From patchwork Tue Nov 1 20:17:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027418 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 160FCC4332F for ; Tue, 1 Nov 2022 20:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229945AbiKAUS2 (ORCPT ); Tue, 1 Nov 2022 16:18:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229939AbiKAUSX (ORCPT ); Tue, 1 Nov 2022 16:18:23 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2CAFD110A for ; Tue, 1 Nov 2022 13:18:22 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1JtukG012334; Tue, 1 Nov 2022 20:18:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=qxq90qBrR9pOtJArpqU39kMaPYesIl3zkGw8+LLsPUI=; b=hUHvbcdlASXmndbbi0OdQlUjYSuJmtDTdMj0Ue0M6rlOunRRfzHnYr8b2ab/DMwV+9vM 9loFHImlytRDYVheugGIzku+n+auPkh94K3GRDZ/vVQkJNuJLK6vXqHD+jpcIfYaQ0aR 6V+TFUMccF3kTiwwKTkl29QkQ4apg6AMEhvHkwJgql+vFj7cy9KmUrQMuj7n9dApC2bW HojOvBg76LcZBexMl0WtWSKyhtCagabPwsQJd+uxYky9ve7QKJSM7x9Foic6vC4wo7xM zla+Ld5/5WCmgZUAZBTOt3nc4lm4MxaZDFPrugp7wRWfDveuMUYEDYf96Sy2pJ87Lh+F Bg== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjtg5qaj2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:13 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K5Z8U004787; Tue, 1 Nov 2022 20:18:11 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma03ams.nl.ibm.com with ESMTP id 3kgut8w8bm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:11 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KI8TD47055300 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:09 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D6B0FA405C; Tue, 1 Nov 2022 20:18:08 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2583EA4054; Tue, 1 Nov 2022 20:18:08 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:08 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 01/17] Revert "Reset 'errno' after failure to open or access a file" Date: Tue, 1 Nov 2022 16:17:47 -0400 Message-Id: <20221101201803.372652-2-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: V54xEE_GX0B1S-l2GvjEHzvNydLRFXep X-Proofpoint-GUID: V54xEE_GX0B1S-l2GvjEHzvNydLRFXep X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1011 lowpriorityscore=0 phishscore=0 impostorscore=0 mlxscore=0 suspectscore=0 adultscore=0 malwarescore=0 priorityscore=1501 mlxlogscore=999 spamscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org This reverts commit acb19d1894a4a95471b8d2346cd6c3ecf3385110. Signed-off-by: Mimi Zohar --- src/evmctl.c | 18 ++---------------- src/libimaevm.c | 4 ---- 2 files changed, 2 insertions(+), 20 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 76e2561798fa..0412bc0ac2b0 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -182,7 +182,6 @@ static int bin2file(const char *file, const char *ext, const unsigned char *data fp = fopen(name, "w"); if (!fp) { log_err("Failed to open: %s\n", name); - errno = 0; return -1; } err = fwrite(data, len, 1, fp); @@ -208,7 +207,6 @@ static unsigned char *file2bin(const char *file, const char *ext, int *size) fp = fopen(name, "r"); if (!fp) { log_err("Failed to open: %s\n", name); - errno = 0; return NULL; } if (fstat(fileno(fp), &stats) == -1) { @@ -315,10 +313,8 @@ static int get_uuid(struct stat *st, char *uuid) sprintf(path, "blkid -s UUID -o value /dev/block/%u:%u", major, minor); fp = popen(path, "r"); - if (!fp) { - errno = 0; + if (!fp) goto err; - } len = fread(_uuid, 1, sizeof(_uuid), fp); pclose(fp); @@ -375,7 +371,6 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (fd < 0) { log_err("Failed to open: %s\n", file); - errno = 0; return -1; } if (ioctl(fd, FS_IOC_GETVERSION, &generation)) { @@ -1201,7 +1196,6 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h if (fd < 0) { log_err("Failed to open %s\n", file); - errno = 0; goto out; } if (ioctl(fd, FS_IOC_GETVERSION, &generation)) { @@ -1392,7 +1386,6 @@ static int ima_fix(const char *path) fd = open(path, O_RDONLY); if (fd < 0) { log_errno("Failed to open file: %s", path); - errno = 0; return -1; } @@ -1916,10 +1909,8 @@ static int read_sysfs_pcrs(int num_banks, struct tpm_bank_info *tpm_banks) int i, result; fp = fopen(pcrs, "r"); - if (!fp) { + if (!fp) fp = fopen(misc_pcrs, "r"); - errno = 0; - } if (!fp) return -1; @@ -1982,7 +1973,6 @@ static int read_file_pcrs(int num_banks, struct tpm_bank_info *tpm_banks) fp = fopen(path, "r"); if (!fp) { log_err("Could not open '%s'\n", path); - errno = 0; return -1; } @@ -2075,7 +2065,6 @@ static int ima_measurement(const char *file) fp = fopen(file, "rb"); if (!fp) { log_err("Failed to open measurement file: %s\n", file); - errno = 0; return -1; } @@ -2321,7 +2310,6 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) fp = fopen(file, "r"); if (!fp) { log_errno("Failed to open TPM 1.2 event log.\n"); - errno = 0; return 1; } @@ -2758,8 +2746,6 @@ int main(int argc, char *argv[]) unsigned long keyid; char *eptr; - errno = 0; /* initialize errno */ - #if !(OPENSSL_VERSION_NUMBER < 0x10100000) OPENSSL_init_crypto( #ifndef DISABLE_OPENSSL_CONF diff --git a/src/libimaevm.c b/src/libimaevm.c index e4b62b4989b2..611631c57f14 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -144,7 +144,6 @@ static int add_file_hash(const char *file, EVP_MD_CTX *ctx) fp = fopen(file, "r"); if (!fp) { log_err("Failed to open: %s\n", file); - errno = 0; return -1; } @@ -259,7 +258,6 @@ EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) if (!fp) { if (imaevm_params.verbose > LOG_INFO) log_info("Failed to open keyfile: %s\n", keyfile); - errno = 0; return NULL; } @@ -878,7 +876,6 @@ static int read_keyid_from_cert(uint32_t *keyid_be, const char *certfile, int tr if (!(fp = fopen(certfile, "r"))) { log_err("Cannot open %s: %s\n", certfile, strerror(errno)); - errno = 0; return -1; } if (!PEM_read_X509(fp, &x, NULL, NULL)) { @@ -970,7 +967,6 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) fp = fopen(keyfile, "r"); if (!fp) { log_err("Failed to open keyfile: %s\n", keyfile); - errno = 0; return NULL; } pkey = PEM_read_PrivateKey(fp, NULL, NULL, (void *)keypass); From patchwork Tue Nov 1 20:17:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027414 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5D6EC4332F for ; Tue, 1 Nov 2022 20:18:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230175AbiKAUSY (ORCPT ); Tue, 1 Nov 2022 16:18:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56336 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229930AbiKAUSX (ORCPT ); Tue, 1 Nov 2022 16:18:23 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 213D510B0 for ; Tue, 1 Nov 2022 13:18:22 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1IL85U031986; Tue, 1 Nov 2022 20:18:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=VZiTnDEE4sThFcQnHekhpoTB+Lipx63Bf2mxNtmEOh8=; b=eO6OK/BoscE8uRz2wctsZkpm/zg//hk2ZURbpyPd6EtvmXe9z4We5Do/3PZpE24oEyt4 7dkA6gkWsQVV1dPBy12502x7ykc+/HqbTUGXI6XvDkV9IVgn4wwCjpgZAr3EY3wAgN5z XmQVw5NUyUt/3R1sN86PSZvZyMwG7VQpPFjmuqy+JoVoLZa2yi0ty9VE8pWFXbXkHMtA g++G2K6ZLbw99z/dGyngTmINq3rGyU1cLLn8iurvK/WBbOwWF316VDjtZvoAguWb8yN4 E9jBCc11JOmJDvsPUYlGA+cTbFqQz6hBl+dcU0rwgPX3wAOxGyuidl23YwYzmaLJx1X8 Yg== Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjw7ubhxv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:14 +0000 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K7DWP028524; Tue, 1 Nov 2022 20:18:13 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma02fra.de.ibm.com with ESMTP id 3kgut9bwhg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:12 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIkl713631858 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:46 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CAB63A405F; Tue, 1 Nov 2022 20:18:09 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 11777A4054; Tue, 1 Nov 2022 20:18:09 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:08 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 02/17] log and reset 'errno' after failure to open non-critical files Date: Tue, 1 Nov 2022 16:17:48 -0400 Message-Id: <20221101201803.372652-3-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: aO4awrvqwtCiGoAmMnzyuoe9wq9pgnu1 X-Proofpoint-GUID: aO4awrvqwtCiGoAmMnzyuoe9wq9pgnu1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 mlxlogscore=999 mlxscore=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 bulkscore=0 adultscore=0 priorityscore=1501 suspectscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Define a log_errno_reset macro to emit the errno string at or near the time of error, similar to the existing log_errno macro, but also reset errno to avoid dangling or duplicate errno messages on exit. The initial usage is for non-critical file open failures. Suggested-by: Vitaly Chikunov Signed-off-by: Mimi Zohar --- src/evmctl.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 0412bc0ac2b0..54123bf20f03 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -166,6 +166,9 @@ struct tpm_bank_info { static char *pcrfile[MAX_PCRFILE]; static unsigned npcrfile; +#define log_errno_reset(level, fmt, args...) \ + {do_log(level, fmt " (errno: %s)\n", ##args, strerror(errno)); errno = 0; } + static int bin2file(const char *file, const char *ext, const unsigned char *data, int len) { FILE *fp; @@ -1911,8 +1914,10 @@ static int read_sysfs_pcrs(int num_banks, struct tpm_bank_info *tpm_banks) fp = fopen(pcrs, "r"); if (!fp) fp = fopen(misc_pcrs, "r"); - if (!fp) + if (!fp) { + log_errno_reset(LOG_DEBUG, "Failed to read TPM 1.2 PCRs"); return -1; + } result = read_one_bank(&tpm_banks[0], fp); fclose(fp); @@ -2055,7 +2060,6 @@ static int ima_measurement(const char *file) int err_padded = -1; int err = -1; - errno = 0; memset(zero, 0, MAX_DIGEST_SIZE); pseudo_padded_banks = init_tpm_banks(&num_banks); @@ -2072,6 +2076,8 @@ static int ima_measurement(const char *file) init_public_keys(imaevm_params.keyfile); else /* assume read pubkey from x509 cert */ init_public_keys("/etc/keys/x509_evm.der"); + if (errno) + log_errno_reset(LOG_DEBUG, "Failed to initialize public keys"); /* * Reading the PCRs before walking the IMA measurement list @@ -2746,6 +2752,8 @@ int main(int argc, char *argv[]) unsigned long keyid; char *eptr; + errno = 0; /* initialize global errno */ + #if !