA ABQcfetaWpcBVX70l2Kf6pM/FxlDXSRquGpQqwK4Iew3n15l1h7t/ajLbyUk0QwKulyt rSmZ6mGBWQgUAOmhuFdz9t7sN3U59iB1OIM0enyGWBdSJ1GLIyFc9ZqBjQyQDx8Hmluz D97ccsV4BKg8lGu0U43zZf81qNGBqXeE3ABVthQ6vryMuwCxkYNZBWdnwdPaemCVtD9y tQ8CF6yg5MzuRjx4zhK4qyx277gCoTW4QKY4Q7irIp/QImCA21+ybABXezuPdDED3UT3 EQ== Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3j98c5r9e7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:56 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0o8d6006549; Tue, 30 Aug 2022 00:59:54 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma05fra.de.ibm.com with ESMTP id 3j7aw8t5hw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:54 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U0ucug43450734 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 00:56:38 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2134EA4051; Tue, 30 Aug 2022 00:59:51 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EA121A4040; Tue, 30 Aug 2022 00:59:49 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:49 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 03/11] Update configure.ac to address a couple of obsolete warnings Date: Mon, 29 Aug 2022 20:59:28 -0400 Message-Id: <20220830005936.189922-4-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: XC9Gx4ypQ0zLMuhAJF19yWeK3YhLqGM6 X-Proofpoint-GUID: XC9Gx4ypQ0zLMuhAJF19yWeK3YhLqGM6 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 clxscore=1015 mlxscore=0 mlxlogscore=999 impostorscore=0 adultscore=0 phishscore=0 suspectscore=0 priorityscore=1501 bulkscore=0 malwarescore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Remove AC_PROG_LIBTOOL and AC_HEAD_STDC. Replace AC_HELP_STRING with AS_HELP_STRING. Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- acinclude.m4 | 2 +- configure.ac | 4 ---- m4/manpage-docbook-xsl.m4 | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/acinclude.m4 b/acinclude.m4 index dd430d4f0565..bb962f81a9c0 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -2,7 +2,7 @@ AC_DEFUN([PKG_ARG_ENABLE], [ AC_MSG_CHECKING(whether to enable $1) - AC_ARG_ENABLE([$1], AC_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), + AC_ARG_ENABLE([$1], AS_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), [pkg_cv_enable_$1=$enableval], [AC_CACHE_VAL([pkg_cv_enable_$1], [pkg_cv_enable_$1=$2])]) if test $pkg_cv_enable_$1 = yes; then diff --git a/configure.ac b/configure.ac index 1a0f093df562..9d3b23ff8def 100644 --- a/configure.ac +++ b/configure.ac @@ -15,16 +15,12 @@ AM_PROG_CC_C_O #AC_PROG_CXX #AC_PROG_CPP AC_PROG_INSTALL -AC_PROG_LIBTOOL #AC_PROG_LN_S LT_INIT # FIXME: Replace `main' with a function in `-lpthread': #AC_CHECK_LIB([pthread], [main]) -# Checks for header files. -AC_HEADER_STDC - PKG_CHECK_MODULES(LIBCRYPTO, [libcrypto >= 0.9.8 ]) AC_SUBST(KERNEL_HEADERS) AC_CHECK_HEADER(unistd.h) diff --git a/m4/manpage-docbook-xsl.m4 b/m4/manpage-docbook-xsl.m4 index 25c8ce54b068..f2ee912ed1be 100644 --- a/m4/manpage-docbook-xsl.m4 +++ b/m4/manpage-docbook-xsl.m4 @@ -7,7 +7,7 @@ AC_DEFUN([EVMCTL_MANPAGE_DOCBOOK_XSL], [ AC_PATH_PROGS(XMLCATALOG, xmlcatalog) AC_ARG_WITH([xml-catalog], - AC_HELP_STRING([--with-xml-catalog=CATALOG], + AS_HELP_STRING([--with-xml-catalog=CATALOG], [path to xml catalog to use]),, [with_xml_catalog=/etc/xml/catalog]) XML_CATALOG_FILE="$with_xml_catalog" From patchwork Tue Aug 30 00:59:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958567 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66581C0502E for ; Tue, 30 Aug 2022 01:00:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229536AbiH3BAL (ORCPT ); Mon, 29 Aug 2022 21:00:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33672 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229564AbiH3BAH (ORCPT ); Mon, 29 Aug 2022 21:00:07 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E60F5466B for ; Mon, 29 Aug 2022 18:00:04 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0o8H4020670; Tue, 30 Aug 2022 00:59:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=O2jZnZrnQdOd6rby7QocBMeJrgkBJAe8VcO4oW4dQa0=; b=CWMql7omuKjfyVlsnhG1VZTtJWNrCtEjRaRZ3jc5z67bMKQ9/GqJrQ2DWDEcVqJRjTks dQ6OhKO2hyo1kUu6QszeHiUD7w37CVxMYyftqz6CcpXGuGQdQwh5ALM/yPHNL3GT+1YV NGmK7X2lsUzpWi4a2RDepTLtWsLNHkPguSRXObmU7exE9J1IMO6BdDUvil208jkfQ8BY oOTQ/OLLNFWD9xyNlVSPw6pdmVFy4xGMdYRvgKYtVfbMY9FoA8bUSnHb708vo85LefJ2 i0enoz/O3Cr5TWSQADqNk1iHUMRrNmqhkqrsXiUHfHpCbQR8qSQvfGAcSK88QmG7I20X dg== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3j98bn8aav-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:58 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0oCgG012775; Tue, 30 Aug 2022 00:59:56 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma06fra.de.ibm.com with ESMTP id 3j7ahht5kd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:56 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U0xrmU21692684 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 00:59:53 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DCCBFA404D; Tue, 30 Aug 2022 00:59:52 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 732E0A4040; Tue, 30 Aug 2022 00:59:51 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:51 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 04/11] Deprecate IMA signature version 1 Date: Mon, 29 Aug 2022 20:59:29 -0400 Message-Id: <20220830005936.189922-5-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: l-XZU4o1ma6DpkOAXfUgx-QI7kGtMEdS X-Proofpoint-GUID: l-XZU4o1ma6DpkOAXfUgx-QI7kGtMEdS X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 mlxscore=0 lowpriorityscore=0 clxscore=1015 bulkscore=0 malwarescore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The original IMA file signatures were based on a SHA1 hash. Kernel support for other hash algorithms was subsequently upstreamed. Deprecate "--rsa" support. Define "--enable-sigv1" option to configure signature v1 support. Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- configure.ac | 6 ++++++ src/Makefile.am | 10 ++++++++++ src/evmctl.c | 16 ++++++++++++---- src/libimaevm.c | 24 ++++++++++++++++++++++-- tests/sign_verify.test | 18 ++++++++++++------ 5 files changed, 62 insertions(+), 12 deletions(-) diff --git a/configure.ac b/configure.ac index 9d3b23ff8def..dc666f2bb1fa 100644 --- a/configure.ac +++ b/configure.ac @@ -49,6 +49,11 @@ AC_ARG_ENABLE([openssl_conf], AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by evmctl.]) fi], [enable_openssl_conf=yes]) +AC_ARG_ENABLE(sigv1, + AS_HELP_STRING([--enable-sigv1], [Build ima-evm-utils with signature v1 support])) + AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) + AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -83,5 +88,6 @@ echo " openssl-conf: $enable_openssl_conf" echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" +echo " sigv1: $enable_sigv1" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 396496bb439d..90c7249020cf 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -7,6 +7,10 @@ libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) libimaevm_la_LDFLAGS = -version-info 3:0:0 libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS) +if CONFIG_SIGV1 +libimaevm_la_CFLAGS = -DCONFIG_SIGV1 +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -22,6 +26,12 @@ evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) evmctl_LDFLAGS = $(LDFLAGS_READLINE) evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la +# Enable IMA signature version 1 +if CONFIG_SIGV1 +evmctl_CFLAGS = -DCONFIG_SIGV1 +endif + + # USE_PCRTSS uses the Intel TSS if USE_PCRTSS evmctl_SOURCES += pcr_tss.c diff --git a/src/evmctl.c b/src/evmctl.c index 76e2561798fa..621136b5b85f 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -987,7 +987,6 @@ static int cmd_verify_ima(struct command *cmd) init_public_keys("/etc/keys/x509_evm.der"); } - errno = 0; if (!file) { log_err("Parameters missing\n"); print_usage(cmd); @@ -1006,6 +1005,7 @@ static int cmd_verify_ima(struct command *cmd) static int cmd_convert(struct command *cmd) { +#if CONFIG_SIGV1 char *inkey; unsigned char _pub[1024], *pub = _pub; int len, err = 0; @@ -1033,6 +1033,8 @@ static int cmd_convert(struct command *cmd) RSA_free(key); return err; +#endif + return 77; } static int cmd_import(struct command *cmd) @@ -1088,6 +1090,7 @@ static int cmd_import(struct command *cmd) calc_keyid_v2((uint32_t *)keyid, name, pkey); EVP_PKEY_free(pkey); } else { +#if CONFIG_SIGV1 RSA *key = read_pub_key(inkey, imaevm_params.x509); if (!key) @@ -1095,6 +1098,10 @@ static int cmd_import(struct command *cmd) len = key2bin(key, pub); calc_keyid_v1(keyid, name, pub, len); RSA_free(key); +#else + log_info("Importing public RSA key not supported\n"); + return 1; +#endif } log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); @@ -2598,7 +2605,8 @@ static void usage(void) " -d, --imahash make IMA hash\n" " -f, --sigfile store IMA signature in .sig file instead of xattr\n" " --xattr-user store xattrs in user namespace (for testing purposes)\n" - " --rsa use RSA key type and signing scheme v1\n" + + " --rsa use RSA key type and signing scheme v1 (deprecated)\n" " -k, --key path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n" " or a pkcs11 URI\n" " --keyid n overwrite signature keyid with a 32-bit value in hex (for signing)\n" @@ -2637,8 +2645,8 @@ static void usage(void) struct command cmds[] = { {"--version", NULL, 0, ""}, {"help", cmd_help, 0, ""}, - {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring.\n"}, - {"convert", cmd_convert, 0, "key", "convert public key into the keyring.\n"}, + {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring. (deprecated)\n"}, + {"convert", cmd_convert, 0, "key", "convert public key into the keyring. (deprecated)\n"}, {"sign", cmd_sign_evm, 0, "[-r] [--imahash | --imasig ] [--key key] [--pass [password] file", "Sign file metadata.\n"}, {"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"}, {"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--key key] [--pass [password] file", "Make file content signature.\n"}, diff --git a/src/libimaevm.c b/src/libimaevm.c index e4b62b4989b2..cb815f953a80 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -294,8 +294,9 @@ out: RSA *read_pub_key(const char *keyfile, int x509) { + RSA *key = NULL; +#if CONFIG_SIGV1 EVP_PKEY *pkey; - RSA *key; pkey = read_pub_pkey(keyfile, x509); if (!pkey) @@ -307,9 +308,11 @@ RSA *read_pub_key(const char *keyfile, int x509) output_openssl_errors(); return NULL; } +#endif return key; } +#if CONFIG_SIGV1 static int verify_hash_v1(const char *file, const unsigned char *hash, int size, unsigned char *sig, int siglen, const char *keyfile) { @@ -351,6 +354,7 @@ static int verify_hash_v1(const char *file, const unsigned char *hash, int size, return 0; } +#endif struct public_key_entry { struct public_key_entry *next; @@ -686,6 +690,7 @@ int verify_hash(const char *file, const unsigned char *hash, int size, { /* Get signature type from sig header */ if (sig[1] == DIGSIG_VERSION_1) { +#if CONFIG_SIGV1 const char *key = NULL; /* Read pubkey from RSA key */ @@ -695,6 +700,10 @@ int verify_hash(const char *file, const unsigned char *hash, int size, key = imaevm_params.keyfile; return verify_hash_v1(file, hash, size, sig + 1, siglen - 1, key); +#else + log_info("Signature version 1 deprecated."); + return -1; +#endif } else if (sig[1] == DIGSIG_VERSION_2) { return verify_hash_v2(file, hash, size, sig, siglen); } else if (sig[1] == DIGSIG_VERSION_3) { @@ -747,6 +756,7 @@ int ima_verify_signature(const char *file, unsigned char *sig, int siglen, */ int key2bin(RSA *key, unsigned char *pub) { +#if CONFIG_SIGV1 int len, b, offset = 0; struct pubkey_hdr *pkh = (struct pubkey_hdr *)pub; const BIGNUM *n, *e; @@ -781,10 +791,14 @@ int key2bin(RSA *key, unsigned char *pub) offset += len; return offset; +#else + return 77; /* SKIP */ +#endif } void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len) { +#if CONFIG_SIGV1 uint8_t sha1[SHA_DIGEST_LENGTH]; uint64_t id; @@ -799,6 +813,7 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len if (imaevm_params.verbose > LOG_INFO) log_info("keyid-v1: %s\n", str); +#endif } /* @@ -990,10 +1005,11 @@ err_engine: return NULL; } +#if CONFIG_SIGV1 static RSA *read_priv_key(const char *keyfile, const char *keypass) { + RSA *key = NULL; EVP_PKEY *pkey; - RSA *key; pkey = read_priv_pkey(keyfile, keypass); if (!pkey) @@ -1018,10 +1034,12 @@ static int get_hash_algo_v1(const char *algo) return -1; } +#endif static int sign_hash_v1(const char *hashalgo, const unsigned char *hash, int size, const char *keyfile, unsigned char *sig) { +#if CONFIG_SIGV1 int len = -1, hashalgo_idx; SHA_CTX ctx; unsigned char pub[1024]; @@ -1099,6 +1117,8 @@ static int sign_hash_v1(const char *hashalgo, const unsigned char *hash, out: RSA_free(key); return len; +#endif + return 77; /* SKIP */ } /* diff --git a/tests/sign_verify.test b/tests/sign_verify.test index c56290aa4932..948892759424 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -17,6 +17,7 @@ cd "$(dirname "$0")" || exit 1 PATH=../src:$PATH +SIGV1=0 source ./functions.sh _require cmp evmctl getfattr openssl xxd @@ -368,13 +369,18 @@ try_different_sigs() { ## Test v1 signatures # Signature v1 only supports sha1 and sha256 so any other should fail -expect_fail \ - check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa +if [ $SIGV1 -eq 0 ]; then + __skip() { echo "IMA signature v1 tests are skipped: not supported"; return $SKIP; } + expect_pass __skip +else + expect_fail \ + check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa -sign_verify rsa1024 sha1 0x0301 --rsa -sign_verify rsa1024 sha256 0x0301 --rsa - try_different_keys - try_different_sigs + sign_verify rsa1024 sha1 0x0301 --rsa + sign_verify rsa1024 sha256 0x0301 --rsa + try_different_keys + try_different_sigs +fi ## Test v2 signatures with RSA PKCS#1 # List of allowed hashes much greater but not all are supported. From patchwork Tue Aug 30 00:59:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958562 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FAD3ECAAD3 for ; Tue, 30 Aug 2022 01:00:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229556AbiH3BAJ (ORCPT ); Mon, 29 Aug 2022 21:00:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33668 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229535AbiH3BAH (ORCPT ); Mon, 29 Aug 2022 21:00:07 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4906B2AC74 for ; Mon, 29 Aug 2022 18:00:04 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0o6kZ020611; Tue, 30 Aug 2022 00:59:59 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=d8KrJptHY3H/kikZKcZrFwwgcat/58SsH9Gd3YF2zH8=; b=mrs4IObBbjcL93tdPO+MNN8eYxOhobROy1nOfq7sgpQGBpE4K3jJR9dCmYvAuyZvk8iH DSWjLt3HcMQ7T3BWg7dhkrowsukQvsPY/9A36916++APF25NILEk9cm8n08+/nLVtkEN /lIgHFC7bgZsM/4f2cbGnoNyR9Y3OaQkCs7Rgymp+kusRoyfVx6kcCT4mguztQHd39fo 2FuEKtccSKSfMKMHsFkoqnZ2Fl4tjg6YiFfdPOjY2QoFt6gAQy2VOkZt4e/m5B3iayvz UM52erP9Bng+YPPnBcrOTPvED8irXVI1myz9QMtGD05MK457YrQMIYqUjeZ1Eoh32lmw tA== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3j98bn8abn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:59 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0pgAB027779; Tue, 30 Aug 2022 00:59:57 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma04ams.nl.ibm.com with ESMTP id 3j7aw8txtx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:57 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U0xst732571814 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 00:59:54 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6C74EA404D; Tue, 30 Aug 2022 00:59:54 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4358FA4040; Tue, 30 Aug 2022 00:59:53 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:53 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 05/11] Replace the low level SHA1 calls when calculating the TPM 1.2 PCRs Date: Mon, 29 Aug 2022 20:59:30 -0400 Message-Id: <20220830005936.189922-6-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 4R8B3M6HwFkbsnRwVPmtyRM654hjaEUM X-Proofpoint-GUID: 4R8B3M6HwFkbsnRwVPmtyRM654hjaEUM X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 mlxscore=0 lowpriorityscore=0 clxscore=1015 bulkscore=0 malwarescore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 emits deprecated warnings for SHA1 functions. Use the EVP_ functions when walking the TPM 1.2 binary bios measurements to calculate the TPM 1.2 PCRs. Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- src/evmctl.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 59 insertions(+), 6 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 621136b5b85f..6534950f3683 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2296,6 +2296,11 @@ static int cmd_ima_measurement(struct command *cmd) return ima_measurement(file); } +/* + * read_binary_bios_measurements - read the TPM 1.2 event log + * + * Returns 0 on success, 1 on failure. + */ #define MAX_EVENT_DATA_SIZE 200000 static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) { @@ -2308,12 +2313,19 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } header; unsigned char data[MAX_EVENT_DATA_SIZE]; } event; + EVP_MD_CTX *mdctx; + const EVP_MD *md; + unsigned int mdlen; + int evp_err = 1; /* success */ struct stat s; FILE *fp; - SHA_CTX c; int err = 0; int len; int i; +#if OPENSSL_VERSION_NUMBER < 0x10100000 + EVP_MD_CTX ctx; + mdctx = &ctx; +#endif if (stat(file, &s) == -1) { errno = 0; @@ -2335,6 +2347,23 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) if (imaevm_params.verbose > LOG_INFO) log_info("Reading the TPM 1.2 event log %s.\n", file); + md = EVP_get_digestbyname(bank->algo_name); + if (!md) { + log_errno("Unknown message digest %s\n", bank->algo_name); + errno = 0; + fclose(fp); + return 1; + } + +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + mdctx = EVP_MD_CTX_new(); + if (!mdctx) { + log_err("EVP_MD_CTX_new failed\n"); + fclose(fp); + return 1; + } +#endif + /* Extend the pseudo TPM PCRs with the event digest */ while (fread(&event, sizeof(event.header), 1, fp) == 1) { if (imaevm_params.verbose > LOG_INFO) { @@ -2343,13 +2372,30 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } if (event.header.pcr >= NUM_PCRS) { log_err("Invalid PCR %d.\n", event.header.pcr); - err = 1; break; } - SHA1_Init(&c); - SHA1_Update(&c, bank->pcr[event.header.pcr], 20); - SHA1_Update(&c, event.header.digest, 20); - SHA1_Final(bank->pcr[event.header.pcr], &c); + + evp_err = EVP_DigestInit(mdctx, md); + if (evp_err == 0) { + log_err("EVP_DigestInit() failed\n"); + break; + } + + evp_err = EVP_DigestUpdate(mdctx, bank->pcr[event.header.pcr], 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestUpdate(mdctx, event.header.digest, 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestFinal(mdctx, bank->pcr[event.header.pcr], &mdlen); + if (evp_err == 0) { + log_err("EVP_DigestFinal() failed\n"); + break; + } if (event.header.len > MAX_EVENT_DATA_SIZE) { log_err("Event data event too long.