From patchwork Mon Feb 26 18:20:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13572678 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA48712E1CC for ; Mon, 26 Feb 2024 18:21:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971680; cv=none; b=c8KXfzO8rwFcl5CByfX+UoDAJupVC8araUa/mkwxiEUtB02+mUryKMQHzszY5TadRfbhjnqcHZ93i+OOalS7s8wfeMA/w58a1xK+6qWcXKhOQxrGycLoVYmInKVZeUyU20CgZTOUayHFdkoZbbqMtnAFinwlNXs9ThenY3uQy/Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971680; c=relaxed/simple; bh=zMGAVGweC5y/MoocSFCaaMw0eIfXKNEOcdoa4FZ/GyQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rCsttyhD0J21pMNccmx48WGYgif9skbUuZM1SPpsTW9knpC0omnJ442wx/KjxC4wgL86adRx7Bo6jt5x5RKWUB8f5nWXiljHFZI9V8jdi5QS4QplRIYgZBnyRpUo79EXGGphQT8otOlasv97VfKyopz6Vug/+hTl5Iw1uDQgsRU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=ZxW+zShu; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="ZxW+zShu" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41QHQt9w011013; Mon, 26 Feb 2024 18:21:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=2Lz1yA32rQxf186cgFelNmMiudGyBBMc9qhYFADfnxg=; b=ZxW+zShuEzyPfhPIT5ZmTavBKVWmtJ8m128WvcA+jcHzzSfvcCP4CEfjRSGz3PH30fyx BdE6wnW2EV1iVppHQlbHGLIBJYAg1O9ASCAmRJTPzzZs2tcEHptbCwN9tXqip9yIsrJn 7WIc79JmwEcrTpMPZRKhSa9INpQnx5dCXFS3975KtKfKqWuFY7vEbAlU7ZgEHG5z/x9o dwQFPueYnKj1u4wrZ2gQByG9MAdoKEb+Zi9Ej2vwVfoEiM/1DaTD9VbLOV2LAB3SXur4 sr0U5lSU8MDh+LTZh14CKGI97Y1Cs/cBIrx3fMcX46jGWzsJ9TibDI0VaEaku798sdIH RQ== Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wgy24sakj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:08 +0000 Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41QHTp0A024127; Mon, 26 Feb 2024 18:21:08 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 3wfw0k2jtk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:08 +0000 Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41QIL4ZQ27263560 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 26 Feb 2024 18:21:06 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9DFC75805C; Mon, 26 Feb 2024 18:21:04 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1566D58060; Mon, 26 Feb 2024 18:21:04 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 26 Feb 2024 18:21:03 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v3 ima-evm-utils 1/7] tests: Skip pkcs11 test if no engine support in evmctl Date: Mon, 26 Feb 2024 13:20:55 -0500 Message-ID: <20240226182101.25210-2-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240226182101.25210-1-stefanb@linux.ibm.com> References: <20240226182101.25210-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: FT6jf02aiOGBCISmUQVPok8ijjoJvRoY X-Proofpoint-ORIG-GUID: FT6jf02aiOGBCISmUQVPok8ijjoJvRoY X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-26_11,2024-02-26_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 adultscore=0 clxscore=1015 priorityscore=1501 phishscore=0 impostorscore=0 suspectscore=0 lowpriorityscore=0 mlxscore=0 mlxlogscore=825 spamscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402260139 Check the evmctl help screen for engine support and skip the pkcs11 test if no engine support is compiled into evmctl. Fixes: c1635add22af ("Disable use of OpenSSL "engine" support") Signed-off-by: Stefan Berger --- tests/sign_verify.test | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 1b6cf2a..16c7ada 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -439,8 +439,14 @@ expect_fail \ # Test signing with key described by pkcs11 URI _softhsm_setup "${WORKDIR}" if [ -n "${PKCS11_KEYURI}" ]; then - expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_KEYURI}" ALG=sha256 PREFIX=0x030204aabbccdd0100 OPTS=--keyid=aabbccdd - expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_KEYURI}" ALG=sha1 PREFIX=0x030202aabbccdd0100 OPTS=--keyid=aabbccdd + if evmctl --help 2>/dev/null | grep -q engine; then + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_KEYURI}" ALG=sha256 PREFIX=0x030204aabbccdd0100 OPTS="--keyid=aabbccdd --engine pkcs11" + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_KEYURI}" ALG=sha1 PREFIX=0x030202aabbccdd0100 OPTS="--keyid=aabbccdd --engine pkcs11" + else + __skip() { echo "pkcs11 test with engine is skipped since there is no engine support"; return "$SKIP"; } + expect_pass __skip + expect_pass __skip + fi else # to have a constant number of tests, skip these two tests __skip() { echo "pkcs11 test is skipped: could not setup softhsm"; return $SKIP; } From patchwork Mon Feb 26 18:20:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13572679 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59F9660DC5 for ; Mon, 26 Feb 2024 18:21:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971680; cv=none; b=BzN9yj7jXF0pg0udtMXcgRDFPySn6LtIiKEhDeB1CPTZwNZqg9ABQQGpz51oYXypL5We2Hb2Y1XNmd1ydRbveUMLqtgXyTrHER+JlOZB+zKi5Jq3FG8yC+huq7tBcfzqZgLprvlFPXpBDugFhvMQYPKMCKyMwvCL6oRYM2AEMBQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971680; c=relaxed/simple; bh=lqHtadbXbj6O5W5AQD2ro+GnD+oelkK4JLiRkxslWuA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=d+99Ui/xySmxOO7b60omCJZ2PKjWRwdxwyoHlL92BY+qJikBBmRRBiUTiBP6jtTITZ4FM+JF+Ngmw/HRBAlNlaBR5rVedrdSnfZYF+WlODhiXgU4o58hb4C5c7k9GmuQxxXh/gQD04s8zfpgiF7af+WLmKVdweQrNuvB/oOEutQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Ev7L4SZl; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Ev7L4SZl" Received: from pps.filterd (m0353728.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41QHCLT8009499; Mon, 26 Feb 2024 18:21:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=iiMpBjvXD/UR8dpbjUgqM+fMQVZYnjiYq+nxrAF/NWY=; b=Ev7L4SZlQp2STvohum2E7rafWnkTbBpUq3oNGdu+esyjgTYVCOcs1yj0bCv9fy40nXcl c7WzIU44NY4UvyqGH4B3lsw6YGQdr2lMI67lTHDiiFv2nmFwwhn6Ssqz1kFmoV9Ywh4L xq2Do93GJZhW/9UVIPqcimKM80aSm1VBWSUj2EMF2u7CDNCtdO4Xj14yhqg67ambevgJ goDDKm+NDZa2n1rFHIxFlPGHubSLjfL2CJY8qYhRwn+THm5wsKpZHYcnps65Ts8BhWJm qhoO4pnMWJRXgil8LwTnvdqSzulgTSwpT18+27960xvaFs0yE4qi/p9T+Hw93vfNOUxm qA== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wgxu89pxj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:09 +0000 Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41QHAZxH021316; Mon, 26 Feb 2024 18:21:08 GMT Received: from smtprelay06.wdc07v.mail.ibm.com ([172.16.1.73]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3wfusntwgh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:08 +0000 Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay06.