(OPENSSL_VERSION_NUMBER < 0x10100000) OPENSSL_init_crypto( #ifndef DISABLE_OPENSSL_CONF From patchwork Tue Nov 1 20:17:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027417 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 389BDC4321E for ; Tue, 1 Nov 2022 20:18:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230186AbiKAUS1 (ORCPT ); Tue, 1 Nov 2022 16:18:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56342 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229945AbiKAUSY (ORCPT ); Tue, 1 Nov 2022 16:18:24 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4154E63A2 for ; Tue, 1 Nov 2022 13:18:23 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1J5jUu004217; Tue, 1 Nov 2022 20:18:16 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=/pzgdG8QVbwIElZT9syZFCeYlDXsjwv5NKCpyDJxLTs=; b=aukc+P1Sz4cIrENzomOUHvQKC81Zidwf9HggNjZbzuZUUvKbqYPP0bd5kpoC3hS0m1w5 udPGv4yEodEAVXKmA+Szw+cDLXUm+2S/OMXnG0NUglNby3mVjcBt91HF67Xejydf+Oj6 WdwfSneyJLZdx04Oikq7umg0D1099xs8Z4F+rJhC2j/cxJOULWZXx498VpaVzCPiSPKm VDoGV3lHk9ei2e+JL89M5hg/FCA8ll3+PXB4p0HGVDqYqzECdmG4z0g9hEzRW+1BaCPM ZvHYXE87IEAxlAv8qmg/4AxAVw/a5AoLNug5SUyR8wkzvgrLaCobG8LCrHHGo1eHRpco pQ== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjtg5qak4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:15 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6cwg014532; Tue, 1 Nov 2022 20:18:13 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9572e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:13 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KCgwZ47841536 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:12:42 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C909EA405F; Tue, 1 Nov 2022 20:18:10 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 05114A4054; Tue, 1 Nov 2022 20:18:10 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:09 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 03/17] Log and reset 'errno' on lsetxattr failure Date: Tue, 1 Nov 2022 16:17:49 -0400 Message-Id: <20221101201803.372652-4-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 6J39EkjsZtaRcZqKyzzafhl3pfj_PuPI X-Proofpoint-GUID: 6J39EkjsZtaRcZqKyzzafhl3pfj_PuPI X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 phishscore=0 impostorscore=0 mlxscore=0 suspectscore=0 adultscore=0 malwarescore=0 priorityscore=1501 mlxlogscore=785 spamscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Writing either security.ima hashes or security.evm hmacs from userspace will fail regardless of the IMA or EVM fix mode. In fix mode, 'touch' will force security.ima and security.evm to be updated. Make the setxattr error messages more explicit and clear errno. Signed-off-by: Mimi Zohar Reviewed-by: Stefan Berger --- src/evmctl.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 54123bf20f03..b1dcd9b1c1ef 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -572,7 +572,7 @@ static int sign_evm(const char *file, const char *key) if (xattr) { err = lsetxattr(file, xattr_evm, sig, len, 0); if (err < 0) { - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, "Set EVM xattr failed: %s", file); return err; } } @@ -615,7 +615,8 @@ static int hash_ima(const char *file) if (xattr) { err = lsetxattr(file, xattr_ima, hash, len, 0); if (err < 0) { - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, "Set IMA hash xattr failed: %s", + file); return err; } } @@ -652,7 +653,8 @@ static int sign_ima(const char *file, const char *key) if (xattr) { err = lsetxattr(file, xattr_ima, sig, len, 0); if (err < 0) { - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, "Set IMA sig xattr failed: %s", + file); return err; } } @@ -1125,7 +1127,7 @@ static int setxattr_ima(const char *file, char *sig_file) err = lsetxattr(file, xattr_ima, sig, len, 0); if (err < 0) - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, "Set IMA sig xattr failed: %s", file); free(sig); return err; } @@ -1323,7 +1325,8 @@ static int hmac_evm(const char *file, const char *key) sig[0] = EVM_XATTR_HMAC; err = lsetxattr(file, xattr_evm, sig, len + 1, 0); if (err < 0) { - log_err("setxattr failed: %s\n", file); + log_errno_reset(LOG_ERR, "Set EVM hmac xattr failed: %s", + file); return err; } } From patchwork Tue Nov 1 20:17:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027415 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5C46BC43219 for ; Tue, 1 Nov 2022 20:18:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229930AbiKAUSZ (ORCPT ); Tue, 1 Nov 2022 16:18:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56340 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229875AbiKAUSX (ORCPT ); Tue, 1 Nov 2022 16:18:23 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E96D111F for ; Tue, 1 Nov 2022 13:18:22 -0700 (PDT) Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1K6Lar007939; Tue, 1 Nov 2022 20:18:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=Y//fm9Dgzbk+PFjbKzqhMOboUHD60qTJUUpmKo88SPU=; b=Hve4fS/j1WF/6KP6zJSqNW3GEjIYAfkeK2ge3UYhDxM3ulVg/m3bBzOdVlPmWKoVtfg9 8BjNl2B/BwAXjdh+b35bt/7y4e/GCvGJXkN+8I6K6DcWmn+ohQfSWCBHz12/8y0t29rQ WDdjZYqtkG5PwPsvgLXZN1LscFoqFW4OTe6wUyJn8hCaDygngkrYfN42Yy5znW+R1Gvd NqG4/eOwulQDpPRrSQ7AxLzVjlbY1R7s3x7c5aCGPlbYoo/ufCwPFdx5uOf4HFgAzxL1 Ul5Ntr+BB9ML1ccFOFLnK/f1Swf3dCJBqQ9JRNzLZqrLBIW65g0UKqDlVSb7EaTVc5xr Xw== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjufh6rfq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:17 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6dvZ009325; Tue, 1 Nov 2022 20:18:15 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma06fra.de.ibm.com with ESMTP id 3kguejbx0w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:14 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIBvo4326110 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:11 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BD132A405B; Tue, 1 Nov 2022 20:18:11 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0388CA4054; Tue, 1 Nov 2022 20:18:11 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:10 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 04/17] travis: update dist=focal Date: Tue, 1 Nov 2022 16:17:50 -0400 Message-Id: <20221101201803.372652-5-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 8viia0eN4Y2jN-4wQwTD2kg-hJPQzXpz X-Proofpoint-ORIG-GUID: 8viia0eN4Y2jN-4wQwTD2kg-hJPQzXpz X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_10,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 clxscore=1015 mlxscore=0 spamscore=0 lowpriorityscore=0 malwarescore=0 bulkscore=0 impostorscore=0 priorityscore=1501 adultscore=0 mlxlogscore=999 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Although Github Actions is available on Github Enterprise Server 3.x single server edition, as well as the unpaid version, it is not available in Github Enterprise Server 3.x cluster edition[1]. Continue updating travis.yml. [1] https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#github-packages Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 5741116e418a..edd2a21b83d3 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,6 @@ # Copyright (c) 2017-2021 Petr Vorel -dist: bionic +dist: focal language: C services: - docker From patchwork Tue Nov 1 20:17:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027438 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9294FC4332F for ; Tue, 1 Nov 2022 20:22:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230013AbiKAUV7 (ORCPT ); Tue, 1 Nov 2022 16:21:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58328 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229939AbiKAUV7 (ORCPT ); Tue, 1 Nov 2022 16:21:59 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 452241C102 for ; Tue, 1 Nov 2022 13:21:58 -0700 (PDT) Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1K3q4K008328; Tue, 1 Nov 2022 20:21:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=bniy1ulIUzo3NXXzZuvQMD4AY5vSfcSUm9l7WXv7ZwA=; b=g9XXc6b1e9YzyOuPAFaBvlboAw88Er9GFH2VQMMyu+YBDt27l/NoET3Vv/YArIhtPGUG Q6W3VMBRaip9oUT+3xIAc00P5dpkMbxFscZ0lkb84YVyGxWN0/nAryqPF7r0nu7kKAC3 ACt4QQY5NDE4czyFnRlEMKJ5DFuEuaJyuiG3OgNegjQ0gViJs3gGHjgSZvCJonk6WHQG U7yrzE1Zzg0wtUSGVJCW5QX4x5oHUU4iM9qwmAjFloWeA2dSuXa/ESBS06oDQVODHkd8 SWygjUgUf1w0va7Ar0kuEBfSeLA+KdlFJQWeHl7/ZbMv5mlGqw3O4R1Vy4mUZvMcD6I+ yw== Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjw3ks0rq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:21:51 +0000 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6wA1028466; Tue, 1 Nov 2022 20:18:15 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma02fra.de.ibm.com with ESMTP id 3kgut9bwhk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:15 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KICBP49545606 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:12 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AAC2DA405B; Tue, 1 Nov 2022 20:18:12 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EB888A4054; Tue, 1 Nov 2022 20:18:11 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:11 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 05/17] Update configure.ac to address a couple of obsolete warnings Date: Tue, 1 Nov 2022 16:17:51 -0400 Message-Id: <20221101201803.372652-6-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: rDNIoa0PX9iohJK8fb5PJnhHdAJivmqt X-Proofpoint-ORIG-GUID: rDNIoa0PX9iohJK8fb5PJnhHdAJivmqt X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_10,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxlogscore=999 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 phishscore=0 mlxscore=0 bulkscore=0 spamscore=0 clxscore=1015 impostorscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Remove AC_PROG_LIBTOOL and AC_HEAD_STDC. Replace AC_HELP_STRING with AS_HELP_STRING. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- acinclude.m4 | 2 +- configure.ac | 4 ---- m4/manpage-docbook-xsl.m4 | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/acinclude.m4 b/acinclude.m4 index dd430d4f0565..bb962f81a9c0 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -2,7 +2,7 @@ AC_DEFUN([PKG_ARG_ENABLE], [ AC_MSG_CHECKING(whether to enable $1) - AC_ARG_ENABLE([$1], AC_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), + AC_ARG_ENABLE([$1], AS_HELP_STRING([--enable-$1], [enable $1 (default is $2)]), [pkg_cv_enable_$1=$enableval], [AC_CACHE_VAL([pkg_cv_enable_$1], [pkg_cv_enable_$1=$2])]) if test $pkg_cv_enable_$1 = yes; then diff --git a/configure.ac b/configure.ac index 1a0f093df562..9d3b23ff8def 100644 --- a/configure.ac +++ b/configure.ac @@ -15,16 +15,12 @@ AM_PROG_CC_C_O #AC_PROG_CXX #AC_PROG_CPP AC_PROG_INSTALL -AC_PROG_LIBTOOL #AC_PROG_LN_S LT_INIT # FIXME: Replace `main' with a function in `-lpthread': #AC_CHECK_LIB([pthread], [main]) -# Checks for header files. -AC_HEADER_STDC - PKG_CHECK_MODULES(LIBCRYPTO, [libcrypto >= 0.9.8 ]) AC_SUBST(KERNEL_HEADERS) AC_CHECK_HEADER(unistd.h) diff --git a/m4/manpage-docbook-xsl.m4 b/m4/manpage-docbook-xsl.m4 index 25c8ce54b068..f2ee912ed1be 100644 --- a/m4/manpage-docbook-xsl.m4 +++ b/m4/manpage-docbook-xsl.m4 @@ -7,7 +7,7 @@ AC_DEFUN([EVMCTL_MANPAGE_DOCBOOK_XSL], [ AC_PATH_PROGS(XMLCATALOG, xmlcatalog) AC_ARG_WITH([xml-catalog], - AC_HELP_STRING([--with-xml-catalog=CATALOG], + AS_HELP_STRING([--with-xml-catalog=CATALOG], [path to xml catalog to use]),, [with_xml_catalog=/etc/xml/catalog]) XML_CATALOG_FILE="$with_xml_catalog" From patchwork Tue Nov 1 20:17:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027425 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6EC0C43219 for ; Tue, 1 Nov 2022 20:18:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230013AbiKAUSb (ORCPT ); Tue, 1 Nov 2022 16:18:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230189AbiKAUS2 (ORCPT ); Tue, 1 Nov 2022 16:18:28 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 93E452666 for ; Tue, 1 Nov 2022 13:18:22 -0700 (PDT) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1JxKfc003020; Tue, 1 Nov 2022 20:18:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=2b5YjR1S0N6x3Khxi5N6Ych3YUvKfCnM5IiTFsl86RA=; b=k8IRmYHfpEO6XgE6X2vsxNSW4fZl1gMuWQ73wN+x3MvWQ5zzWwAiZOww246AvCsjM0/m 9zBhWjFiCftud8PQk9DimePaw5NVebQ7weOwL0ruRc9f8JDe2r06bCK4/95q2GcWpcRM zynN/uWTWyp4uYwq2Fq6c/rCjeaXa5yf8NjikuOxDzwf12/I0RRuDwnAmMuKY3Z7KqbQ ByGsNoD0/V7wJgBJUI0XVtoj6s9YWaC+gBPwMtSjWlRx2UGAmj5CjTF+F3OgckAq0jea kQXE6SaP2YIJ7ELEHVcqYJs/Fn+90KFyTSBv/bzA3RUa4nlojc2GrfaEzvGW0WP30X3L FQ== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjwjjjyuy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:18 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6kmg014575; Tue, 1 Nov 2022 20:18:16 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9572g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:16 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KID9Z34472648 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:13 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 944EAA405C; Tue, 1 Nov 2022 20:18:13 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DBE67A4054; Tue, 1 Nov 2022 20:18:12 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:12 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 06/17] Deprecate IMA signature version 1 Date: Tue, 1 Nov 2022 16:17:52 -0400 Message-Id: <20221101201803.372652-7-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: t6ospBdMcDYGJO6wZHSorQuPWtIvcqMs X-Proofpoint-GUID: t6ospBdMcDYGJO6wZHSorQuPWtIvcqMs X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 mlxlogscore=999 spamscore=0 bulkscore=0 priorityscore=1501 phishscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 adultscore=0 impostorscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The original IMA file signatures were based on a SHA1 hash. Kernel support for other hash algorithms was subsequently upstreamed. Deprecate "--rsa" support. Define "--enable-sigv1" option to configure signature v1 support. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- configure.ac | 6 ++++++ src/Makefile.am | 10 ++++++++++ src/evmctl.c | 20 ++++++++++++++++---- src/libimaevm.c | 22 +++++++++++++++++++--- tests/sign_verify.test | 21 +++++++++++++++------ 5 files changed, 66 insertions(+), 13 deletions(-) diff --git a/configure.ac b/configure.ac index 9d3b23ff8def..dc666f2bb1fa 100644 --- a/configure.ac +++ b/configure.ac @@ -49,6 +49,11 @@ AC_ARG_ENABLE([openssl_conf], AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by evmctl.]) fi], [enable_openssl_conf=yes]) +AC_ARG_ENABLE(sigv1, + AS_HELP_STRING([--enable-sigv1], [Build ima-evm-utils with signature v1 support])) + AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) + AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -83,5 +88,6 @@ echo " openssl-conf: $enable_openssl_conf" echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" +echo " sigv1: $enable_sigv1" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 396496bb439d..90c7249020cf 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -7,6 +7,10 @@ libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) libimaevm_la_LDFLAGS = -version-info 3:0:0 libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS) +if CONFIG_SIGV1 +libimaevm_la_CFLAGS = -DCONFIG_SIGV1 +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -22,6 +26,12 @@ evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) evmctl_LDFLAGS = $(LDFLAGS_READLINE) evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la +# Enable IMA signature version 1 +if CONFIG_SIGV1 +evmctl_CFLAGS = -DCONFIG_SIGV1 +endif + + # USE_PCRTSS uses the Intel TSS if USE_PCRTSS evmctl_SOURCES += pcr_tss.c diff --git a/src/evmctl.c b/src/evmctl.c index b1dcd9b1c1ef..158c1f9bf7a1 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -987,7 +987,6 @@ static int cmd_verify_ima(struct command *cmd) init_public_keys("/etc/keys/x509_evm.der"); } - errno = 0; if (!file) { log_err("Parameters missing\n"); print_usage(cmd); @@ -1004,6 +1003,7 @@ static int cmd_verify_ima(struct command *cmd) return fails > 0; } +#if CONFIG_SIGV1 static int cmd_convert(struct command *cmd) { char *inkey; @@ -1034,6 +1034,7 @@ static int cmd_convert(struct command *cmd) RSA_free(key); return err; } +#endif static int cmd_import(struct command *cmd) { @@ -1088,6 +1089,7 @@ static int cmd_import(struct command *cmd) calc_keyid_v2((uint32_t *)keyid, name, pkey); EVP_PKEY_free(pkey); } else { +#if CONFIG_SIGV1 RSA *key = read_pub_key(inkey, imaevm_params.x509); if (!key) @@ -1095,6 +1097,10 @@ static int cmd_import(struct command *cmd) len = key2bin(key, pub); calc_keyid_v1(keyid, name, pub, len); RSA_free(key); +#else + log_info("Importing public RSA key is not supported\n"); + return 1; +#endif } log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); @@ -2595,7 +2601,9 @@ static void usage(void) " -d, --imahash make IMA hash\n" " -f, --sigfile store IMA signature in .sig file instead of xattr\n" " --xattr-user store xattrs in user namespace (for testing purposes)\n" - " --rsa use RSA key type and signing scheme v1\n" +#if CONFIG_SIGV1 + " --rsa use RSA key type and signing scheme v1 (deprecated)\n" +#endif " -k, --key path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n" " or a pkcs11 URI\n" " --keyid n overwrite signature keyid with a 32-bit value in hex (for signing)\n" @@ -2634,8 +2642,12 @@ static void usage(void) struct command cmds[] = { {"--version", NULL, 0, ""}, {"help", cmd_help, 0, ""}, - {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring.\n"}, - {"convert", cmd_convert, 0, "key", "convert public key into the keyring.\n"}, +#if CONFIG_SIGV1 + {"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring. ([--rsa] deprecated)\n"}, + {"convert", cmd_convert, 0, "key", "convert public key into the keyring. (deprecated)\n"}, +#else + {"import", cmd_import, 0, "pubkey keyring", "Import public key into the keyring.\n"}, +#endif {"sign", cmd_sign_evm, 0, "[-r] [--imahash | --imasig ] [--key key] [--pass [password] file", "Sign file metadata.\n"}, {"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"}, {"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--key key] [--pass [password] file", "Make file content signature.\n"}, diff --git a/src/libimaevm.c b/src/libimaevm.c index 611631c57f14..b12b7ff14d95 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -290,6 +290,7 @@ out: return pkey; } +#if CONFIG_SIGV1 RSA *read_pub_key(const char *keyfile, int x509) { EVP_PKEY *pkey; @@ -349,6 +350,7 @@ static int verify_hash_v1(const char *file, const unsigned char *hash, int size, return 0; } +#endif /* CONFIG_SIGV1 */ struct public_key_entry { struct public_key_entry *next; @@ -684,6 +686,7 @@ int verify_hash(const char *file, const unsigned char *hash, int size, { /* Get signature type from sig header */ if (sig[1] == DIGSIG_VERSION_1) { +#if CONFIG_SIGV1 const char *key = NULL; /* Read pubkey from RSA key */ @@ -693,6 +696,10 @@ int verify_hash(const char *file, const unsigned char *hash, int size, key = imaevm_params.keyfile; return verify_hash_v1(file, hash, size, sig + 1, siglen - 1, key); +#else + log_info("Signature version 1 deprecated."); + return -1; +#endif } else if (sig[1] == DIGSIG_VERSION_2) { return verify_hash_v2(file, hash, size, sig, siglen); } else if (sig[1] == DIGSIG_VERSION_3) { @@ -740,6 +747,7 @@ int ima_verify_signature(const char *file, unsigned char *sig, int siglen, return verify_hash(file, hash, hashlen, sig, siglen); } +#if CONFIG_SIGV1 /* * Create binary key representation suitable for kernel */ @@ -798,6 +806,7 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len if (imaevm_params.verbose > LOG_INFO) log_info("keyid-v1: %s\n", str); } +#endif /* CONFIG_SIGV1 */ /* * Calculate keyid of the public_key part of EVP_PKEY @@ -986,6 +995,7 @@ err_engine: return NULL; } +#if CONFIG_SIGV1 static RSA *read_priv_key(const char *keyfile, const char *keypass) { EVP_PKEY *pkey; @@ -1096,6 +1106,7 @@ out: RSA_free(key); return len; } +#endif /* CONFIG_SIGV1 */ /* * @sig is assumed to be of (MAX_SIGNATURE_SIZE - 1) size @@ -1210,9 +1221,14 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c if (keypass) imaevm_params.keypass = keypass; - return imaevm_params.x509 ? - sign_hash_v2(hashalgo, hash, size, keyfile, sig) : - sign_hash_v1(hashalgo, hash, size, keyfile, sig); + if (imaevm_params.x509) + return sign_hash_v2(hashalgo, hash, size, keyfile, sig); +#if CONFIG_SIGV1 + else + return sign_hash_v1(hashalgo, hash, size, keyfile, sig); +#endif + log_info("Signature version 1 deprecated."); + return -1; } static void libinit() diff --git a/tests/sign_verify.test b/tests/sign_verify.test index c56290aa4932..3e9548e1aeb7 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -17,6 +17,10 @@ cd "$(dirname "$0")" || exit 1 PATH=../src:$PATH + +# set the env SIGV1=1 to execute the signature v1 tests +SIGV1=${SIGV1:-0} + source ./functions.sh _require cmp evmctl getfattr openssl xxd @@ -368,13 +372,18 @@ try_different_sigs() { ## Test v1 signatures # Signature v1 only supports sha1 and sha256 so any other should fail -expect_fail \ - check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa +if [ $SIGV1 -eq 0 ]; then + __skip() { echo "IMA signature v1 tests are skipped: not supported"; return $SKIP; } + expect_pass __skip +else + expect_fail \ + check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa -sign_verify rsa1024 sha1 0x0301 --rsa -sign_verify rsa1024 sha256 0x0301 --rsa - try_different_keys - try_different_sigs + sign_verify rsa1024 sha1 0x0301 --rsa + sign_verify rsa1024 sha256 0x0301 --rsa + try_different_keys + try_different_sigs +fi ## Test v2 signatures with RSA PKCS#1 # List of allowed hashes much greater but not all are supported. From patchwork Tue Nov 1 20:17:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027416 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F933C43217 