\n"); err = 1; @@ -2358,10 +2404,17 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) len = fread(event.data, event.header.len, 1, fp); if (len != 1) { log_errno("Failed reading event data (short read)\n"); + err = 1; break; } } + + if (evp_err == 0) /* EVP_ functions return 1 on success, 0 on failure */ + err = 1; fclose(fp); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(mdctx); +#endif if (imaevm_params.verbose <= LOG_INFO) return err; From patchwork Tue Aug 30 00:59:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958572 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F17A7ECAAD3 for ; Tue, 30 Aug 2022 01:01:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229599AbiH3BBA (ORCPT ); Mon, 29 Aug 2022 21:01:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35004 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229597AbiH3BA6 (ORCPT ); Mon, 29 Aug 2022 21:00:58 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 750B89E116 for ; Mon, 29 Aug 2022 18:00:57 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0kfeU013920; Tue, 30 Aug 2022 01:00:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=Xw5RzkvWDuFt4ms2okEmdcGg53AlMaKqPaxVzFBNADA=; b=fT0eSXnFF/KyzaozD8XcTTQh9ODpRxeKS/cX0Rkbi3geqY0w0+DQKcxjbfcyuct1FZdd rve0m7j8SRli84v5xuEJ1MsHdCyIahVLvUT54TME6SsYQ1LXXQ7AUYytcD4iwkOkfseG hvVHI9yc0pl5e1E7cbr5JKCiRXC/mbFCzSjqQl++xvH9gLHz83lVwmZvLQHscpUvpId4 Zncty5izrPKajcxOimrncLBKPDIL2hI5u7MfcV+F13kbovAxU50Scr+cQSDDLtlWZ2k6 SHiYD5NAQnU4mecN5/YCQCItqgcA/Qm/z/nuhg3wZXBZdsxLZ7xacIQ/SMR+dcFI1+HA iA== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3j98a7gf67-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:53 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0oCgH012775; Tue, 30 Aug 2022 00:59:59 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma06fra.de.ibm.com with ESMTP id 3j7ahht5kf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 00:59:59 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U0xuIe37486956 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 00:59:56 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E16B3A4040; Tue, 30 Aug 2022 00:59:55 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C0D0DA4051; Tue, 30 Aug 2022 00:59:54 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:54 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 06/11] Replace the low level HMAC calls when calculating the EVM HMAC Date: Mon, 29 Aug 2022 20:59:31 -0400 Message-Id: <20220830005936.189922-7-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: TlvB7Sbr-NwTsQ3YJ4KIQrukFSepzPPg X-Proofpoint-GUID: TlvB7Sbr-NwTsQ3YJ4KIQrukFSepzPPg X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 bulkscore=0 mlxlogscore=999 phishscore=0 lowpriorityscore=0 clxscore=1015 mlxscore=0 adultscore=0 suspectscore=0 spamscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Calculating the EVM HMAC and labeling the filesystem was originally included in ima-evm-utils for debugging purposes only. For now, instead of removing EVM HMAC support just replace the low level HMAC_ calls with EVP_ calls. The '-a, --hashalgo' specifies the IMA hash or signature algorithm. The kernel EVM HMAC is limited to SHA1. Fix ima-evm-utils by hard coding the EVM HMAC algorithm to SHA1. Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- src/evmctl.c | 57 +++++++++++++++++++++++++++++----------------------- 1 file changed, 32 insertions(+), 25 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 6534950f3683..913b85f6b620 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1160,12 +1160,12 @@ static int cmd_setxattr_ima(struct command *cmd) static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash) { - const EVP_MD *md; + size_t mdlen; + EVP_MD_CTX *pctx; + EVP_PKEY *pkey = NULL; struct stat st; int err = -1; uint32_t generation = 0; - HMAC_CTX *pctx; - unsigned int mdlen; char **xattrname; unsigned char xattr_value[1024]; unsigned char *key; @@ -1176,10 +1176,8 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h struct h_misc_64 hmac_misc; int hmac_size; #if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX ctx; + EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = HMAC_CTX_new(); #endif key = file2bin(keyfile, NULL, &keylen); @@ -1227,19 +1225,26 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h goto out; } - md = EVP_get_digestbyname(imaevm_params.hash_algo); - if (!md) { - log_err("EVP_get_digestbyname(%s) failed\n", - imaevm_params.hash_algo); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new failed\n"); goto out; } +#endif - err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL); - if (err) { + pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, evmkey, sizeof(evmkey)); + if (!pkey) { log_err("HMAC_Init() failed\n"); goto out; } + err = EVP_DigestSignInit(pctx, NULL, EVP_sha1(), NULL, pkey); + if (err != 1) { + log_err("EVP_DigestSignInit() failed\n"); + goto out; + } + for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value)); if (err < 0) { @@ -1250,12 +1255,12 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_info("skipping xattr: %s\n", *xattrname); continue; } - /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ log_info("name: %s, size: %d\n", *xattrname, err); log_debug_dump(xattr_value, err); - err = !HMAC_Update(pctx, xattr_value, err); - if (err) { - log_err("HMAC_Update() failed\n"); + + err = EVP_DigestSignUpdate(pctx, xattr_value, err); + if (err != 1) { + log_err("EVP_DigestSignUpdate() failed\n"); goto out_ctx_cleanup; } } @@ -1294,23 +1299,24 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_debug("hmac_misc (%d): ", hmac_size); log_debug_dump(&hmac_misc, hmac_size); - err = !HMAC_Update(pctx, (const unsigned char *)&hmac_misc, hmac_size); - if (err) { + err = EVP_DigestSignUpdate(pctx, &hmac_misc, hmac_size); + if (err != 1) { log_err("HMAC_Update() failed\n"); goto out_ctx_cleanup; } - err = !HMAC_Final(pctx, hash, &mdlen); - if (err) + err = EVP_DigestSignFinal(pctx, hash, &mdlen); + if (err != 1) log_err("HMAC_Final() failed\n"); out_ctx_cleanup: -#if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX_cleanup(pctx); -#else - HMAC_CTX_free(pctx); + EVP_PKEY_free(pkey); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); #endif out: free(key); - return err ?: mdlen; + if (err == 1) + return mdlen; + return err; } static int hmac_evm(const char *file, const char *key) @@ -1334,6 +1340,7 @@ static int hmac_evm(const char *file, const char *key) err = lsetxattr(file, xattr_evm, sig, len + 1, 0); if (err < 0) { log_err("setxattr failed: %s\n", file); + errno = 0; return err; } } From patchwork Tue Aug 30 00:59:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958571 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CB17ECAAD2 for ; Tue, 30 Aug 2022 01:01:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229597AbiH3BBA (ORCPT ); Mon, 29 Aug 2022 21:01:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35002 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229558AbiH3BA6 (ORCPT ); Mon, 29 Aug 2022 21:00:58 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 646529DFA1 for ; Mon, 29 Aug 2022 18:00:57 -0700 (PDT) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0hbLv004268; Tue, 30 Aug 2022 01:00:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=JXMIak8Q2MdMzisqjnldIBa3kYQMqO8YMJeKKl/sbYE=; b=PxwjvLCfU1kIQ4XEEOYQMDufLtc/gZigIRmV8EQRwZe+7c3+saTU0Q79n4lP3ct/8I/L LG8e7Bp/J0nvrkbBa6A0m6AOmdjHsRP2NaXnMLfgiD6Sc0quDXRwmIFLR8d0Bhu5q0cL prPPdxHaAuU5Qcu4iOOuvGhcdhtOJbl13O/flQb5hZGz94FzPpaygRAkoYsNjsp2kqEB YPNJatZulZik69Sc5VMy67uUcISGfUBOHDsG8Et4kXvNY+FsLO4kB7ZHckbfrLaKSRT0 I+4Y0LGYvr/XTo6+O+VXenQROvz/6F6r85WOc4WvmYpVd/WN61d8xXSe20uOa5/J3lQ7 7Q== Received: from ppma01fra.de.ibm.com (46.49.7a9f.ip4.static.sl-reverse.com [159.122.73.70]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3j988nrnme-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:53 +0000 Received: from pps.filterd (ppma01fra.de.ibm.com [127.0.0.1]) by ppma01fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0phSK027169; Tue, 30 Aug 2022 01:00:01 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma01fra.de.ibm.com with ESMTP id 3j8hka90gv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:00 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U10JUW35783066 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 01:00:19 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AF873A4053; Tue, 30 Aug 2022 00:59:57 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B299A4040; Tue, 30 Aug 2022 00:59:56 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:56 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 07/11] Add missing EVP_MD_CTX_free() call in calc_evm_hash() Date: Mon, 29 Aug 2022 20:59:32 -0400 Message-Id: <20220830005936.189922-8-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: Hvq0xSLn9g5Z6DHskCXvARuiJjzv07Ts X-Proofpoint-GUID: Hvq0xSLn9g5Z6DHskCXvARuiJjzv07Ts X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 adultscore=0 suspectscore=0 mlxlogscore=999 spamscore=0 mlxscore=0 priorityscore=1501 malwarescore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org When EVP_MD_CTX_new() call was added, the corresponding EVP_MD_CTX_free() was never called. Properly free it. Fixes: 81010f0d87ef ("ima-evm-utils: Add backward compatible support for openssl 1.1") Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- src/evmctl.c | 57 ++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 17 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 913b85f6b620..490d355188d0 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -331,11 +331,17 @@ err: return -1; } +/* + * calc_evm_hash - calculate the file metadata hash + * + * Returns 0 for EVP_ function failures. Return -1 for other failures. + * Return hash algorithm size on success. + */ static int calc_evm_hash(const char *file, unsigned char *hash) { const EVP_MD *md; struct stat st; - int err; + int err = -1; uint32_t generation = 0; EVP_MD_CTX *pctx; unsigned int mdlen; @@ -349,12 +355,11 @@ static int calc_evm_hash(const char *file, unsigned char *hash) #if OPENSSL_VERSION_NUMBER < 0x10100000 EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = EVP_MD_CTX_new(); #endif if (lstat(file, &st)) { log_err("Failed to stat: %s\n", file); + errno = 0; return -1; } @@ -391,20 +396,30 @@ static int calc_evm_hash(const char *file, unsigned char *hash) list_size = llistxattr(file, list, sizeof(list)); if (list_size < 0) { log_err("llistxattr() failed\n"); + errno = 0; return -1; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new() failed\n"); + return 0; + } +#endif + md = EVP_get_digestbyname(imaevm_params.hash_algo); if (!md) { log_err("EVP_get_digestbyname(%s) failed\n", imaevm_params.hash_algo); - return 1; + err = 0; + goto out; } err = EVP_DigestInit(pctx, md); if (!err) { log_err("EVP_DigestInit() failed\n"); - return 1; + goto out; } for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { @@ -415,7 +430,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("selinux[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, selinux_str); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && ima_str) { @@ -423,7 +439,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("ima[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } hex2bin(xattr_value, ima_str, err); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && evm_portable){ @@ -432,7 +449,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err < 0) { log_err("EVM portable sig: %s required\n", xattr_ima); - return -1; + goto out; } use_xattr_ima = 1; } else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) { @@ -442,7 +459,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err >= sizeof(xattr_value)) { log_err("caps[%u] value is too long to fit into xattr[%zu]\n", err + 1, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, caps_str); } else { @@ -463,7 +481,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, xattr_value, err); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } @@ -517,29 +535,33 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } if (!evm_immutable && !evm_portable && !