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41QIL59m22348468 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 26 Feb 2024 18:21:07 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 614A55805B; Mon, 26 Feb 2024 18:21:05 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C32CA58059; Mon, 26 Feb 2024 18:21:04 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 26 Feb 2024 18:21:04 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v3 ima-evm-utils 2/7] headers: Remove usage of CONFIG_IMA_EVM_ENGINE from public header Date: Mon, 26 Feb 2024 13:20:56 -0500 Message-ID: <20240226182101.25210-3-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240226182101.25210-1-stefanb@linux.ibm.com> References: <20240226182101.25210-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: pxJSbuw2GZGCWs5xMdKsx5ScTp9jbio5 X-Proofpoint-GUID: pxJSbuw2GZGCWs5xMdKsx5ScTp9jbio5 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-26_11,2024-02-26_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 mlxlogscore=879 suspectscore=0 bulkscore=0 mlxscore=0 lowpriorityscore=0 priorityscore=1501 phishscore=0 clxscore=1015 adultscore=0 spamscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402260139 An application including the public header imaevm.h won't know whether CONFIG_IMA_EVM_ENGINE was set during compilation of the library, so remove the usage of CONFIG_IMA_EVM_ENGINE from it. An application wanting to use the engine will have to find out whether engine support is compiled-in by invoking library functions and possibly dealing with errors if there's no engine support . Signed-off-by: Stefan Berger --- src/imaevm.h | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/imaevm.h b/src/imaevm.h index 8e24f08..6a52afb 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -48,12 +48,10 @@ #include #include #include -#ifdef CONFIG_IMA_EVM_ENGINE -#include -#endif +#include -#if defined(OPENSSL_NO_ENGINE) || defined(OPENSSL_NO_DYNAMIC_ENGINE) -#undef CONFIG_IMA_EVM_ENGINE +#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) +#include #endif #ifdef USE_FPRINTF From patchwork Mon Feb 26 18:20:57 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13572682 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4863412EBEA for ; Mon, 26 Feb 2024 18:21:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971682; cv=none; b=HjCdTkuAHmnt27y9EQCB3HPJZ/5uIRm+nqu5iSOsS9UfWS2L1HfLCKJMz4Lz+yjBP/ui4f/0eDGvWPqj0qg7LxpvkRUzzyUoVrEpop22ddGnO/VzpGrRu/cKHgRwL5JhLiKSwLpWgNOO35Gdn6nU93EnNFvfJipOR9LdsVIkNtg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971682; c=relaxed/simple; bh=h7WfAq7U/cJ1mhh/23qx9O38D9knj4LAO7UkG4PJTfc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tDLs15bhhhN8ACabvH9wrgeWt/JE7wl5epaF2sQ1olX/fsDcxSOFMKogrkpfCA2PTtxJqozkRu0wmGR00deyqcGoBXEQpji59FOKUxoFgJpxeM8LfxcIN10gFvnyYhUa4jQXybI9JdMJ50mJRC9tuss4XCtRS1Ag5EB0WThooH0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=bRBnT7yK; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="bRBnT7yK" Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41QHDYhB023975; Mon, 26 Feb 2024 18:21:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=TC92paM6IIUxtmTco8hPgZym8UmDjZqYvgKPVQG+xbw=; b=bRBnT7yKeifVuf1QAXDhpd5dIF28+pNSXFMfm+8msLH9UoVgksB3bMWVcS08YqXTHoha crcv+JDi4fWioLZzO5V1o/tq1R++T6QIo1O9H5oGt2ZEPA1MPAWAFFnac6HWIOxfmriH DwTidyuKlIoKwJxyAd2a6QkO+M+p04PpU1WszKl+VzwNer11YPSA65Jpy6NjB2K4KI0K qL+R3pK4BaRiPdlqvB+EPjuJ0ZtmrkKvqJJAMMlehpTww9k2SlR4dI2fBL4d9BbTHFRl gVgLiWvrvrYNYbYuvrHL1H54h+avCnrSHKhca8AH+tzMUdRvmNIrq54tIO6k8yWEY3IF nA== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wgxur1jmh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:09 +0000 Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41QHN7a5008170; Mon, 26 Feb 2024 18:21:09 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3wfv9m2s5w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:09 +0000 Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41QIL6AO62193948 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 26 Feb 2024 18:21:08 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1B00558059; Mon, 26 Feb 2024 18:21:06 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8646758058; Mon, 26 Feb 2024 18:21:05 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 26 Feb 2024 18:21:05 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v3 ima-evm-utils 3/7] Pass ENGINE and keyid through to function using them Date: Mon, 26 Feb 2024 13:20:57 -0500 Message-ID: <20240226182101.25210-4-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240226182101.25210-1-stefanb@linux.ibm.com> References: <20240226182101.25210-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: l1hfAFxRqmW4Ta6LNG6ab2NxF_aDRTVi X-Proofpoint-ORIG-GUID: l1hfAFxRqmW4Ta6LNG6ab2NxF_aDRTVi X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-26_11,2024-02-26_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 malwarescore=0 priorityscore=1501 lowpriorityscore=0 suspectscore=0 bulkscore=0 impostorscore=0 adultscore=0 mlxlogscore=999 phishscore=0 spamscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402260139 Instead of relying on imaevm_params.engine and imaevm_params.keyid global variables, which are not concurrency-safe, define a new library function imaevm_signhash() function with the engine and keyid as parameters. Pass the ENGINE and keyid all the way through to the function that is using them and deprecate sign_hash since it needs to pass these parameters from the global imaevm_params. In preparation of support for OpenSSL providers, wrap the ENGINE in a union inside a struct imaevm_ossl_access and add a type for the selection of the ENGINE or provider later on. Signed-off-by: Stefan Berger --- src/imaevm.h | 26 ++++++++- src/libimaevm.c | 144 ++++++++++++++++++++++++++++++++++++------------ 2 files changed, 134 insertions(+), 36 deletions(-) diff --git a/src/imaevm.h b/src/imaevm.h