for ; Tue, 1 Nov 2022 20:18:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229875AbiKAUS0 (ORCPT ); Tue, 1 Nov 2022 16:18:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230013AbiKAUSY (ORCPT ); Tue, 1 Nov 2022 16:18:24 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3AB4F6373 for ; Tue, 1 Nov 2022 13:18:23 -0700 (PDT) Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1IL633031881; Tue, 1 Nov 2022 20:18:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=3AWH/kyBDXen+GMgwU+7BI8VCESrxppP/nM6OzO0Zdg=; b=VPBOGMLabCiRQFyIk85qXVG/s1vS4RFx+lZIuRp6gSvHL3Jc4wAUG9z8EDzQzn3ExPVA jUFZ7kgeF19gKBRIFodd0W4nJ7NBDseiS0nUnlHEsZczlfAS5SDJ5spvQntiznetRQfR b1K74QlXa9kyx2y2Dgn6n0kHbVXDulNGR023afoZdXpZA8N7DC2zHLqz3W1i27/5TwN1 E+QjZODLugHuB6++3nlQhUtmzmd6wHS5az6TgmcNbKxoYd0VDGoXJJJ2jWz30czIE0qt 5HJr5kDj8rC+K740lmxl6FMg190WPFCuY2rln+D6txBTr9Fmy8biyA8BBa5eWARYS/bc VQ== Received: from ppma03fra.de.ibm.com (6b.4a.5195.ip4.static.sl-reverse.com [149.81.74.107]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjw7ubj18-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:19 +0000 Received: from pps.filterd (ppma03fra.de.ibm.com [127.0.0.1]) by ppma03fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K5cXv020222; Tue, 1 Nov 2022 20:18:18 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma03fra.de.ibm.com with ESMTP id 3kgut8kw7h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:17 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIEAu1573532 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:14 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 95BDBA4054; Tue, 1 Nov 2022 20:18:14 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C27C3A405B; Tue, 1 Nov 2022 20:18:13 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:13 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 07/17] Replace the low level SHA1 calls when calculating the TPM 1.2 PCRs Date: Tue, 1 Nov 2022 16:17:53 -0400 Message-Id: <20221101201803.372652-8-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 2mcStGUhV_P8KQvqtIepRU7lmmBnz2Mm X-Proofpoint-GUID: 2mcStGUhV_P8KQvqtIepRU7lmmBnz2Mm X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 mlxlogscore=999 mlxscore=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 bulkscore=0 adultscore=0 priorityscore=1501 suspectscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 emits deprecated warnings for SHA1 functions. Use the EVP_ functions when walking the TPM 1.2 binary bios measurements to calculate the TPM 1.2 PCRs. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 78 ++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 63 insertions(+), 15 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 158c1f9bf7a1..808f7d43bd18 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2293,6 +2293,11 @@ static int cmd_ima_measurement(struct command *cmd) return ima_measurement(file); } +/* + * read_binary_bios_measurements - read the TPM 1.2 event log + * + * Returns 0 on success, 1 on failure. + */ #define MAX_EVENT_DATA_SIZE 200000 static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) { @@ -2305,17 +2310,22 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } header; unsigned char data[MAX_EVENT_DATA_SIZE]; } event; + EVP_MD_CTX *mdctx; + const EVP_MD *md; + unsigned int mdlen; + int evp_err = 1; /* success */ struct stat s; FILE *fp; - SHA_CTX c; int err = 0; int len; int i; +#if OPENSSL_VERSION_NUMBER < 0x10100000 + EVP_MD_CTX ctx; + mdctx = &ctx; +#endif - if (stat(file, &s) == -1) { - errno = 0; + if (stat(file, &s) == -1) return 1; - } if (!S_ISREG(s.st_mode)) { log_info("Bios event log: not a regular file or link to regular file\n"); @@ -2323,13 +2333,27 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } fp = fopen(file, "r"); - if (!fp) { - log_errno("Failed to open TPM 1.2 event log.\n"); + if (!fp) return 1; - } if (imaevm_params.verbose > LOG_INFO) - log_info("Reading the TPM 1.2 event log %s.\n", file); + log_info("Reading the TPM 1.2 event log (%s)\n", file); + + md = EVP_get_digestbyname(bank->algo_name); + if (!md) { + log_err("Unknown message digest %s\n", bank->algo_name); + fclose(fp); + return 1; + } + +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + mdctx = EVP_MD_CTX_new(); + if (!mdctx) { + log_err("EVP_MD_CTX_new failed\n"); + fclose(fp); + return 1; + } +#endif /* Extend the pseudo TPM PCRs with the event digest */ while (fread(&event, sizeof(event.header), 1, fp) == 1) { @@ -2339,13 +2363,30 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) } if (event.header.pcr >= NUM_PCRS) { log_err("Invalid PCR %d.\n", event.header.pcr); - err = 1; break; } - SHA1_Init(&c); - SHA1_Update(&c, bank->pcr[event.header.pcr], 20); - SHA1_Update(&c, event.header.digest, 20); - SHA1_Final(bank->pcr[event.header.pcr], &c); + + evp_err = EVP_DigestInit(mdctx, md); + if (evp_err == 0) { + log_err("EVP_DigestInit() failed\n"); + break; + } + + evp_err = EVP_DigestUpdate(mdctx, bank->pcr[event.header.pcr], 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestUpdate(mdctx, event.header.digest, 20); + if (evp_err == 0) { + log_err("EVP_DigestUpdate() failed\n"); + break; + } + evp_err = EVP_DigestFinal(mdctx, bank->pcr[event.header.pcr], &mdlen); + if (evp_err == 0) { + log_err("EVP_DigestFinal() failed\n"); + break; + } if (event.header.len > MAX_EVENT_DATA_SIZE) { log_err("Event data event too long.\n"); err = 1; @@ -2354,10 +2395,17 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank) len = fread(event.data, event.header.len, 1, fp); if (len != 1) { log_errno("Failed reading event data (short read)\n"); + err = 1; break; } } + + if (evp_err == 0) /* EVP_ functions return 1 on success, 0 on failure */ + err = 1; fclose(fp); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(mdctx); +#endif if (imaevm_params.verbose <= LOG_INFO) return err; @@ -2481,8 +2529,8 @@ static int cmd_ima_bootaggr(struct command *cmd) err = read_binary_bios_measurements(file, tpm_banks); if (err) { - log_info("Failed reading the TPM 1.2 event log %s.\n", - file); + log_err("Failed reading the TPM 1.2 event log (%s)\n", + file); return -1; } } else { From patchwork Tue Nov 1 20:17:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027419 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 103B5C433FE for ; Tue, 1 Nov 2022 20:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229939AbiKAUS2 (ORCPT ); Tue, 1 Nov 2022 16:18:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230184AbiKAUSZ (ORCPT ); Tue, 1 Nov 2022 16:18:25 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3AE5A644A for ; Tue, 1 Nov 2022 13:18:24 -0700 (PDT) Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1J6Nvo021560; Tue, 1 Nov 2022 20:18:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=116L1+HEzyTabiLqhFWAJNRCcfnLdMqlEXves1zSbtQ=; b=QWWqma25cy1j2ar2SE+46IN2/vM1Fk9dyoJPrKFHiKd4gCVFgW6PGWKc/iKADAff3ji1 uiiSkT/C5vg/gVDGEefeBoyKoRhxRvXwMMQOup4EkjNktE5nH8gS5x6qPBPDXzqK1j+f RxFhwQMxaa7z910Y9pad+rDGGJzf3WwrulAPMgvqWCkGMQNF2E1jKnY1jWBI9CqDgMLB CnOR6lVcqf1RmX4Sz5RS3l3ESqfa2GDxtTBa7kEFaV3YlrNTgCQibiC1Bwgr6cwBfWup S5xh+GFPrQ73Jzoi522NZ4Z3HPd62h8aqo+UOTL1XaN3UIjG8ksyGc4bsWKKClptBhXD ZQ== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjrugtn65-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:20 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6ZBb014518; Tue, 1 Nov 2022 20:18:18 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9572k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:18 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIFf064815590 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:15 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9D167A405B; Tue, 1 Nov 2022 20:18:15 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C4F64A4054; Tue, 1 Nov 2022 20:18:14 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:14 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 08/17] Replace the low level HMAC calls when calculating the EVM HMAC Date: Tue, 1 Nov 2022 16:17:54 -0400 Message-Id: <20221101201803.372652-9-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: _RGbY8X07U0xx9TOjCLQrUYX6X86EGGJ X-Proofpoint-ORIG-GUID: _RGbY8X07U0xx9TOjCLQrUYX6X86EGGJ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 priorityscore=1501 mlxscore=0 suspectscore=0 phishscore=0 impostorscore=0 lowpriorityscore=0 spamscore=0 adultscore=0 mlxlogscore=999 malwarescore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Calculating the EVM HMAC and labeling the filesystem was originally included in ima-evm-utils for debugging purposes only. For now, instead of removing EVM HMAC support just replace the low level HMAC_ calls with EVP_ calls. The '-a, --hashalgo' specifies the IMA hash or signature algorithm. The kernel EVM HMAC is limited to SHA1. Fix ima-evm-utils by hard coding the EVM HMAC algorithm to SHA1. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 57 +++++++++++++++++++++++++++++----------------------- 1 file changed, 32 insertions(+), 25 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 808f7d43bd18..5306d3b6356d 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -61,6 +61,7 @@ #include #include #include +#include #include #include #include @@ -1159,12 +1160,12 @@ static int cmd_setxattr_ima(struct command *cmd) static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash) { - const EVP_MD *md; + size_t mdlen; + EVP_MD_CTX *pctx; + EVP_PKEY *pkey = NULL; struct stat st; int err = -1; uint32_t generation = 0; - HMAC_CTX *pctx; - unsigned int mdlen; char **xattrname; unsigned char xattr_value[1024]; unsigned char *key; @@ -1175,10 +1176,8 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h struct h_misc_64 hmac_misc; int hmac_size; #if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX ctx; + EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = HMAC_CTX_new(); #endif key = file2bin(keyfile, NULL, &keylen); @@ -1225,19 +1224,26 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h goto out; } - md = EVP_get_digestbyname(imaevm_params.hash_algo); - if (!md) { - log_err("EVP_get_digestbyname(%s) failed\n", - imaevm_params.hash_algo); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new failed\n"); goto out; } +#endif - err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL); - if (err) { + pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, evmkey, sizeof(evmkey)); + if (!pkey) { log_err("HMAC_Init() failed\n"); goto out; } + err = EVP_DigestSignInit(pctx, NULL, EVP_sha1(), NULL, pkey); + if (err != 1) { + log_err("EVP_DigestSignInit() failed\n"); + goto out; + } + for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value)); if (err < 0) { @@ -1248,12 +1254,12 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_info("skipping xattr: %s\n", *xattrname); continue; } - /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/ log_info("name: %s, size: %d\n", *xattrname, err); log_debug_dump(xattr_value, err); - err = !HMAC_Update(pctx, xattr_value, err); - if (err) { - log_err("HMAC_Update() failed\n"); + + err = EVP_DigestSignUpdate(pctx, xattr_value, err); + if (err != 1) { + log_err("EVP_DigestSignUpdate() failed\n"); goto out_ctx_cleanup; } } @@ -1292,23 +1298,24 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h log_debug("hmac_misc (%d): ", hmac_size); log_debug_dump(&hmac_misc, hmac_size); - err = !HMAC_Update(pctx, (const unsigned char *)&hmac_misc, hmac_size); - if (err) { + err = EVP_DigestSignUpdate(pctx, &hmac_misc, hmac_size); + if (err != 1) { log_err("HMAC_Update() failed\n"); goto out_ctx_cleanup; } - err = !HMAC_Final(pctx, hash, &mdlen); - if (err) + err = EVP_DigestSignFinal(pctx, hash, &mdlen); + if (err != 1) log_err("HMAC_Final() failed\n"); out_ctx_cleanup: -#if OPENSSL_VERSION_NUMBER < 0x10100000 - HMAC_CTX_cleanup(pctx); -#else - HMAC_CTX_free(pctx); + EVP_PKEY_free(pkey); +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); #endif out: free(key); - return err ?: mdlen; + if (err == 1) + return mdlen; + return err; } static int hmac_evm(const char *file, const char *key) From patchwork Tue Nov 1 20:17:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027421 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D907EC43217 for ; Tue, 1 Nov 2022 20:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230184AbiKAUS3 (ORCPT ); Tue, 1 Nov 2022 16:18:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56476 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230185AbiKAUS0 (ORCPT ); Tue, 1 Nov 2022 16:18:26 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE8DF644A for ; Tue, 1 Nov 2022 13:18:25 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1IaH3c032273; Tue, 1 Nov 2022 20:18:22 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=VYYMkhwQG+wfyk3wxq1h6bcWHrs7e2US+4y/UJWmv9o=; b=MxVwRVXFALbNVQ3vRNQVSGthq5/fdvBXwbWQgnx9a8ytu+t6ycfP+7j4N5mNB5crXqF7 4rgYWaeIaknaznJTomHX45NloKZN/QdWhv97Ml6PopuJudma5eqXZj5/RhTj9nb5zJod DDxLfYIVK71uHVyL8GfAr2ethdtnnEryCnkfaZGHvoNCbvq//yPOTYFV0DDuTbMisa/B c8XyKskoyVmwLaSvbTVlFcgZUFcBKe3qGToLLN2XbZ4lRS4A5kKWgrftn4ywOGbx0zuO smpE6hChlFJ03WSnOQwqEFuapBdgMMf7iDoFKBKRbnq6wi/9LdPQP+GdyO7C1xCaSRKH Hw== Received: from ppma01fra.de.ibm.com (46.49.7a9f.ip4.static.sl-reverse.com [159.122.73.70]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjtw3g4fw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:21 +0000 Received: from pps.filterd (ppma01fra.de.ibm.com [127.0.0.1]) by ppma01fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K5JlK025198; Tue, 1 Nov 2022 20:18:19 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma01fra.de.ibm.com with ESMTP id 3kgut9bwbm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:19 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIq0X39125474 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:52 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 88571A4060; Tue, 1 Nov 2022 20:18:16 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CC476A4054; Tue, 1 Nov 2022 20:18:15 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:15 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 09/17] Add missing EVP_MD_CTX_free() call in calc_evm_hash() Date: Tue, 1 Nov 2022 16:17:55 -0400 Message-Id: <20221101201803.372652-10-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: opd1Wh6UV8VT7lFRJY7A4FELlvlXKPAM X-Proofpoint-GUID: opd1Wh6UV8VT7lFRJY7A4FELlvlXKPAM X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_10,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 lowpriorityscore=0 adultscore=0 suspectscore=0 phishscore=0 priorityscore=1501 mlxlogscore=999 clxscore=1015 bulkscore=0 spamscore=0 impostorscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org When EVP_MD_CTX_new() call was added, the corresponding EVP_MD_CTX_free() was never called. Properly free it. Fixes: 81010f0d87ef ("ima-evm-utils: Add backward compatible support for openssl 1.1") Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 58 +++++++++++++++++++++++++++++++++++----------------- 1 file changed, 39 insertions(+), 19 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 5306d3b6356d..039571577448 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -331,11 +331,17 @@ err: return -1; } +/* + * calc_evm_hash - calculate the file metadata hash + * + * Returns 0 for EVP_ function failures. Return -1 for other failures. + * Return hash algorithm size on success. + */ static int calc_evm_hash(const char *file, unsigned char *hash) { const EVP_MD *md; struct stat st; - int err; + int err = -1; uint32_t generation = 0; EVP_MD_CTX *pctx; unsigned int mdlen; @@ -349,12 +355,10 @@ static int calc_evm_hash(const char *file, unsigned char *hash) #if OPENSSL_VERSION_NUMBER < 0x10100000 EVP_MD_CTX ctx; pctx = &ctx; -#else - pctx = EVP_MD_CTX_new(); #endif if (lstat(file, &st)) { - log_err("Failed to stat: %s\n", file); + log_errno_reset(LOG_ERR, "Failed to stat: %s", file); return -1; } @@ -389,21 +393,30 @@ static int calc_evm_hash(const char *file, unsigned char *hash) list_size = llistxattr(file, list, sizeof(list)); if (list_size < 0) { - log_err("llistxattr() failed\n"); + log_errno_reset(LOG_ERR, "llistxattr() failed"); return -1; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + pctx = EVP_MD_CTX_new(); + if (!pctx) { + log_err("EVP_MD_CTX_new() failed\n"); + return 0; + } +#endif + md = EVP_get_digestbyname(imaevm_params.hash_algo); if (!md) { log_err("EVP_get_digestbyname(%s) failed\n", imaevm_params.hash_algo); - return 1; + err = 0; + goto out; } err = EVP_DigestInit(pctx, md); if (!err) { log_err("EVP_DigestInit() failed\n"); - return 1; + goto out; } for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) { @@ -414,7 +427,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("selinux[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, selinux_str); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && ima_str) { @@ -422,7 +436,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err > sizeof(xattr_value)) { log_err("ima[%u] value is too long to fit into xattr[%zu]\n", err, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } hex2bin(xattr_value, ima_str, err); } else if (!strcmp(*xattrname, XATTR_NAME_IMA) && evm_portable){ @@ -431,7 +446,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err < 0) { log_err("EVM portable sig: %s required\n", xattr_ima); - return -1; + goto out; } use_xattr_ima = 1; } else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) { @@ -441,7 +456,8 @@ static int calc_evm_hash(const char *file, unsigned char *hash) if (err >= sizeof(xattr_value)) { log_err("caps[%u] value is too long to fit into xattr[%zu]\n", err + 1, sizeof(xattr_value)); - return -1; + err = -1; + goto out; } strcpy(xattr_value, caps_str); } else { @@ -462,7 +478,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, xattr_value, err); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } @@ -516,29 +532,33 @@ static int calc_evm_hash(const char *file, unsigned char *hash) err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } if (!evm_immutable && !evm_portable && !(hmac_flags & HMAC_FLAG_NO_UUID)) { err = get_uuid(&st, uuid); if (err) - return -1; + goto out; err = EVP_DigestUpdate(pctx, (const unsigned char *)uuid, sizeof(uuid)); if (!err) { log_err("EVP_DigestUpdate() failed\n"); - return 1; + goto out; } } err = EVP_DigestFinal(pctx, hash, &mdlen); - if (!err) { + if (!err) log_err("EVP_DigestFinal() failed\n"); - return 1; - } - return mdlen; +out: +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); +#endif + if (err == 1) + return mdlen; + return err; } static int sign_evm(const char *file, const char *key) From patchwork Tue Nov 1 20:17:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027423 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99943C4332F for ; Tue, 1 Nov 2022 20:18:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230193AbiKAUSc (ORCPT ); Tue, 1 Nov 2022 16:18:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230190AbiKAUS3 (ORCPT ); Tue, 1 Nov 2022 16:18:29 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB276DF2F for ; Tue, 1 Nov 2022 13:18:26 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1Ishux027865; Tue, 1 Nov 2022 20:18:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=uvfh6MTyWjh11ox160+OBJ2eKLAYVZcg93CZSE8+2jg=; b=G53cgFiWQ1yqXBzVisV4Lo3mPz2VbV52y4c57xCOPy7eeLipgUOR25B8ZMh1wzlWU5as XG6AAGj8DZLGFeTCI8Vm9mIGvgnhZXR79gZVJAF3B0cC5pqS3jHbDk8ei55kx9QJbDal AtEi+6UsmYBvqPT24c0FtPrZiKtmk8AwJRw0/xjfLpOdDVzFEgnmlNAG6UhVnz4cA8xg RGRbhdd2SXZgSz5SCz9ZoS3j96gv0vfnNQwuKr22s8MAGdtmlhW/Hka1wgk2Ft3XWWqv Lo78CjvKjowHMij5fcsjQeYCAQsjXcJ+AXPAytEDfX9uenaqEYvWonZkYinlQij50KPn LA== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjtw3g4gc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:22 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K5Z42004779; Tue, 1 Nov 2022 20:18:20 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma03ams.nl.ibm.com with ESMTP id 3kgut8w8bv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:20 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KCntL47841552 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:12:49 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6DF9EA405F; Tue, 1 Nov 2022 20:18:17 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B6521A405C; Tue, 1 Nov 2022 20:18:16 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:16 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 10/17] Disable use of OpenSSL "engine" support Date: Tue, 1 Nov 2022 16:17:56 -0400 Message-Id: <20221101201803.372652-11-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: uXgRQns-tC8ikSosZ9dLFeS97wMkSN2C X-Proofpoint-GUID: uXgRQns-tC8ikSosZ9dLFeS97wMkSN2C X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_10,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 lowpriorityscore=0 adultscore=0 suspectscore=0 phishscore=0 priorityscore=1501 mlxlogscore=999 clxscore=1015 bulkscore=0 spamscore=0 impostorscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org OpenSSL v3 "engine" support is deprecated and replaced with "providers". Engine support will continue to work for a while, but results in deprecated declaration and other messages. One option is simply to hide them ("-Wno-deprecated-declarations"). The other alternative is to conditionally build ima-evm-utils without OpenSSL engine support