(hmac_flags & HMAC_FLAG_NO_UUID)) { err = get_uuid(&st, uuid); if (err) - return -1; + goto out; err = EVP_DigestUpdate(pctx, (const unsigned char *)uuid, sizeof(uuid)); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } err = EVP_DigestFinal(pctx, hash, &mdlen); - if (!err) { + if (!err) log_err("EVP_DigestFinal() failed\n"); - return 1; - } - return mdlen; +out: +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); +#endif + if (err == 1) + return mdlen; + return err; } static int sign_evm(const char *file, const char *key) @@ -575,6 +597,7 @@ static int sign_evm(const char *file, const char *key) err = lsetxattr(file, xattr_evm, sig, len, 0); if (err < 0) { log_err("setxattr failed: %s\n", file); + errno = 0; return err; } } From patchwork Tue Aug 30 00:59:33 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958569 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9EF54C0502F for ; Tue, 30 Aug 2022 01:00:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229575AbiH3BAN (ORCPT ); Mon, 29 Aug 2022 21:00:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229597AbiH3BAL (ORCPT ); Mon, 29 Aug 2022 21:00:11 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 16BC18050D for ; Mon, 29 Aug 2022 18:00:07 -0700 (PDT) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0iCfM019837; Tue, 30 Aug 2022 01:00:04 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=zib90+zO9xk6+HG2mfCnC5Gx41MAz3290w+/ImLT6L0=; b=O8NEGhmdL38Zz0gjwG1Z+h8q1j4DHbTFe4e1xxaUkUUCMfnTcpUl+GBW8jV6R4Vbu2yN TUDVMQIv3I+lgaPXDq1+hZZy6tzTxXLEFrBsVmt9WQS6P3ydQmBhIK3nZYdRQDGsb0AY G2eIQI0FroV74HwQOjOKKe9bLAsp5pjzTGEpL9vf3pYXrN5uueBBdAUa82Lf5MorSzCo VAIvTbdJsHp5IVT+61BxDPoqyO0azVbb1j5jHiQfvIy2D/0YOCeHdI5lvHcbSv+PfI6a pbYemd2CAMtMExQ39iRItn97yVBedcxv3WbSXjBwCJrepbLajpuXByMPrViz4FDBR0Eo EA== Received: from ppma01fra.de.ibm.com (46.49.7a9f.ip4.static.sl-reverse.com [159.122.73.70]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3j988urk2b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:04 +0000 Received: from pps.filterd (ppma01fra.de.ibm.com [127.0.0.1]) by ppma01fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0q0Jf027203; Tue, 30 Aug 2022 01:00:02 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma01fra.de.ibm.com with ESMTP id 3j8hka90gw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:02 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U0xxMm38732236 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 00:59:59 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3ED62A4053; Tue, 30 Aug 2022 00:59:59 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1C024A404D; Tue, 30 Aug 2022 00:59:58 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:57 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 08/11] Deprecate use of OpenSSL 3 "engine" support Date: Mon, 29 Aug 2022 20:59:33 -0400 Message-Id: <20220830005936.189922-9-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: ALxKtnmTXb_aAO6ooBgULJwi1pQsnHzJ X-Proofpoint-ORIG-GUID: ALxKtnmTXb_aAO6ooBgULJwi1pQsnHzJ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 impostorscore=0 mlxscore=0 bulkscore=0 phishscore=0 clxscore=1015 mlxlogscore=999 suspectscore=0 adultscore=0 priorityscore=1501 spamscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL 3 "engine" support is deprecated, which results in deprecated build warning messages. In preparation for OpenSSL "engine" support to be removed, define a "--enable-engine" configuration option. If not specified, disable engine support on systems with OpenSSL v3. When ima-evm-utils engine support is disabled, don't execute the tests requiring it. Signed-off-by: Mimi Zohar --- configure.ac | 15 +++++++++++++++ src/Makefile.am | 8 ++++++++ src/evmctl.c | 17 +++++++++++++++-- src/imaevm.h | 2 ++ src/libimaevm.c | 5 +++++ tests/functions.sh | 11 ++++++++++- tests/ima_hash.test | 9 +++++++++ tests/sign_verify.test | 10 ++++++++++ 8 files changed, 74 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index dc666f2bb1fa..5e0b78eb651b 100644 --- a/configure.ac +++ b/configure.ac @@ -54,6 +54,19 @@ AC_ARG_ENABLE(sigv1, AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) +AC_ARG_ENABLE(engine, + [AS_HELP_STRING([--enable-engine], [build ima-evm-utils with OpenSSL engine support])]) + +ssl_version=$(openssl version | sed -e 's/^OpenSSL //' | sed -e 's/ .*//') +if test -z "$enable_engine"; then + if test "${ssl_version::1}" = "3"; then + enable_engine="no" + else + enable_engine="yes" + fi +fi +AM_CONDITIONAL([CONFIG_ENGINE], [test "x$enable_engine" = "xyes"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -89,5 +102,7 @@ echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" echo " sigv1: $enable_sigv1" +echo " engine: $enable_engine" +echo " ssl: $ssl_version" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 90c7249020cf..a810d6e0acff 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -11,6 +11,10 @@ if CONFIG_SIGV1 libimaevm_la_CFLAGS = -DCONFIG_SIGV1 endif +if CONFIG_ENGINE +libimaevm_la_CFLAGS = -DCONFIG_ENGINE +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -31,6 +35,10 @@ if CONFIG_SIGV1 evmctl_CFLAGS = -DCONFIG_SIGV1 endif +# Enable "--engine" support +if CONFIG_ENGINE +evmctl_CFLAGS = -DCONFIG_ENGINE +endif # USE_PCRTSS uses the Intel TSS if USE_PCRTSS diff --git a/src/evmctl.c b/src/evmctl.c index 490d355188d0..ad96789f1984 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -64,7 +64,9 @@ #include #include #include +#if CONFIG_ENGINE #include +#endif #include #include "hash_info.h" #include "pcr.h" @@ -2715,7 +2717,7 @@ static void usage(void) " --selinux use custom Selinux label for EVM\n" " --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n" " --verify-sig verify measurement list signatures\n" - " --engine e preload OpenSSL engine e (such as: gost)\n" + " --engine e preload OpenSSL engine e (such as: gost) id deprecated\n" " --ignore-violations ignore ToMToU measurement violations\n" " -v increase verbosity level\n" " -h, --help display this help and exit\n" @@ -2828,7 +2830,9 @@ static char *get_password(void) static ENGINE *setup_engine(const char *engine_id) { +#if CONFIG_ENGINE ENGINE *eng = ENGINE_by_id(engine_id); + if (!eng) { log_err("engine %s isn't available\n", optarg); ERR_print_errors_fp(stderr); @@ -2841,6 +2845,9 @@ static ENGINE *setup_engine(const char *engine_id) if (eng) ENGINE_set_default(eng, ENGINE_METHOD_ALL); return eng; +#endif + log_err("OpenSSL 3 \"engine\" support is deprecated\n"); + return NULL; } int main(int argc, char *argv[]) @@ -2969,8 +2976,12 @@ int main(int argc, char *argv[]) break; case 139: /* --engine e */ imaevm_params.eng = setup_engine(optarg); - if (!imaevm_params.eng) + if (!imaevm_params.eng) { +#ifndef CONFIG_ENGINE + err = 77; /* SKIP */ +#endif goto error; + } break; case 140: /* --xattr-user */ xattr_ima = "user.ima"; @@ -3056,6 +3067,7 @@ int main(int argc, char *argv[]) } error: +#if CONFIG_ENGINE if (imaevm_params.eng) { ENGINE_finish(imaevm_params.eng); ENGINE_free(imaevm_params.eng); @@ -3063,6 +3075,7 @@ error: ENGINE_cleanup(); #endif } +#endif ERR_free_strings(); EVP_cleanup(); BIO_free(NULL); diff --git a/src/imaevm.h b/src/imaevm.h index afcf1e042014..ebe8c20d566a 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -48,7 +48,9 @@ #include #include #include +#ifdef CONFIG_ENGINE #include +#endif #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ diff --git a/src/libimaevm.c b/src/libimaevm.c index cb815f953a80..d81bdbb85250 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -965,6 +965,7 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) EVP_PKEY *pkey; if (!strncmp(keyfile, "pkcs11:", 7)) { +#ifdef CONFIG_ENGINE if (!imaevm_params.keyid) { log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); return NULL; @@ -981,6 +982,10 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) log_err("Failed to load private key %s\n", keyfile); goto err_engine; } +#else + log_err("OpenSSL 3 \"engine\" support is deprecated\n"); + goto err_engine; +#endif } else { fp = fopen(keyfile, "r"); if (!fp) { diff --git a/tests/functions.sh b/tests/functions.sh index 8f6f02dfcd95..ddc8fe9e5ea6 100755 --- a/tests/functions.sh +++ b/tests/functions.sh @@ -312,4 +312,13 @@ _softhsm_teardown() { rm -rf "${SOFTHSM_SETUP_CONFIGDIR}" unset SOFTHSM_SETUP_CONFIGDIR SOFTHSM2_CONF PKCS11_KEYURI \ EVMCTL_ENGINE OPENSSL_ENGINE OPENSSL_KEYFORM -} \ No newline at end of file +} + +# OpenSSL 3 engine support still works, but is deprecated. In preparation +# for it being removed, a new ima-evm-utils configuration option +# "--enable-engine" is defined.` +_is_engine_supported() { + cmd="evmctl --engine pkcs11" + $cmd &>/dev/null + ENGINE_SUPPORTED=$? +} diff --git a/tests/ima_hash.test b/tests/ima_hash.test index e88fd59cc359..0de9e6808af9 100755 --- a/tests/ima_hash.test +++ b/tests/ima_hash.test @@ -71,6 +71,15 @@ expect_pass check sha384 0x0405 38b060a751ac96384cd9327eb1b1e36a21fdb71114b expect_pass check sha512 0x0406 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e expect_pass check rmd160 0x0403 9c1185a5c5e9fc54612808977ee8f548b2258d31 expect_pass check sm3 0x0411 1ab21d8355cfa17f8e61194831e81a8f22bec8c728fefb747ed035eb5082aa2b + +# Remaining tests require engine support +_is_engine_supported +if [ $ENGINE_SUPPORTED -eq 77 ]; then + __skip() { echo "Tests requiring engine support are skipped (not supported)"; return $SKIP; } + expect_pass __skip + exit 0 +fi + _enable_gost_engine expect_pass check md_gost12_256 0x0412 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb expect_pass check streebog256 0x0412 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 948892759424..8c005b741916 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -18,6 +18,8 @@ cd "$(dirname "$0")" || exit 1 PATH=../src:$PATH SIGV1=0 +ENGINE_SUPPORTED=0 + source ./functions.sh _require cmp evmctl getfattr openssl xxd @@ -418,6 +420,14 @@ if [ -x /opt/openssl3/bin/openssl ]; then sign_verify sm2 sm3 0x030211:K:004[345678] fi +# Remaining tests require engine support +_is_engine_supported +if [ $ENGINE_SUPPORTED -eq 77 ]; then + __skip() { echo "Tests requiring engine support are skipped (not supported)"; return $SKIP; } + expect_pass __skip + exit 0 +fi + # Test v2 signatures with EC-RDSA _enable_gost_engine sign_verify gost2012_256-A md_gost12_256 0x030212:K:0040 From patchwork Tue Aug 30 00:59:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958566 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E56F8ECAAD3 for ; Tue, 30 Aug 2022 01:00:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229572AbiH3BAM (ORCPT ); Mon, 29 Aug 2022 21:00:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33938 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229587AbiH3BAL (ORCPT ); Mon, 29 Aug 2022 21:00:11 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 945572AC74 for ; Mon, 29 Aug 2022 18:00:09 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0o8H6020670; Tue, 30 Aug 2022 01:00:06 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=9I21ak7dUQ1I9aeoGj2xC0fMsumeHmVwzq6M3jGf40w=; b=T2/St9GKIGFU0RHTpu13znb4lr83TjsovXwEPv9ZOS0cGWnwYeyG/n5dOjoBQ0kokUte kAIlc4w/u3JIglPYBjDL1GaYZG529x53+cJr3cdIUfKsHjpWXQpiprq8EVuCvJuCVCp/ M78DJvdmUPN7thLLYETKNHEaTzD8DW3RL+lmDKFl7mKTSYwUWSnCZHRrAX3JjI3hsNHC I6ZRBD2WFHxe0k9i0o9bT1YoGHI3ok1hPDV6XlUQQySNNvRR6BZ/i89ql8OjGZNMIRxG 1pAp98JVmsow4+clULIVn1q3lpNK6ljNjUu7wRiBqKbGfiYnMPApzcxnv/GWjY+6SCnY QA== Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3j98bn8ahr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:06 +0000 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0qtK0007819; Tue, 30 Aug 2022 01:00:04 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma02fra.de.ibm.com with ESMTP id 3j7aw8t5hv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:04 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U100TV33161686 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 01:00:00 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C695EA4051; Tue, 30 Aug 2022 01:00:00 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8BE25A404D; Tue, 30 Aug 2022 00:59:59 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 00:59:59 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 09/11] Fix potential use after free in read_tpm_banks() Date: Mon, 29 Aug 2022 20:59:34 -0400 Message-Id: <20220830005936.189922-10-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 7253Qkh1DEqEzkaEY1q7-jlFKyhBbUQl X-Proofpoint-GUID: 7253Qkh1DEqEzkaEY1q7-jlFKyhBbUQl X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 mlxscore=0 lowpriorityscore=0 clxscore=1015 bulkscore=0 malwarescore=0 adultscore=0 phishscore=0 mlxlogscore=850 suspectscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On failure to read TPM 2.0 bank PCRs 'errmsg' is not properly set to NULL after being freed. Fix potential use after free. Fixes: 3472f9ba9c05 ("ima-evm-utils: read the PCRs for the requested TPM banks") Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- src/evmctl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/evmctl.c b/src/evmctl.c index ad96789f1984..4bdc62d2e2e4 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2076,6 +2076,7 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank) log_debug("Failed to read %s PCRs: (%s)\n", bank[i].algo_name, errmsg); free(errmsg); + errmsg = NULL; bank[i].supported = 0; } } From