index 6a52afb..6764604 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -51,7 +51,10 @@ #include #if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) -#include +# include +#else +struct engine_st; +typedef struct engine_st ENGINE; /* unused when no engine support */ #endif #ifdef USE_FPRINTF @@ -250,7 +253,9 @@ void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey); int key2bin(RSA *key, unsigned char *pub); uint32_t imaevm_read_keyid(const char *certfile); -int sign_hash(const char *algo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, unsigned char *sig); +IMAEVM_DEPRECATED int sign_hash(const char *algo, const unsigned char *hash, + int size, const char *keyfile, const char *keypass, + unsigned char *sig); IMAEVM_DEPRECATED int ima_calc_hash(const char *file, uint8_t *hash); IMAEVM_DEPRECATED int verify_hash(const char *file, const unsigned char *hash, int size, unsigned char *sig, int siglen); @@ -259,7 +264,24 @@ IMAEVM_DEPRECATED int ima_verify_signature(const char *file, unsigned char *sig, int digestlen); IMAEVM_DEPRECATED void init_public_keys(const char *keyfiles); +struct imaevm_ossl_access { + int type; +#define IMAEVM_OSSL_ACCESS_TYPE_NONE 0 +#define IMAEVM_OSSL_ACCESS_TYPE_ENGINE 1 /* also: engine field exists */ + union { + ENGINE *engine; + } u; +}; + +#define IMAEVM_SIGFLAG_SIGNATURE_V1 (1 << 0) /* v1 signature; deprecated */ +#define IMAEVM_SIGFLAGS_SUPPORT (1 << 0) /* mask of all supported flags */ + int ima_calc_hash2(const char *file, const char *hash_algo, uint8_t *hash); +int imaevm_signhash(const char *hashalgo, const unsigned char *hash, int size, + const char *keyfile, const char *keypass, + unsigned char *sig, long sigflags, + const struct imaevm_ossl_access *access_info, + uint32_t keyid); int imaevm_verify_hash(struct public_key_entry *public_keys, const char *file, const char *hash_algo, const unsigned char *hash, int size, unsigned char *sig, int siglen); diff --git a/src/libimaevm.c b/src/libimaevm.c index ce4f6f7..91af613 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -1031,33 +1031,53 @@ uint32_t imaevm_read_keyid(const char *certfile) return ntohl(keyid_be); } -static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) +static EVP_PKEY *read_priv_pkey_engine(ENGINE *e, const char *keyfile, + const char *keypass, uint32_t keyid) { - FILE *fp; - EVP_PKEY *pkey = NULL; - - if (!strncmp(keyfile, "pkcs11:", 7)) { #ifdef CONFIG_IMA_EVM_ENGINE - if (!imaevm_params.keyid) { - log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); - return NULL; - } + EVP_PKEY *pkey; - if (keypass) { - if (!ENGINE_ctrl_cmd_string(imaevm_params.eng, "PIN", keypass, 0)) { - log_err("Failed to set the PIN for the private key\n"); - goto err_engine; - } - } - pkey = ENGINE_load_private_key(imaevm_params.eng, keyfile, NULL, NULL); - if (!pkey) { - log_err("Failed to load private key %s\n", keyfile); + if (!keyid) { + log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); + return NULL; + } + + if (keypass) { + if (!ENGINE_ctrl_cmd_string(e, "PIN", keypass, 0)) { + log_err("Failed to set the PIN for the private key\n"); goto err_engine; } -#else - log_err("OpenSSL \"engine\" support is disabled\n"); + } + pkey = ENGINE_load_private_key(e, keyfile, NULL, NULL); + if (!pkey) { + log_err("Failed to load private key %s\n", keyfile); goto err_engine; + } + return pkey; + +err_engine: + output_openssl_errors(); + return NULL; +#else + log_err("OpenSSL \"engine\" support is disabled\n"); + return NULL; #endif +} + +static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) +{ + FILE *fp; + EVP_PKEY *pkey = NULL; + + if (!strncmp(keyfile, "pkcs11:", 7)) { + switch (access_info->type) { + case IMAEVM_OSSL_ACCESS_TYPE_ENGINE: + pkey = read_priv_pkey_engine(access_info->u.engine, + keyfile, keypass, keyid); + break; + } } else { fp = fopen(keyfile, "r"); if (!fp) { @@ -1076,18 +1096,17 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass) return pkey; -err_engine: - output_openssl_errors(); - return NULL; } #if CONFIG_SIGV1 -static RSA *read_priv_key(const char *keyfile, const char *keypass) +static RSA *read_priv_key(const char *keyfile, const char *keypass, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) { EVP_PKEY *pkey; RSA *key; - pkey = read_priv_pkey(keyfile, keypass); + pkey = read_priv_pkey(keyfile, keypass, access_info, keyid); if (!pkey) return NULL; key = EVP_PKEY_get1_RSA(pkey); @@ -1113,7 +1132,9 @@ static int get_hash_algo_v1(const char *algo) static int sign_hash_v1(const char *hashalgo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, - unsigned char *sig) + unsigned char *sig, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) { int len = -1, hashalgo_idx; SHA_CTX ctx; @@ -1147,7 +1168,7 @@ static int sign_hash_v1(const char *hashalgo, const unsigned char *hash, log_info("hash(%s): ", hashalgo); log_dump(hash, size); - key = read_priv_key(keyfile, keypass); + key = read_priv_key(keyfile, keypass, access_info, keyid); if (!key) return -1; @@ -1201,7 +1222,9 @@ out: */ static int sign_hash_v2(const char *algo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, - unsigned char *sig) + unsigned char *sig, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) { struct signature_v2_hdr *hdr; int len = -1; @@ -1211,7 +1234,6 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash, const EVP_MD *md; size_t sigsize; const char *st; - uint32_t keyid; if (!hash) { log_err("sign_hash_v2: hash is null\n"); @@ -1236,7 +1258,7 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash, log_info("hash(%s): ", algo); log_dump(hash, size); - pkey = read_priv_pkey(keyfile, keypass); + pkey = read_priv_pkey(keyfile, keypass, access_info, keyid); if (!pkey) return -1; @@ -1259,8 +1281,8 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash, } #endif - if (imaevm_params.keyid) - keyid = htonl(imaevm_params.keyid); + if (keyid) + keyid = htonl(keyid); else { int keyid_read_failed = read_keyid_from_cert(&keyid, keyfile, false); @@ -1303,17 +1325,71 @@ err: return len; } +static int check_ossl_access(const struct imaevm_ossl_access *access_info) +{ + switch (access_info->type) { + case