and without disabling deprecated declarations. Based on "--disable-engine" or "--enable-engine=no" configuration option, disable OpenSSL "engine" support. As suggested by Vitaly, - verify ENGINE_init symbol is defined in libcrypto - disable engine support if either OPENSSL_NO_DYNAMIC_ENGINE or OPENSSL_NO_ENGINE variables are defined Signed-off-by: Mimi Zohar --- configure.ac | 6 ++++++ src/Makefile.am | 8 ++++++++ src/evmctl.c | 17 ++++++++++++++++- src/imaevm.h | 6 ++++++ src/libimaevm.c | 7 ++++++- 5 files changed, 42 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index dc666f2bb1fa..90646da22061 100644 --- a/configure.ac +++ b/configure.ac @@ -54,6 +54,11 @@ AC_ARG_ENABLE(sigv1, AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"]) AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"]) +AC_ARG_ENABLE(engine, + [AS_HELP_STRING([--disable-engine], [build ima-evm-utils without OpenSSL engine support])],,[enable_engine=yes]) + AC_CHECK_LIB([crypto], [ENGINE_init],, [enable_engine=no]) + AM_CONDITIONAL([CONFIG_IMA_EVM_ENGINE], [test "x$enable_engine" = "xyes"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -89,5 +94,6 @@ echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free" echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" echo " sigv1: $enable_sigv1" +echo " engine: $enable_engine" echo " doc: $have_doc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 90c7249020cf..0527a7b9df5c 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -11,6 +11,10 @@ if CONFIG_SIGV1 libimaevm_la_CFLAGS = -DCONFIG_SIGV1 endif +if CONFIG_IMA_EVM_ENGINE +libimaevm_la_CFLAGS = -DCONFIG_IMA_EVM_ENGINE +endif + include_HEADERS = imaevm.h nodist_libimaevm_la_SOURCES = hash_info.h @@ -31,6 +35,10 @@ if CONFIG_SIGV1 evmctl_CFLAGS = -DCONFIG_SIGV1 endif +# Enable "--engine" support +if CONFIG_IMA_EVM_ENGINE +evmctl_CFLAGS = -DCONFIG_IMA_EVM_ENGINE +endif # USE_PCRTSS uses the Intel TSS if USE_PCRTSS diff --git a/src/evmctl.c b/src/evmctl.c index 039571577448..4817eeba01c0 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -65,7 +65,9 @@ #include #include #include +#if CONFIG_IMA_EVM_ENGINE #include +#endif #include #include "hash_info.h" #include "pcr.h" @@ -2704,7 +2706,9 @@ static void usage(void) " --selinux use custom Selinux label for EVM\n" " --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n" " --verify-sig verify measurement list signatures\n" - " --engine e preload OpenSSL engine e (such as: gost)\n" +#if CONFIG_IMA_EVM_ENGINE + " --engine e preload OpenSSL engine e (such as: gost) is deprecated\n" +#endif " --ignore-violations ignore ToMToU measurement violations\n" " -v increase verbosity level\n" " -h, --help display this help and exit\n" @@ -2766,7 +2770,9 @@ static struct option opts[] = { {"selinux", 1, 0, 136}, {"caps", 2, 0, 137}, {"verify-sig", 0, 0, 138}, +#if CONFIG_IMA_EVM_ENGINE {"engine", 1, 0, 139}, +#endif {"xattr-user", 0, 0, 140}, {"ignore-violations", 0, 0, 141}, {"pcrs", 1, 0, 142}, @@ -2819,9 +2825,11 @@ static char *get_password(void) return password; } +#if CONFIG_IMA_EVM_ENGINE static ENGINE *setup_engine(const char *engine_id) { ENGINE *eng = ENGINE_by_id(engine_id); + if (!eng) { log_err("engine %s isn't available\n", optarg); ERR_print_errors_fp(stderr); @@ -2835,6 +2843,7 @@ static ENGINE *setup_engine(const char *engine_id) ENGINE_set_default(eng, ENGINE_METHOD_ALL); return eng; } +#endif int main(int argc, char *argv[]) { @@ -2960,11 +2969,13 @@ int main(int argc, char *argv[]) case 138: verify_list_sig = 1; break; +#if CONFIG_IMA_EVM_ENGINE case 139: /* --engine e */ imaevm_params.eng = setup_engine(optarg); if (!imaevm_params.eng) goto error; break; +#endif case 140: /* --xattr-user */ xattr_ima = "user.ima"; xattr_evm = "user.evm"; @@ -3023,7 +3034,9 @@ int main(int argc, char *argv[]) if (imaevm_params.keyfile != NULL && imaevm_params.eng == NULL && !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { +#if CONFIG_IMA_EVM_ENGINE imaevm_params.eng = setup_engine("pkcs11"); +#endif if (!imaevm_params.eng) goto error; } @@ -3049,6 +3062,7 @@ int main(int argc, char *argv[]) } error: +#if CONFIG_IMA_EVM_ENGINE if (imaevm_params.eng) { ENGINE_finish(imaevm_params.eng); ENGINE_free(imaevm_params.eng); @@ -3056,6 +3070,7 @@ error: ENGINE_cleanup(); #endif } +#endif ERR_free_strings(); EVP_cleanup(); BIO_free(NULL); diff --git a/src/imaevm.h b/src/imaevm.h index afcf1e042014..884321670fa7 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -48,7 +48,13 @@ #include #include #include +#ifdef CONFIG_IMA_EVM_ENGINE #include +#endif + +#if defined(OPENSSL_NO_ENGINE) || defined(OPENSSL_NO_DYNAMIC_ENGINE) +#undef CONFIG_IMA_EVM_ENGINE +#endif #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ diff --git a/src/libimaevm.c b/src/libimaevm.c index b12b7ff14d95..8070ffd61a2c 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -953,9 +953,10 @@ uint32_t imaevm_read_keyid(const char *certfile) static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) { FILE *fp; - EVP_PKEY *pkey; + EVP_PKEY *pkey = NULL; if (!strncmp(keyfile, "pkcs11:", 7)) { +#ifdef CONFIG_IMA_EVM_ENGINE if (!imaevm_params.keyid) { log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); return NULL; @@ -972,6 +973,10 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) log_err("Failed to load private key %s\n", keyfile); goto err_engine; } +#else + log_err("OpenSSL \"engine\" support is disabled\n"); + goto err_engine; +#endif } else { fp = fopen(keyfile, "r"); if (!fp) { From patchwork Tue Nov 1 20:17:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027420 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C12BC4332F for ; Tue, 1 Nov 2022 20:18:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230185AbiKAUSa (ORCPT ); Tue, 1 Nov 2022 16:18:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56516 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230013AbiKAUS1 (ORCPT ); Tue, 1 Nov 2022 16:18:27 -0400 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BAC54DEC1 for ; Tue, 1 Nov 2022 13:18:26 -0700 (PDT) Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1IqDci018205; Tue, 1 Nov 2022 20:18:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=L/b9wibu6EHs2iyh9mGy88SYY/spqL+EkdquebrQBLo=; b=mGnI7fXrLOXPnRT6bHXobSnvOxHm+S1amhw1Tq67rQtWLYoyfpiLDlarSiyeiQoc7E6U +I46bMsjKYCulwhmBUhu+L+NqEnIGGWMgbHj0lF8DKdlE9qyKMdnAU1h7sJ8/Gzp/lM1 VpfxBEe1WdLecRY/Dw37jLAbzhbwp6v1fvaqeQN66BZVbygHijyqXkGPjwPZxL907qvZ 61Ry6/mkMshldaCjAxrXZehUKmhdwu884ZAtCIHzKzodsrJqUj3EbT+ERnRnF4UMvt/Y cCPyygIksAY35tHzpvicnUPpXWtiAco5lAU5hHeNZv+19UjkvecLq2YW3I4EbghwVCkd zA== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjtg5qapt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:23 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K5ZOM004786; Tue, 1 Nov 2022 20:18:21 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma03ams.nl.ibm.com with ESMTP id 3kgut8w8c6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:21 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KII9F55509370 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:18 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5E9A7A4064; Tue, 1 Nov 2022 20:18:18 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9D68BA405C; Tue, 1 Nov 2022 20:18:17 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:17 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 11/17] Fix potential use after free in read_tpm_banks() Date: Tue, 1 Nov 2022 16:17:57 -0400 Message-Id: <20221101201803.372652-12-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: JTCZjiNZOnknqdK0J9DUvsiaTiZF86Hv X-Proofpoint-GUID: JTCZjiNZOnknqdK0J9DUvsiaTiZF86Hv X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 phishscore=0 impostorscore=0 mlxscore=0 suspectscore=0 adultscore=0 malwarescore=0 priorityscore=1501 mlxlogscore=990 spamscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On failure to read TPM 2.0 bank PCRs 'errmsg' is not properly set to NULL after being freed. Fix potential use after free. Fixes: 3472f9ba9c05 ("ima-evm-utils: read the PCRs for the requested TPM banks") Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/evmctl.c b/src/evmctl.c index 4817eeba01c0..c224e17ee620 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2070,6 +2070,7 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank) log_debug("Failed to read %s PCRs: (%s)\n", bank[i].algo_name, errmsg); free(errmsg); + errmsg = NULL; bank[i].supported = 0; } } From patchwork Tue Nov 1 20:17:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027422 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0DD7C4167B for ; Tue, 1 Nov 2022 20:18:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230188AbiKAUSc (ORCPT ); Tue, 1 Nov 2022 16:18:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230193AbiKAUS3 (ORCPT ); Tue, 1 Nov 2022 16:18:29 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CEA53DF66 for ; Tue, 1 Nov 2022 13:18:27 -0700 (PDT) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1JMSPv017415; Tue, 1 Nov 2022 20:18:24 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=6MMf8Ew1JPySHaA49ZJF87QoYl49fGUQPqUE3YyR7Lg=; b=I/4hH00X7d6zWuYL5HlZqgBRmEXJKSs3bSLjTy/SV5KSCW1LbrPopoPwml2QWxbNZcbK MAJiC1PTNHpy3cWFvlzrku4PZk2r1X0kPAwPyL6puT3UxOgOvWIiOR0xgLOebPVDmWCP zMEYWPMRmZ9CDh9RFp7RCC1/TNvSMsd79bMAMxnGPWiZLO/W0dQRmwEnf3ErFsLd6uFH rRFTaYPN8NS2hchvWXG5KBEA2N4jtyVNyMHyWF3LTREJSR/IzRjCLjCtpPbvUfRdnav5 iYIo5H00ex0KHY4X0GEotJxEgL6Y7H/tSgc5ovDwAV4q4zs/2AEgIge+ilfTcLDv/uEo uA== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjv4x5jf6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:24 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6Xxm014495; Tue, 1 Nov 2022 20:18:22 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9572v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:22 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIJPx65339888 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:19 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 57C12A4054; Tue, 1 Nov 2022 20:18:19 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8D46DA4060; Tue, 1 Nov 2022 20:18:18 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:18 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 12/17] Limit the file hash algorithm name length Date: Tue, 1 Nov 2022 16:17:58 -0400 Message-Id: <20221101201803.372652-13-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: C2065qrhDtwhShSdVYn7XPImqORDhedS X-Proofpoint-ORIG-GUID: C2065qrhDtwhShSdVYn7XPImqORDhedS X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_10,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 spamscore=0 phishscore=0 mlxscore=0 priorityscore=1501 impostorscore=0 malwarescore=0 suspectscore=0 mlxlogscore=999 bulkscore=0 adultscore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Instead of assuming the file hash algorithm is a properly NULL terminated string, properly limit the "algo:" field size. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index c224e17ee620..17cc2188fe73 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1598,7 +1598,7 @@ void ima_ng_show(struct template_entry *entry) total_len -= sizeof(field_len); algo = (char *)fieldp; - len = strlen(algo) + 1; + len = strnlen(algo, field_len - 1) + 1; digest_len = field_len - len; digest = fieldp + len; From patchwork Tue Nov 1 20:17:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027426 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7CE1C4167E for ; Tue, 1 Nov 2022 20:18:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230190AbiKAUSd (ORCPT ); Tue, 1 Nov 2022 16:18:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56694 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230196AbiKAUSa (ORCPT ); Tue, 1 Nov 2022 16:18:30 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0FF1D2648 for ; Tue, 1 Nov 2022 13:18:30 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1K3WlU006857; Tue, 1 Nov 2022 20:18:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=Ko43l/KpNmwAWiWHHumT6aGjxWyEO39cJCPiU3qoddI=; b=Hv3h2SEHV7dD5nAlpSEr58Ht5PivfKol7emhaethwCBTklW+lQiQ/aXWp++mj0ZTGDpw 9srU9sL7n9OGnWUjXvnsQU1x2qTP4mU7LLHQlTT1ZKykrFq/axmb7Z9HlZ82Bzzt3PnH UdjXfx/KB4LK9P7cxOth5yKyADDORSWsc1EyQADcUO9qQUKdpswrNrTHhokJn1u7nQww 1/pHvQ31nwXSipKJoSsHbwFxRUykqrjosew8JAoK+b90Bjzl/XFhmhjWSGyx9Koaps5e g7vyelMTSeyjGzxJkFzuNNGWRuC9H0rZG+3r2oBX3ljw+ugYjLmKoUyMJv8C4zwmq5o3 bg== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjtw3g4hy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:25 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6b2O014527; Tue, 1 Nov 2022 20:18:23 GMT Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut9572w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:23 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIK8019595582 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:20 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 77006A405B; Tue, 1 Nov 2022 20:18:20 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 853D7A4054; Tue, 1 Nov 2022 20:18:19 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:19 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 13/17] Missing template data size lower bounds checking Date: Tue, 1 Nov 2022 16:17:59 -0400 Message-Id: <20221101201803.372652-14-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: QC9alV7sGIyNK318ic4loYcq_MHIqZ5i X-Proofpoint-GUID: QC9alV7sGIyNK318ic4loYcq_MHIqZ5i X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_10,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 lowpriorityscore=0 adultscore=0 suspectscore=0 phishscore=0 priorityscore=1501 mlxlogscore=999 clxscore=1015 bulkscore=0 spamscore=0 impostorscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Each record in the IMA measurement list must contain some template data. Ensure the template data is not zero length. Reviewed-by: Petr Vorel Reviewed-by: Stefan Berger Signed-off-by: Mimi Zohar --- src/evmctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index 17cc2188fe73..2fc11db77ec3 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2183,6 +2183,10 @@ static int ima_measurement(const char *file) log_err("Unable to read template length\n"); goto out; } + if (entry.template_len == 0) { + log_err("Invalid template data len\n"); + goto out; + } } else { entry.template_len = SHA_DIGEST_LENGTH + TCG_EVENT_NAME_LEN_MAX + 1; From patchwork Tue Nov 1 20:18:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027427 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C164C4332F for ; Tue, 1 Nov 2022 20:18:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230196AbiKAUSd (ORCPT ); Tue, 1 Nov 2022 16:18:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230199AbiKAUSb (ORCPT ); Tue, 1 Nov 2022 16:18:31 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 278B113F28 for ; Tue, 1 Nov 2022 13:18:31 -0700 (PDT) Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1J0Pmp018968; Tue, 1 Nov 2022 20:18:27 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=06xxS+0mkUWYwuTg+FX2TvF2vVdBzvO5EaGFsX/SdVw=; b=ZioQFHrpfOwAA4zaxsskhVYkEGVLDP4uxqTtIf2aJl7/lGl8rJLu3ba+qussKrpRxo2n tNnhgl55Ph29g35y+9xDf2N6uL9Ha/u5Y4YJlVhTYeN5XQn7w7KCbi7Syw63/OLAEHtD K/vs5Z+l3ZLbya1WyfFNI+BjgH1WOTKDv2SSTNHWC/SZcJ+aEW2mzf/OoeICqf8mCD96 uZOFIGsMF0W9eWwnCdD7fgqf2uaUTZlUUkP4Begf/JBoOrXfJLl3GRbloxmmyP2Kc3I/ W5ufbEh2dT41opChgwVRlpYWTmUGoyFxeNwl8/+08wvZTY8S+1dWVOYxeyjHfDmaaeCX yg== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjvbhd7x8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:26 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6aZ8009317; Tue, 1 Nov 2022 20:18:24 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma06fra.de.ibm.com with ESMTP id 3kguejbx1d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:24 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KILqK6423102 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:21 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7CA00A4060; Tue, 1 Nov 2022 20:18:21 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A7E8BA4054; Tue, 1 Nov 2022 20:18:20 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:20 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 14/17] Base sm2/sm3 test on openssl version installed Date: Tue, 1 Nov 2022 16:18:00 -0400 Message-Id: <20221101201803.372652-15-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: cxDkxJc4PrVA1ZSGmYLC1CGrpH0s81Pv X-Proofpoint-ORIG-GUID: cxDkxJc4PrVA1ZSGmYLC1CGrpH0s81Pv X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 phishscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 adultscore=0 mlxscore=0 spamscore=0 malwarescore=0 mlxlogscore=999 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Since the distros are now shipping with OpenSSL 3, no need to build it. Limit the sm2/sm3 test to OpenSSL 3. Signed-off-by: Mimi Zohar Reviewed-by: Stefan Berger --- tests/sign_verify.test | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 3e9548e1aeb7..ed95f6955dc1 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -416,8 +416,8 @@ sign_verify prime256v1 sha384 0x030205:K:004[345678] sign_verify prime256v1 sha512 0x030206:K:004[345678] # If openssl 3.0 is installed, test the SM2/3 algorithm combination -if [ -x /opt/openssl3/bin/openssl ]; then - PATH=/opt/openssl3/bin:$PATH LD_LIBRARY_PATH=/opt/openssl3/lib \ +ssl_version=$(openssl version | sed -e 's/^OpenSSL //' | sed -e 's/ .*//') +if test "${ssl_version::1}" = "3"; then sign_verify sm2 sm3 0x030211:K:004[345678] fi From patchwork Tue Nov 1 20:18:01 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027430 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2BB0C433FE for ; Tue, 1 Nov 2022 20:18:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230208AbiKAUSl (ORCPT ); Tue, 1 Nov 2022 16:18:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56928 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230207AbiKAUSg (ORCPT ); Tue, 1 Nov 2022 16:18:36 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50AC31903E for ; Tue, 1 Nov 2022 13:18:32 -0700 (PDT) Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1ITpEA032429; Tue, 1 Nov 2022 20:18:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=drT64InxfTIATQKuCRL+GopbslNgDcvCaBLvhsbs44Y=; b=m4GzPQuOoAb93KVtzH0AnjmVj4ElcNdUb3S0dIaFEA54Uw/2oXDrbpObvHfsnRbC21Wj VMFUe6qJlWRiXR5is4eDEZQ3Av4pbSJHoCqkyNgSwTvEoeIs+2M8wO60sV87+LPpe0Ni kut5SMZiA05WivajYedIh5oMqDSCAjXar8n0boM9mZYF5UeCbBct5wcJdlnU6PnbMy39 7qEsz2kOr0nk+tD2+WOqymzenkttnvH/GPJi2kPyOTnUjAQWMvOlzLHMgp84mIhVmyPi Pmp06wgUO0ayRSdzm1Y+fJo90+HOOw7AVEagIvZTUYrRAhAjHqOVGkOJyCEfWfuu/yFC 8Q== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjvbhd7xt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:27 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K5ZON004786; Tue, 1 Nov 2022 20:18:25 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma03ams.nl.ibm.com with ESMTP id 3kgut8w8cd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:25 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIMZE64815600 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:22 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 675DBA405C; Tue, 1 Nov 2022 20:18:22 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AC132A405B; Tue, 1 Nov 2022 20:18:21 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:21 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 15/17] Compile a newer version of OpenSSL Date: Tue, 1 Nov 2022 16:18:01 -0400 Message-Id: <20221101201803.372652-16-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: G_7rmw3HhOOvauHIjd9qG0rTbSVPdHUp X-Proofpoint-ORIG-GUID: G_7rmw3HhOOvauHIjd9qG0rTbSVPdHUp X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 phishscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 adultscore=0 mlxscore=0 spamscore=0 malwarescore=0 mlxlogscore=999 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org With the distros shipping OpenSSL 3 with engine support, the original purpose for compiling OpenSSL 3 to test sm2/sm3 is no longer necessary and could be removed. Or, it could be re-purposed for building OpenSSL without engine support, which is needed for testing. For both travis and github actions, update openssl-3.0.0-beta1 with openssl-3.0.5. Signed-off-by: Mimi Zohar --- .github/workflows/ci.yml | 6 +++--- .travis.