patchwork Tue Aug 30 00:59:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958568 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F667ECAAD2 for ; Tue, 30 Aug 2022 01:00:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229587AbiH3BAO (ORCPT ); Mon, 29 Aug 2022 21:00:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34064 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229558AbiH3BAM (ORCPT ); Mon, 29 Aug 2022 21:00:12 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E83180F51 for ; Mon, 29 Aug 2022 18:00:11 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0o35E020048; Tue, 30 Aug 2022 01:00:08 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=MQFo5LYv6BY+PUZ3R8QzbQ1PybhcmArSKoA+MLVN0ag=; b=NKs4w/NfnFORHxnzaAjgVU7C19hW6tzPROHJ8NwUbSTPUUd1FL4bJ/ok5w/4l9IG8SbE d5t5OsYp13dCFSXOa5RJGiwlGYm95nC9I8bTeSha16j0ah9/gQgn3kajii/FPKT87LFB mUrzoDxXQoYNGWjdyN1xYnYzQMXkaJEqwwxcA0VOhxqYyPOnoxme0i/+VYVKjD+pksCg g05UvvLX5I6hoo9+sVmLUO/AggF2ua7H5hRlnyETjoaPcvIJ7Eb1xKFDDZuwGoIrlHS9 J8YQgijylu0uTxJ/CinEkiKMJ9pfHZGtAGOHDYdXCD+QbfK2KBLmmQI80G3XGi7anvfn Cg== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3j98bn8akd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:07 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0oPwN013169; Tue, 30 Aug 2022 01:00:06 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma06fra.de.ibm.com with ESMTP id 3j7ahht5kn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:06 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U102VV37814582 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 01:00:02 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9A514A404D; Tue, 30 Aug 2022 01:00:02 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1EB25A4040; Tue, 30 Aug 2022 01:00:01 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 01:00:00 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 10/11] Limit the file hash algorithm name length Date: Mon, 29 Aug 2022 20:59:35 -0400 Message-Id: <20220830005936.189922-11-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: ivct-V-iNSQn4L2kW38rjfJ6dQM1d25P X-Proofpoint-GUID: ivct-V-iNSQn4L2kW38rjfJ6dQM1d25P X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 mlxscore=0 lowpriorityscore=0 clxscore=1015 bulkscore=0 malwarescore=0 adultscore=0 phishscore=0 mlxlogscore=969 suspectscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Instead of assuming the file hash algorithm is a properly NULL terminated string, properly limit the "algo:" field size. Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- src/evmctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index 4bdc62d2e2e4..4619bb433926 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1603,7 +1603,7 @@ void ima_ng_show(struct template_entry *entry) total_len -= sizeof(field_len); algo = (char *)fieldp; - len = strlen(algo) + 1; + len = strnlen(algo, field_len - 1) + 1; digest_len = field_len - len; digest = fieldp + len; From patchwork Tue Aug 30 00:59:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 12958570 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8693ECAAD3 for ; Tue, 30 Aug 2022 01:00:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229600AbiH3BAS (ORCPT ); Mon, 29 Aug 2022 21:00:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229558AbiH3BAR (ORCPT ); Mon, 29 Aug 2022 21:00:17 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3BB88E47B for ; Mon, 29 Aug 2022 18:00:13 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 27U0ljhs009624; Tue, 30 Aug 2022 01:00:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=XJakh9xhGVgEMmc4jaKcZU+zFgYpSkoa8s0HulTBWRU=; b=KS2W3rHLBksD0R9rlyhylAYu103CcVxlfayOyMR2GopugEHNVAxA34pzEWJi2WodnJtd ns98wKEP/u2MuTTO/NZon9AgeyNR26+ybcb0EXbaIhtq6Jdvu3AKEJ5dWAHNMdkKf+m3 x8voJgun3Lotnqp4jQVHfHo9S99bBxwQEtUEmFXgvVftTJew0N0MLafZUopmNHNdgP0o paE1+udOvXM6ZPSXcK2iIJplCPZBOADRYeszOiv9tnwQUsnOvclsSuCBVTcb6cPal4eN FdSiA3VXuvlvw7AHBRaXVXwRQMBZvptdtUDOima7aHXc7me0B7i8ltzuiMcBC8U5+FsL ag== Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3j98auge8n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:09 +0000 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 27U0o8d8006549; Tue, 30 Aug 2022 01:00:07 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma05fra.de.ibm.com with ESMTP id 3j7aw8t5j1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Aug 2022 01:00:07 +0000 Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 27U10Pkn38994242 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 30 Aug 2022 01:00:26 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 29819A4040; Tue, 30 Aug 2022 01:00:04 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id F1E5CA404D; Tue, 30 Aug 2022 01:00:02 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.211.117.120]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 30 Aug 2022 01:00:02 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [RFC PATCH ima-evm-utils 11/11] Missing template data size lower bounds checking Date: Mon, 29 Aug 2022 20:59:36 -0400 Message-Id: <20220830005936.189922-12-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220830005936.189922-1-zohar@linux.ibm.com> References: <20220830005936.189922-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: C1L4_14iXs8Nx0lAqMszf5nB4aJpHyNH X-Proofpoint-GUID: C1L4_14iXs8Nx0lAqMszf5nB4aJpHyNH X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-08-29_13,2022-08-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 mlxscore=0 suspectscore=0 mlxlogscore=981 impostorscore=0 malwarescore=0 bulkscore=0 spamscore=0 phishscore=0 lowpriorityscore=0 clxscore=1015 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2207270000 definitions=main-2208290107 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Each record in the IMA measurement list must contain some template data. Ensure the template data is not zero length. Signed-off-by: Mimi Zohar Reviewed-by: Petr Vorel --- src/evmctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index 4619bb433926..0d8f93bf5d26 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2189,6 +2189,10 @@ static int ima_measurement(const char *file) log_err("Unable to read template length\n"); goto out; } + if (entry.template_len == 0) { + log_err("Invalid template data len\n"); + goto out; + } } else { entry.template_len = SHA_DIGEST_LENGTH + TCG_EVENT_NAME_LEN_MAX + 1;