IMAEVM_OSSL_ACCESS_TYPE_NONE: +#ifdef CONFIG_IMA_EVM_ENGINE + case IMAEVM_OSSL_ACCESS_TYPE_ENGINE: +#endif + return 0; + + default: + errno = EINVAL; + return -1; + } +} + +int imaevm_signhash(const char *hashalgo, const unsigned char *hash, int size, + const char *keyfile, const char *keypass, + unsigned char *sig, long sigflags, + const struct imaevm_ossl_access *access_info, + uint32_t keyid) +{ + int rc; + + if (access_info) { + rc = check_ossl_access(access_info); + if (rc) + return rc; + } + if (sigflags & ~IMAEVM_SIGFLAGS_SUPPORT) { + /* unsupported flag */ + errno = EINVAL; + return -1; + } + + if (sigflags & IMAEVM_SIGFLAG_SIGNATURE_V1) { +#if CONFIG_SIGV1 + return sign_hash_v1(hashalgo, hash, size, keyfile, keypass, sig, + access_info, keyid); +#else + log_info("Signature version 1 deprecated."); + return -1; +#endif + } + + return sign_hash_v2(hashalgo, hash, size, keyfile, keypass, sig, + access_info, keyid); +} + int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, unsigned char *sig) { + const struct imaevm_ossl_access access_info = { + .type = IMAEVM_OSSL_ACCESS_TYPE_ENGINE, + .u.engine = imaevm_params.eng, + }; if (!keypass) /* Avoid breaking existing libimaevm usage */ keypass = imaevm_params.keypass; if (imaevm_params.x509) - return sign_hash_v2(hashalgo, hash, size, keyfile, keypass, sig); + return sign_hash_v2(hashalgo, hash, size, keyfile, keypass, sig, + &access_info, imaevm_params.keyid); #if CONFIG_SIGV1 else - return sign_hash_v1(hashalgo, hash, size, keyfile, keypass, sig); + return sign_hash_v1(hashalgo, hash, size, keyfile, keypass, sig, + &access_info, imaevm_params.keyid); #endif log_info("Signature version 1 deprecated."); return -1; From patchwork Mon Feb 26 18:20:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13572683 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 687CF12F36E for ; Mon, 26 Feb 2024 18:21:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971683; cv=none; b=OEdnHjPvDgHL3fYuLfoDrBBJIDfAkj4xE4Wze41o204y6KU/KEwLz8qmEuPUiH/S/Qrt/IN+VZfJHdgH/AZzhfpOFYbicZLy/FgskFrUsyce+NFqjRmyvg4IgKpNmjuS6zQZZSXEBcs/kfy4CV8+BpWb1SDMEv6ikr1hduhD7pM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971683; c=relaxed/simple; bh=7aDDw6axSZhIXmeyVJ5X0Ga7FLRTIgt8eeWrnJ8ibFk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uXAjAz6cv0FcbNGvFoR7WqteSHB0d1/P4p1qdODrfNhSJTVduAj2U+1fYfazcGaOl17HN7xMgGGmwP62ImgNaSTWhjwkUi/PsQ5JzcAFN9ITe/5YXUBDZ+JnAq5uqOqUSLkcHNF+VbRtHyKu1TVbfMDzMoeKK5IfNytGeVvsV4I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=A+NW8tO+; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="A+NW8tO+" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41QHCFGL005005; Mon, 26 Feb 2024 18:21:11 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=IjmbAeuFVX32mVIappYWX81tArzk3M87IaPnLUIZL8I=; b=A+NW8tO+6eiKwmQveX9SRnAwzcfyWK+bZ1Jwz3C3yzvGI0BC0eHr1NqvVttbir3aKM50 8MpFYU/TosQKqDrtQSXUkiUecfBvV/bKEYccQzO1FA4hi686KsfPED0ONECGwK189uK2 YFhM+fu6lbcdeN0qhvzmEekScQAWaGs4BejH0ETwinoHrHcdSvrP7LtihcX8JBNkMBgW r5GFKIHJa99+4dKK0tt3v8cJowy/8gQhfZun3YRffakBdHf812nTHwBUtswvEXrDSEIC 0MjEl/JSi9FhnNleuRbSvUoIgmgEI/8vo5CyM6OacBnz5w9Ee1duSRP921B6seh44OPL Ew== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wgxu5hpb9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:11 +0000 Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41QH3M9q021267; Mon, 26 Feb 2024 18:21:10 GMT Received: from smtprelay07.wdc07v.mail.ibm.com ([172.16.1.74]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3wfusntwgn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:10 +0000 Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay07.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41QIL6YP5767908 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 26 Feb 2024 18:21:09 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C88D45805D; Mon, 26 Feb 2024 18:21:06 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 4044958058; Mon, 26 Feb 2024 18:21:06 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 26 Feb 2024 18:21:06 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v3 ima-evm-utils 4/7] evmctl: Replace deprecated sign_hash with imaevm_signhash Date: Mon, 26 Feb 2024 13:20:58 -0500 Message-ID: <20240226182101.25210-5-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240226182101.25210-1-stefanb@linux.ibm.com> References: <20240226182101.25210-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: VmzYFCHff5AuzG_BRg0UecAgqplsu8b3 X-Proofpoint-GUID: VmzYFCHff5AuzG_BRg0UecAgqplsu8b3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-26_11,2024-02-26_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 spamscore=0 mlxlogscore=852 bulkscore=0 lowpriorityscore=0 mlxscore=0 phishscore=0 clxscore=1015 suspectscore=0 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402260139 Replace the deprecated sign_hash with imaevm_signhash. Define local variables to pass the choice of signature version, key id, and whether to use an OpenSSL engine to imaevm_signhash. Signed-off-by: Stefan Berger --- src/evmctl.c | 75 +++++++++++++++++++++++++++++++--------------------- 1 file changed, 45 insertions(+), 30 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index d050b5e..20f34dd 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -147,6 +147,14 @@ static char *g_keypass; #define HMAC_FLAG_CAPS_SET 0x0002 static unsigned long hmac_flags; +static uint32_t imaevm_keyid; +static struct imaevm_ossl_access access_info; +static long sigflags; + +static inline bool use_x509(long sigflags) +{ + return (sigflags & IMAEVM_SIGFLAG_SIGNATURE_V1) == 0; +} typedef int (*find_cb_t)(const char *path); static int find(const char *path, int dts, find_cb_t func); @@ -577,7 +585,8 @@ static int sign_evm(const char *file, char *hash_algo, const char *key) return len; assert(len <= sizeof(hash)); - len = sign_hash(hash_algo, hash, len, key, g_keypass, sig + 1); + len = imaevm_signhash(hash_algo, hash, len, key, g_keypass, + sig + 1, sigflags, &access_info, imaevm_keyid); if (len <= 1) return len; assert(len < sizeof(sig)); @@ -663,7 +672,8 @@ static int sign_ima(const char *file, char *hash_algo, const char *key) return len; assert(len <= sizeof(hash)); - len = sign_hash(hash_algo, hash, len, key, g_keypass, sig + 1); + len = imaevm_signhash(hash_algo, hash, len, key, g_keypass, + sig + 1, sigflags, &access_info, imaevm_keyid); if (len <= 1) return len; assert(len < sizeof(sig)); @@ -844,8 +854,9 @@ static int cmd_sign_hash(struct command *cmd) continue; } - siglen = sign_hash(algo, sigv3_hash, hashlen / 2, - key, g_keypass, sig + 1); + siglen = imaevm_signhash(algo, sigv3_hash, hashlen / 2, + key, g_keypass, sig + 1, sigflags, + &access_info, imaevm_keyid); sig[0] = IMA_VERITY_DIGSIG; sig[1] = DIGSIG_VERSION_3; /* sigv3 */ @@ -856,8 +867,10 @@ static int cmd_sign_hash(struct command *cmd) assert(hashlen / 2 <= sizeof(hash)); hex2bin(hash, line, hashlen / 2); - siglen = sign_hash(g_hash_algo, hash, - hashlen / 2, key, g_keypass, sig + 1); + siglen = imaevm_signhash(g_hash_algo, hash, + hashlen / 2, key, g_keypass, + sig + 1, sigflags, + &access_info, imaevm_keyid); sig[0] = EVM_IMA_XATTR_DIGSIG; } @@ -963,7 +976,7 @@ static int cmd_verify_evm(struct command *cmd) return -1; } - if (imaevm_params.x509) { + if (use_x509(sigflags)) { if (imaevm_params.keyfile) /* Support multiple public keys */ err = imaevm_init_public_keys(imaevm_params.keyfile, &public_keys); @@ -1026,7 +1039,7 @@ static int cmd_verify_ima(struct command *cmd) return -1; } - if (imaevm_params.x509) { + if (use_x509(sigflags)) { if (imaevm_params.keyfile) /* Support multiple public keys */ err = imaevm_init_public_keys(imaevm_params.keyfile, &public_keys); @@ -1061,15 +1074,12 @@ static int cmd_convert(struct command *cmd) uint8_t keyid[8]; RSA *key; - imaevm_params.x509 = 0; - inkey = g_argv[optind++]; if (!inkey) { - inkey = imaevm_params.x509 ? "/etc/keys/x509_evm.der" : - "/etc/keys/pubkey_evm.pem"; + inkey = "/etc/keys/pubkey_evm.pem"; } - key = read_pub_key(inkey, imaevm_params.x509); + key = read_pub_key(inkey, 0); if (!key) return 1; @@ -1094,7 +1104,7 @@ static int cmd_import(struct command *cmd) inkey = g_argv[optind++]; if (!inkey) { - inkey = imaevm_params.x509 ? "/etc/keys/x509_evm.der" : + inkey = use_x509(sigflags) ? "/etc/keys/x509_evm.der" : "/etc/keys/pubkey_evm.pem"; } else ring = g_argv[optind++]; @@ -1124,8 +1134,8 @@ static int cmd_import(struct command *cmd) } } - if (imaevm_params.x509) { - EVP_PKEY *pkey = read_pub_pkey(inkey, imaevm_params.x509); + if (use_x509(sigflags)) { + EVP_PKEY *pkey = read_pub_pkey(inkey, 1); if (!pkey) return 1; @@ -1138,7 +1148,7 @@ static int cmd_import(struct command *cmd) EVP_PKEY_free(pkey); } else { #if CONFIG_SIGV1 - RSA *key = read_pub_key(inkey, imaevm_params.x509); + RSA *key = read_pub_key(inkey, 0); if (!key) return 1; @@ -1153,8 +1163,8 @@ static int cmd_import(struct command *cmd) log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); - id = add_key(imaevm_params.x509 ? "asymmetric" : "user", - imaevm_params.x509 ? NULL : name, pub, len, id); + id = add_key(use_x509(sigflags) ? "asymmetric" : "user", + use_x509(sigflags) ? NULL : name, pub, len, id); if (id < 0) { log_err("add_key failed\n"); err = id; @@ -3106,7 +3116,7 @@ int main(int argc, char *argv[]) hmac_flags |= HMAC_FLAG_NO_UUID; break; case '1': - imaevm_params.x509 = 0; + sigflags |= IMAEVM_SIGFLAG_SIGNATURE_V1; break; case 'k': imaevm_params.keyfile = optarg; @@ -3172,11 +3182,12 @@ int main(int argc, char *argv[]) break; #if CONFIG_IMA_EVM_ENGINE case 139: /* --engine e */ - imaevm_params.eng = setup_engine(optarg); - if (!imaevm_params.eng) { + access_info.u.engine = setup_engine(optarg); + if (!access_info.u.engine) { log_info("setup_engine failed\n"); goto error; } + access_info.type = IMAEVM_OSSL_ACCESS_TYPE_ENGINE; break; #endif case 140: /* --xattr-user */ @@ -3210,7 +3221,7 @@ int main(int argc, char *argv[]) log_err("Invalid keyid value.\n"); exit(1); } - imaevm_params.keyid = keyid; + imaevm_keyid = keyid; break; case 145: keyid = imaevm_read_keyid(optarg); @@ -3218,7 +3229,7 @@ int main(int argc, char *argv[]) log_err("Error reading keyid.\n"); exit(1); } - imaevm_params.keyid = keyid; + imaevm_keyid = keyid; break; case 146: veritysig = 1; @@ -3241,12 +3252,16 @@ int main(int argc, char *argv[]) g_keypass = getenv("EVMCTL_KEY_PASSWORD"); if (imaevm_params.keyfile != NULL && - imaevm_params.eng == NULL && + access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE && !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { #if CONFIG_IMA_EVM_ENGINE - imaevm_params.eng = setup_engine("pkcs11"); + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE) { + access_info.u.engine = setup_engine("pkcs11"); + if (access_info.u.engine) + access_info.type = IMAEVM_OSSL_ACCESS_TYPE_ENGINE; + } #endif - if (!imaevm_params.eng) + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE) goto error; } @@ -3272,9 +3287,9 @@ int main(int argc, char *argv[]) error: #if CONFIG_IMA_EVM_ENGINE - if (imaevm_params.eng) { - ENGINE_finish(imaevm_params.eng); - ENGINE_free(imaevm_params.eng); + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_ENGINE) { + ENGINE_finish(access_info.u.engine); + ENGINE_free(access_info.u.engine); #if OPENSSL_API_COMPAT < 0x10100000L ENGINE_cleanup(); #endif From patchwork Mon Feb 26 18:20:59 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13572684 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5EC4312F36D for ; Mon, 26 Feb 2024 18:21:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971683; cv=none; b=bONLmbx3D2i4iB3+LRCvap9LQYnZ+FWanMu+EcAm0Fx9JTOZFNqHKyRVz+wNEJAghJg3wovyjagdZGi/sAf29R5Esm/zolAJ2uCF2uq5wGHqbAUU+nckictMESwe+hN7f6s90tBZKxPWI/vlfgTUvVeo86XXQw+AcrY64+b2Srk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971683; c=relaxed/simple; bh=HRONivaQhC6Vp7JdUuf1tXEspUPOqWLkGfbSYdO2yiM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L8EES61JO4Q+Ve/JFOw3gUVPmbtSeYSbiFHryudFI/oQigfwIj8PtGNnzn/+l4DTxHKXvpyTbOgPEX0cayq/gbZ4bT1FV+0Gfk7HjmTJCivBU7X9t7Mn6UYv6/1Vbv3yer+7UvVe7pE5Y+XOzfg3IiyR1ukj67y41A7wNxW9dUc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=BhWa4iNm; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="BhWa4iNm" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41QHQuWN011094; Mon, 