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dc06fce64ba5..5595855512e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: ARCH: i386 TSS: tpm2-tss VARIANT: i386 - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 # cross compilation builds - container: "debian:stable" @@ -52,7 +52,7 @@ jobs: env: CC: clang TSS: ibmtss - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 - container: "opensuse/leap" env: @@ -63,7 +63,7 @@ jobs: env: CC: gcc TSS: ibmtss - COMPILE_SSL: openssl-3.0.0-beta1 + COMPILE_SSL: openssl-3.0.5 - container: "ubuntu:xenial" env: diff --git a/.travis.yml b/.travis.yml index edd2a21b83d3..09db401928f6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -9,7 +9,7 @@ matrix: include: # 32 bit build - os: linux - env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss COMPILE_SSL=openssl-3.0.5 compiler: gcc # cross compilation builds @@ -32,7 +32,7 @@ matrix: # glibc (gcc/clang) - os: linux - env: DISTRO=opensuse/tumbleweed TSS=ibmtss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host" COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=opensuse/tumbleweed TSS=ibmtss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host" COMPILE_SSL=openssl-3.0.5 compiler: clang - os: linux @@ -40,7 +40,7 @@ matrix: compiler: gcc - os: linux - env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.0-beta1 + env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.5 compiler: gcc - os: linux From patchwork Tue Nov 1 20:18:02 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027429 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5613CC43217 for ; Tue, 1 Nov 2022 20:18:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230210AbiKAUSi (ORCPT ); Tue, 1 Nov 2022 16:18:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56932 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230208AbiKAUSg (ORCPT ); Tue, 1 Nov 2022 16:18:36 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5255D1C102 for ; Tue, 1 Nov 2022 13:18:32 -0700 (PDT) Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1IvpmC016222; Tue, 1 Nov 2022 20:18:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-transfer-encoding : mime-version; s=pp1; bh=AtdIdYDFz0Jg6Bx1VZ6QtS6cs4EJPOZxZJgIMIEFtQ0=; b=aA/BtFAe34OqWZpbGBOLXGS1dC2B5FxQhDdRtTIfveQdjLHaqwaZ5CrbzGmmz2hBNHjU Aml/EaGn7Pl4x+8y9CyC+Dv1XIUbW1iWnjGJymEojKV/LJYXk3K7BFrOU6lOq8V6rNlt Ii57c6v2obPmAyxQPFufhYAhF5dVuCn6adfCrOEkI6BW3GKI0/Lb1TajMlBkOVyCo1YE 2OFfR1U8kFgcrXEBY60WmwHT40/BZlrY+/TtEsX6w4q8MGRRPhHnRbcCENiERWXJ2e/0 syT7+sY3iHtWbAjrJUMx/sIJC8Y33yQ74HrtRNTsKXmKz/XhnBPsRru2U+by35Ipi+Zi rQ== Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0b-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjrugtn96-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:28 +0000 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6n0m014581; Tue, 1 Nov 2022 20:18:26 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma04ams.nl.ibm.com with ESMTP id 3kgut95732-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:26 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KIxeX45416838 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:18:59 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 54D2FA405F; Tue, 1 Nov 2022 20:18:23 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9AF2DA405B; Tue, 1 Nov 2022 20:18:22 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:22 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 16/17] Build OpenSSL without engine support Date: Tue, 1 Nov 2022 16:18:02 -0400 Message-Id: <20221101201803.372652-17-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-GUID: J55JGwG7bM1sGiYXBO2bTXCr6UXleeBa X-Proofpoint-ORIG-GUID: J55JGwG7bM1sGiYXBO2bTXCr6UXleeBa X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_09,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 priorityscore=1501 mlxscore=0 suspectscore=0 phishscore=0 impostorscore=0 lowpriorityscore=0 spamscore=0 adultscore=0 mlxlogscore=999 malwarescore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Fix COMPILE_SSL to build for the proper architecture, link with the appropriate library, and set up library path for evmctl. Compile OpenSSL with "no-engine" and "no-dynamic-engine" support. Signed-off-by: Mimi Zohar --- .github/workflows/ci.yml | 4 ++-- .travis.yml | 2 +- build.sh | 8 ++++++++ src/evmctl.c | 4 +++- tests/install-openssl3.sh | 9 ++++++++- 5 files changed, 22 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5595855512e4..8223b8767351 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -114,7 +114,7 @@ jobs: INSTALL="${INSTALL%%/*}" if [ "$VARIANT" ]; then ARCH="$ARCH" ./ci/$INSTALL.$VARIANT.sh; fi ARCH="$ARCH" CC="$CC" TSS="$TSS" ./ci/$INSTALL.sh - if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" ./tests/install-openssl3.sh; fi + if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" VARIANT="$VARIANT" ./tests/install-openssl3.sh; fi - name: Build swtpm run: | @@ -129,4 +129,4 @@ jobs: run: $CC --version - name: Compile - run: CC="$CC" VARIANT="$VARIANT" ./build.sh + run: CC="$CC" VARIANT="$VARIANT" COMPILE_SSL="$COMPILE_SSL" ./build.sh diff --git a/.travis.yml b/.travis.yml index 09db401928f6..faaa4b5d675b 100644 --- a/.travis.yml +++ b/.travis.yml @@ -95,4 +95,4 @@ script: - INSTALL="${DISTRO#${REPO}}" - INSTALL="${INSTALL%%:*}" - INSTALL="${INSTALL%%/*}" - - $CONTAINER run $CONTAINER_ARGS -t ima-evm-utils /bin/sh -c "if [ \"$VARIANT\" ]; then ARCH=\"$ARCH\" ./ci/$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./ci/$INSTALL.sh && if [ "$COMPILE_SSL" ]; then COMPILE_SSL="$COMPILE_SSL" ./tests/install-openssl3.sh; fi && if [ ! \"$VARIANT\" ]; then which tpm_server || which swtpm || if which tssstartup; then ./tests/install-swtpm.sh; fi; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" ./build.sh" + - $CONTAINER run $CONTAINER_ARGS -t ima-evm-utils /bin/sh -c "if [ \"$VARIANT\" ]; then ARCH=\"$ARCH\" ./ci/$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./ci/$INSTALL.sh && if [ \"$COMPILE_SSL\" ]; then COMPILE_SSL=\"$COMPILE_SSL\" VARIANT=\"$VARIANT\" ./tests/install-openssl3.sh; fi && if [ ! \"$VARIANT\" ]; then which tpm_server || which swtpm || if which tssstartup; then ./tests/install-swtpm.sh; fi; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" COMPILE_SSL=\"$COMPILE_SSL\" ./build.sh" diff --git a/build.sh b/build.sh index c4d28f1302c6..0c2fdd9e995d 100755 --- a/build.sh +++ b/build.sh @@ -32,6 +32,14 @@ log_exit() cd `dirname $0` +if [ "$COMPILE_SSL" ]; then + echo "COMPILE_SSL: $COMPILE_SSL" + export CFLAGS="-I/opt/openssl3/include $CFLAGS" + export LD_LIBRARY_PATH="/opt/openssl3/lib64:/opt/openssl3/lib:$HOME/src/ima-evm-utils/src/.libs:$LD_LIBRARY_PATH" + export LDFLAGS="-L/opt/openssl3/lib64 -L/opt/openssl3/lib $LDFLAGS" + export PATH="/opt/openssl3/bin:$HOME/src/ima-evm-utils/src/.libs:$PATH" +fi + case "$VARIANT" in i386) echo "32-bit compilation" diff --git a/src/evmctl.c b/src/evmctl.c index 2fc11db77ec3..349215eeb632 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2977,8 +2977,10 @@ int main(int argc, char *argv[]) #if CONFIG_IMA_EVM_ENGINE case 139: /* --engine e */ imaevm_params.eng = setup_engine(optarg); - if (!imaevm_params.eng) + if (!imaevm_params.eng) { + log_info("setup_engine failed\n"); goto error; + } break; #endif case 140: /* --xattr-user */ diff --git a/tests/install-openssl3.sh b/tests/install-openssl3.sh index 1b634681a760..911c32bcf87c 100755 --- a/tests/install-openssl3.sh +++ b/tests/install-openssl3.sh @@ -13,7 +13,14 @@ wget --no-check-certificate https://github.com/openssl/openssl/archive/refs/tags tar --no-same-owner -xzf ${version}.tar.gz cd openssl-${version} -./Configure --prefix=/opt/openssl3 --openssldir=/opt/openssl3/ssl +if [ "$VARIANT" = "i386" ]; then + echo "32-bit compilation" + FLAGS="-m32 linux-generic32" +fi + +./Configure $FLAGS no-engine no-dynamic-engine --prefix=/opt/openssl3 --openssldir=/opt/openssl3 +# Uncomment for debugging +# perl configdata.pm --dump | grep engine make -j$(nproc) # only install apps and library sudo make install_sw From patchwork Tue Nov 1 20:18:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 13027428 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 053E0C4332F for ; Tue, 1 Nov 2022 20:18:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230199AbiKAUSi (ORCPT ); Tue, 1 Nov 2022 16:18:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230209AbiKAUSg (ORCPT ); Tue, 1 Nov 2022 16:18:36 -0400 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 52EEB1C41F for ; Tue, 1 Nov 2022 13:18:34 -0700 (PDT) Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 2A1IZAgP004475; Tue, 1 Nov 2022 20:18:30 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=jRM5C1NeOZvP42k45v2YQGrwek8DhutKwpjEfEKWsOE=; b=nGx38y2z2jYy2xm65/ZClJfeWAxEEOfDlO+ZMNk0/qbbsIubDTuJA88E/IWeG8M0CNds fc5V/EjMlNr4IljQZnZQoEkhzUV1VmQ1Bso9if58gtlQbRxGSzlL+cOGmS6R4NvemHJR Hn0ozWpyfiH/zjYbCTTtlrtPZF7578c3B9Fw/40PuuKM7LFFLMnCw5+xHDz2MN8wmUEE /mbKO3n97pkZuQA8RoGb5x8n/OXJ9IAPitYVz0FfItIFtgjGYdT2YJyhvCE44mYpEvwd 8vDadOe1RUa4blMoT5hnFu9voVJEXQ+pOH1moA90+OCDdqUJLw3KvxqiUXDuG+9qjjrS rg== Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kjtw3g4ky-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:29 +0000 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 2A1K6aZ9009317; Tue, 1 Nov 2022 20:18:27 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma06fra.de.ibm.com with ESMTP id 3kguejbx1f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 01 Nov 2022 20:18:27 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 2A1KCtsV46203376 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 1 Nov 2022 20:12:55 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4C0A9A4054; Tue, 1 Nov 2022 20:18:24 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 83476A405F; Tue, 1 Nov 2022 20:18:23 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com.com (unknown [9.160.14.52]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 1 Nov 2022 20:18:23 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Vitaly Chikunov , Stefan Berger Subject: [PATCH ima-evm-utils v4 17/17] Fix d2i_x509_fp failure Date: Tue, 1 Nov 2022 16:18:03 -0400 Message-Id: <20221101201803.372652-18-zohar@linux.ibm.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221101201803.372652-1-zohar@linux.ibm.com> References: <20221101201803.372652-1-zohar@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 9HCeWilXEIbZ2M1irwh0q-OaQ1qkz9Hw X-Proofpoint-GUID: 9HCeWilXEIbZ2M1irwh0q-OaQ1qkz9Hw X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-11-01_10,2022-11-01_02,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 lowpriorityscore=0 adultscore=0 suspectscore=0 phishscore=0 priorityscore=1501 mlxlogscore=943 clxscore=1015 bulkscore=0 spamscore=0 impostorscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000 definitions=main-2211010143 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Before calling d2i_x509_fp(), make sure the keyfile is a regular file. Signed-off-by: Mimi Zohar --- src/libimaevm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/libimaevm.c b/src/libimaevm.c index 8070ffd61a2c..e6fbec5bc17b 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -250,6 +250,7 @@ EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) { FILE *fp; EVP_PKEY *pkey = NULL; + struct stat st; if (!keyfile) return NULL; @@ -262,6 +263,16 @@ EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) } if (x509) { + if (fstat(fileno(fp), &st) == -1) + goto out; + + if ((st.st_mode & S_IFMT) != S_IFREG) { + if (imaevm_params.verbose > LOG_INFO) + log_err("Keyfile is not regular file: %s\n", + keyfile); + goto out; + } + X509 *crt = d2i_X509_fp(fp, NULL); if (!crt) {