26 Feb 2024 18:21:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=hfSYoBQdRRDBCdEd3kxbkBcBRjJxW0HEr3mmdr18pgA=; b=BhWa4iNm0SDLdfxUbh8O0C6r2ZUnNktObHQy88sJ8IFWjkR+DEgQZRtcD7yMqFfnRS1d 54/AlY08EkVuLPzHAm2YnSm1QAV1kJ89SnClWsHeOlQQFsdXZRiqiUDTOgchy67XeEUR 0U5SecemNPE6nNhO04AbUysR3xVbuIyKcotlumsJ82LEGICEER3HkHD4BkffxYNl5GWt phCm1S+74B1Ob0gRhSCJCQMt35pkhEUrhDGKyMzpIMP90297EQq88NyJoONaux2qZaxf ASyegtLmR3O1ganx0Acu4nH8vSoYpcfmeSyR8I+aFfU2ndyMmGy4Bs03RfaF8Ltp7w8v jA== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wgy24samd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:11 +0000 Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41QGCms4012338; Mon, 26 Feb 2024 18:21:10 GMT Received: from smtprelay02.dal12v.mail.ibm.com ([172.16.1.4]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 3wfwg22e7f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:10 +0000 Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay02.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41QIL7PR27722316 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 26 Feb 2024 18:21:09 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 824EF5805F; Mon, 26 Feb 2024 18:21:07 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EE5C058058; Mon, 26 Feb 2024 18:21:06 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 26 Feb 2024 18:21:06 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v3 ima-evm-utils 5/7] Add support for OpenSSL provider to the library and evmctl Date: Mon, 26 Feb 2024 13:20:59 -0500 Message-ID: <20240226182101.25210-6-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240226182101.25210-1-stefanb@linux.ibm.com> References: <20240226182101.25210-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 8Ebcr78rZ5wRGi8hUA7fpG4PwPv94B5r X-Proofpoint-ORIG-GUID: 8Ebcr78rZ5wRGi8hUA7fpG4PwPv94B5r X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-26_11,2024-02-26_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 adultscore=0 clxscore=1015 priorityscore=1501 phishscore=0 impostorscore=0 suspectscore=0 lowpriorityscore=0 mlxscore=0 mlxlogscore=999 spamscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402260139 Also implement the --provider option that is useful for testing with provider. It also helps a user to select whether to use an engine or a provider. Update the README with the new option. Signed-off-by: Stefan Berger --- README | 5 ++-- configure.ac | 6 ++++ src/Makefile.am | 21 +++++++++++--- src/evmctl.c | 49 +++++++++++++++++++++++++++++++++ src/imaevm.h | 9 ++++++ src/libimaevm.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 157 insertions(+), 6 deletions(-) diff --git a/README b/README index 54746ef..815b555 100644 --- a/README +++ b/README @@ -69,7 +69,6 @@ OPTIONS --smack use extra SMACK xattrs for EVM --m32 force EVM hmac/signature for 32 bit target system --m64 force EVM hmac/signature for 64 bit target system - --engine e preload OpenSSL engine e (such as: gost) is deprecated --ino use custom inode for EVM --uid use custom UID for EVM --gid use custom GID for EVM @@ -79,9 +78,11 @@ OPTIONS --selinux use custom Selinux label for EVM --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use) --pcrs file containing TPM pcrs, one per hash-algorithm/bank - --ignore-violations ignore ToMToU measurement violations --verify-sig verify the file signature based on the file hash, both stored in the template data. + --engine e preload OpenSSL engine e (such as: gost) is deprecated + --provider p preload OpenSSL provider (such as: pkcs11) + --ignore-violations ignore ToMToU measurement violations --hmackey path to symmetric key (default: /etc/keys/evm-key-plain) -v increase verbosity level -h, --help display this help and exit diff --git a/configure.ac b/configure.ac index 365aacf..d0d2e21 100644 --- a/configure.ac +++ b/configure.ac @@ -61,6 +61,11 @@ AC_ARG_ENABLE(engine, AC_CHECK_LIB([crypto], [ENGINE_init],, [enable_engine=no]) AM_CONDITIONAL([CONFIG_IMA_EVM_ENGINE], [test "x$enable_engine" = "xyes"]) +AC_ARG_ENABLE(provider, + [AS_HELP_STRING([--disable-provider], [build ima-evm-utils without OpenSSL providre support])],,[enable_provider=yes]) + AC_CHECK_LIB([crypto], [OSSL_PROVIDER_load],, [enable_provider=no]) + AM_CONDITIONAL([CONFIG_IMA_EVM_PROVIDER], [test "x$enable_provider" = "xyes"]) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then @@ -99,6 +104,7 @@ echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode" echo " ibmtss: $ac_cv_header_ibmtss_tss_h" echo " sigv1: $enable_sigv1" echo " engine: $enable_engine" +echo " provider: $enable_provider" echo " doc: $have_doc" echo " pandoc: $have_pandoc" echo diff --git a/src/Makefile.am b/src/Makefile.am index 3bf742f..7c3f5fd 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -7,12 +7,18 @@ libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) libimaevm_la_LDFLAGS = -version-info 4:0:0 libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS) +libimaevm_la_CFLAGS = + if CONFIG_SIGV1 -libimaevm_la_CFLAGS = -DCONFIG_SIGV1 +libimaevm_la_CFLAGS += -DCONFIG_SIGV1 endif if CONFIG_IMA_EVM_ENGINE -libimaevm_la_CFLAGS = -DCONFIG_IMA_EVM_ENGINE +libimaevm_la_CFLAGS += -DCONFIG_IMA_EVM_ENGINE +endif + +if CONFIG_IMA_EVM_PROVIDER +libimaevm_la_CFLAGS += -DCONFIG_IMA_EVM_PROVIDER endif include_HEADERS = imaevm.h @@ -30,14 +36,21 @@ evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS) evmctl_LDFLAGS = $(LDFLAGS_READLINE) evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la +evmctl_CFLAGS = + # Enable IMA signature version 1 if CONFIG_SIGV1 -evmctl_CFLAGS = -DCONFIG_SIGV1 +evmctl_CFLAGS += -DCONFIG_SIGV1 endif # Enable "--engine" support if CONFIG_IMA_EVM_ENGINE -evmctl_CFLAGS = -DCONFIG_IMA_EVM_ENGINE +evmctl_CFLAGS += -DCONFIG_IMA_EVM_ENGINE +endif + +# Enable "--provider" support +if CONFIG_IMA_EVM_PROVIDER +evmctl_CFLAGS += -DCONFIG_IMA_EVM_PROVIDER endif # USE_PCRTSS uses the Intel TSS diff --git a/src/evmctl.c b/src/evmctl.c index 20f34dd..ffe2fc9 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -68,6 +68,9 @@ #if CONFIG_IMA_EVM_ENGINE #include #endif +#if CONFIG_IMA_EVM_PROVIDER +#include +#endif #include #include "hash_info.h" #include "pcr.h" @@ -2914,6 +2917,9 @@ static void usage(void) " --verify-sig verify measurement list signatures\n" #if CONFIG_IMA_EVM_ENGINE " --engine e preload OpenSSL engine e (such as: gost) is deprecated\n" +#endif +#if CONFIG_IMA_EVM_PROVIDER + " --provider p preload OpenSSL provider (such as: pkcs11)\n" #endif " --ignore-violations ignore ToMToU measurement violations\n" #ifdef DEBUG @@ -2991,6 +2997,9 @@ static struct option opts[] = { {"veritysig", 0, 0, 146}, {"hwtpm", 0, 0, 147}, {"hmackey", 1, 0, 148}, +#if CONFIG_IMA_EVM_PROVIDER + {"provider", 1, 0, 149}, +#endif {} }; @@ -3036,6 +3045,25 @@ static char *get_password(void) return password; } + +#if CONFIG_IMA_EVM_PROVIDER +static OSSL_PROVIDER *setup_provider(const char *name) +{ + OSSL_PROVIDER *p = OSSL_PROVIDER_load(NULL, name); + + if (!p) { + log_err("provider %s isn't available\n", optarg); + ERR_print_errors_fp(stderr); + } else if (!OSSL_PROVIDER_self_test(p)) { + log_err("provider %s self test failed\n", optarg); + ERR_print_errors_fp(stderr); + OSSL_PROVIDER_unload(p); + p = NULL; + } + return p; +} +#endif + #if CONFIG_IMA_EVM_ENGINE static ENGINE *setup_engine(const char *engine_id) { @@ -3240,6 +3268,16 @@ int main(int argc, char *argv[]) case 148: imaevm_params.hmackeyfile = optarg; break; +#if CONFIG_IMA_EVM_PROVIDER + case 149: /* --provider p */ + access_info.u.provider = setup_provider(optarg); + if (!access_info.u.provider) { + log_info("setup_provider failed\n"); + goto error; + } + access_info.type = IMAEVM_OSSL_ACCESS_TYPE_PROVIDER; + break; +#endif case '?': exit(1); break; @@ -3254,6 +3292,13 @@ int main(int argc, char *argv[]) if (imaevm_params.keyfile != NULL && access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE && !strncmp(imaevm_params.keyfile, "pkcs11:", 7)) { +#if CONFIG_IMA_EVM_PROVIDER + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE) { + access_info.u.provider = setup_provider("pkcs11"); + if (access_info.u.provider) + access_info.type = IMAEVM_OSSL_ACCESS_TYPE_PROVIDER; + } +#endif #if CONFIG_IMA_EVM_ENGINE if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_NONE) { access_info.u.engine = setup_engine("pkcs11"); @@ -3294,6 +3339,10 @@ error: ENGINE_cleanup(); #endif } +#endif +#if CONFIG_IMA_EVM_PROVIDER + if (access_info.type == IMAEVM_OSSL_ACCESS_TYPE_PROVIDER) + OSSL_PROVIDER_unload(access_info.u.provider); #endif ERR_free_strings(); EVP_cleanup(); diff --git a/src/imaevm.h b/src/imaevm.h index 6764604..281a748 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -57,6 +57,13 @@ struct engine_st; typedef struct engine_st ENGINE; /* unused when no engine support */ #endif +#if OPENSSL_VERSION_NUMBER >= 0x30000000 +# include +#else +struct ossl_provider_st; +typedef struct ossl_provider_st OSSL_PROVIDER; +#endif + #ifdef USE_FPRINTF #define do_log(level, fmt, args...) \ ({ if (level <= imaevm_params.verbose) fprintf(stderr, fmt, ##args); }) @@ -268,8 +275,10 @@ struct imaevm_ossl_access { int type; #define IMAEVM_OSSL_ACCESS_TYPE_NONE 0 #define IMAEVM_OSSL_ACCESS_TYPE_ENGINE 1 /* also: engine field exists */ +#define IMAEVM_OSSL_ACCESS_TYPE_PROVIDER 2 /* also: provider field exists */ union { ENGINE *engine; + OSSL_PROVIDER *provider; } u; }; diff --git a/src/libimaevm.c b/src/libimaevm.c index 91af613..64ddd96 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -62,6 +62,12 @@ #include #include +#if CONFIG_IMA_EVM_PROVIDER +#include +#include +#include +#endif + #include "imaevm.h" #include "hash_info.h" @@ -1064,6 +1070,64 @@ err_engine: #endif } +#ifdef CONFIG_IMA_EVM_PROVIDER +static int ui_get_pin(UI *ui, UI_STRING *uis) +{ + return UI_set_result(ui, uis, UI_get0_user_data(ui)); +} + +static EVP_PKEY *read_priv_pkey_provider(OSSL_PROVIDER *p, const char *keyfile, + const char *keypass, uint32_t keyid) +{ + UI_METHOD *ui_method = NULL; + OSSL_STORE_INFO *info; + OSSL_STORE_CTX *store; + EVP_PKEY *pkey = NULL; + int typ; + + if (!keyid) { + log_err("When using a pkcs11 URI you must provide the keyid with an option\n"); + return NULL; + } + + if (keypass) { + ui_method = UI_create_method("PIN reader"); + if (!ui_method) + return NULL; + UI_method_set_reader(ui_method, ui_get_pin); + } + store = OSSL_STORE_open_ex(keyfile, NULL, "provider=pkcs11", ui_method, + (void *)keypass, NULL, NULL, NULL); + if (!store) { + log_err("Failed to open store for provider=pkcs11\n"); + goto err_provider; + } + for (info = OSSL_STORE_load(store); + info != NULL && pkey == NULL; + info = OSSL_STORE_load(store)) { + typ = OSSL_STORE_INFO_get_type(info); + + switch (typ) { + case OSSL_STORE_INFO_PKEY: + pkey = OSSL_STORE_INFO_get1_PKEY(info); + break; + } + OSSL_STORE_INFO_free(info); + } + OSSL_STORE_close(store); + + if (!pkey) { + log_err("Failed to load private key %s\n", keyfile); + goto err_provider; + } + return pkey; + +err_provider: + output_openssl_errors(); + return NULL; +} +#endif + static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, const struct imaevm_ossl_access *access_info, uint32_t keyid) @@ -1077,6 +1141,12 @@ static EVP_PKEY *read_priv_pkey(const char *keyfile, const char *keypass, pkey = read_priv_pkey_engine(access_info->u.engine, keyfile, keypass, keyid); break; +#ifdef CONFIG_IMA_EVM_PROVIDER + case IMAEVM_OSSL_ACCESS_TYPE_PROVIDER: + pkey = read_priv_pkey_provider(access_info->u.provider, + keyfile, keypass, keyid); + break; +#endif } } else { fp = fopen(keyfile, "r"); @@ -1331,6 +1401,9 @@ static int check_ossl_access(const struct imaevm_ossl_access *access_info) case IMAEVM_OSSL_ACCESS_TYPE_NONE: #ifdef CONFIG_IMA_EVM_ENGINE case IMAEVM_OSSL_ACCESS_TYPE_ENGINE: +#endif +#ifdef CONFIG_IMA_EVM_PROVIDER + case IMAEVM_OSSL_ACCESS_TYPE_PROVIDER: #endif return 0; From patchwork Mon Feb 26 18:21:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13572681 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A44812EBC8 for ; Mon, 26 Feb 2024 18:21:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971682; cv=none; b=S3bAbvaFsbOxDH+yp4wSAWU10aLWpi/aJxuVm8VQvllvHXKPD6qzO96U/3BV0HeYurkKcoRhJ+n3lHPtO8zYGtjc6tslq92lzyRBgp6jbtMGkJOK+RmY998HHSdYHd5Mbziby+PkO01yfJ0IdjvkkvOskTW4PYbTTlhgHJcJ5do= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971682; c=relaxed/simple; bh=AtRW7jklFDL1ukZ9woG1s51F9RTHnmjb+EklXIyhK60=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CTt/cWY1RTcn4Sp59ZCiUbDv7QCaRREDXbeE7/20IhefsmwDBwQJBogQ2WMJzQ1trPE6mhSMvtSrGDmezDbhc+h0ZMvwCuXv/dVCDTrOeXF4IgHCLmRNEgMlbbIxIIeRPcRErzRO1J9FTUQYux0eYgZ6aNpLEkPhndkYGMMWKng= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=PTdrfDwg; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="PTdrfDwg" Received: from pps.filterd (m0353724.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41QGvRcn014978; Mon, 26 Feb 2024 18:21:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=TYF72XV/UoIgUxdKwiHCq1RqywtiOaUr2MpnslvQlTU=; b=PTdrfDwg67jspThQmZ891600r7WxVl3LA3c69fsjyO9s74QDcvPQXI4mnl1fDSANFwtD Bm3/hxn1rBDDq9VGnccAkOXDTbqNiYMnVV0n4+oFaykHETV53AMgLu8HwAmCHutJbhLY SdBguGBWX/puTb0nQ16mL9Js4ti3M9pgbU/baBa/IVeSHg5nCXyM7xkFwDDbfxhxqPhd FEOwtW7o16fX0b6wF1n5ZwPZMhxeS4lv6WURXiKwMcPGJTkac441z4YJr5wcO7CKiwkZ jTLgZrz557arpIiRJNYs4DBQRGY8YGNq/H+DG89HXfPaC88APgGldXjmLqz4K4IAVFzD cQ== Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wgwh7ku0d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:12 +0000 Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41QGBYgo012324; Mon, 26 Feb 2024 18:21:11 GMT Received: from smtprelay03.dal12v.mail.ibm.com ([172.16.1.5]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 3wfwg22e7g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:11 +0000 Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay03.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41QIL8ej16646810 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 26 Feb 2024 18:21:10 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B28958061; Mon, 26 Feb 2024 18:21:08 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A74F15805B; Mon, 26 Feb 2024 18:21:07 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 26 Feb 2024 18:21:07 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v3 ima-evm-utils 6/7] tests: Add pkcs11 test using provider Date: Mon, 26 Feb 2024 13:21:00 -0500 Message-ID: <20240226182101.25210-7-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240226182101.25210-1-stefanb@linux.ibm.com> References: <20240226182101.25210-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: ic8bt2SdCbfg66j8PH8UoZG_z_SN4kLl X-Proofpoint-ORIG-GUID: ic8bt2SdCbfg66j8PH8UoZG_z_SN4kLl X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-26_11,2024-02-26_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 priorityscore=1501 mlxlogscore=999 suspectscore=0 adultscore=0 malwarescore=0 bulkscore=0 spamscore=0 phishscore=0 mlxscore=0 impostorscore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402260139 Adjust the existing pkcs11 engine test cases to pass --engine pkcs11 via an option (OPTS) to evmctl rather than using a global variable. Then duplicate the pkcs11 engine tests and pass --provider pkcs11 to run the same tests using OpenSSL provider. Also check whether evmctl was compiled with provider support and if the pkcs11 provider is installed. Signed-off-by: Stefan Berger --- tests/functions.sh | 1 - tests/sign_verify.test | 20 +++++++++++++++++--- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/tests/functions.sh b/tests/functions.sh index c39b894..962a436 100755 --- a/tests/functions.sh +++ b/tests/functions.sh @@ -373,7 +373,6 @@ _softhsm_setup() { PKCS11_KEYURI=$(echo "$msg" | sed -n 's|^keyuri: \(.*\)|\1|p') export PKCS11_KEYURI - export EVMCTL_ENGINE="--engine pkcs11" export OPENSSL_ENGINE="-engine pkcs11" export OPENSSL_KEYFORM="-keyform engine" else diff --git a/tests/sign_verify.test b/tests/sign_verify.test index 16c7ada..f9522e0 100755 --- a/tests/sign_verify.test +++ b/tests/sign_verify.test @@ -447,10 +447,24 @@ if [ -n "${PKCS11_KEYURI}" ]; then expect_pass __skip expect_pass __skip fi + + # provider may not be supported or pkcs11 provider not installed + if evmctl --help 2>/dev/null | grep -q provider && \ + openssl list -providers -provider pkcs11 2>/dev/null; then + PKCS11_PRIVKEYURI=${PKCS11_KEYURI//type=public/type=private} + + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_PRIVKEYURI}" ALG=sha256 PREFIX=0x030204aabbccdd0100 OPTS="--keyid=aabbccdd --provider pkcs11" + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY="${PKCS11_PRIVKEYURI}" ALG=sha1 PREFIX=0x030202aabbccdd0100 OPTS="--keyid=aabbccdd --provider pkcs11" + else + __skip() { echo "pkcs11 test with provider is skipped since no provider support or pkcs11 not installed"; return "$SKIP"; } + expect_pass __skip + expect_pass __skip + fi else # to have a constant number of tests, skip these two tests - __skip() { echo "pkcs11 test is skipped: could not setup softhsm"; return $SKIP; } - expect_pass __skip - expect_pass __skip + __skip() { echo "pkcs11 test is skipped: could not setup softhsm"; return "$SKIP"; } + for i in $(seq 0 3); do + expect_pass __skip + done fi _softhsm_teardown "${WORKDIR}" From patchwork Mon Feb 26 18:21:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Berger X-Patchwork-Id: 13572685 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AE8FE12EBEA for ; Mon, 26 Feb 2024 18:21:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971684; cv=none; b=INWvdQPHxi91LDN02MGWLDrfErldEy6P72V8fK4VvfKe61zRgmqkpZenZbkvha4bwdJ5cJjwOxnYJYryGHg3k73SB+uUe41Il8tBG+aqVyX+bGEzMrH5iYSuBfEJS0PZmX5Xe0wC5T4x1vqDIHCuwO+9B/Dp5xd1kdIGV5H9zxo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708971684; c=relaxed/simple; bh=iNA/kc7UPyjMMK2i3x91mmPz5yfBx9he3h/LXxVBrRQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hBr2RGeNljGq8+acvDNqYmJxHzC9I4SpEatmiVMfmF5dy0koSrey///TnWqvqQ3Szf2Ti3NO+syy/nhPBJ9/bHAFhovq+uBuPTAOjV8kZlJQDP+3/2gOvJYu2lj7FG4GPHmtgOFo/R3ZWkUR/Ma5YSpcTLIRtgN4Kp4GLYjh1Rg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=hU8R6LHs; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="hU8R6LHs" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 41QIDB4B016041; Mon, 26 Feb 2024 18:21:13 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding; s=pp1; bh=g/mtk9QchJ3u9KHc8aPW5RPudytJFyvaugHvgkEX84A=; b=hU8R6LHsRkS2F9vOyMH3EegvfxQCIAsIej4V2R8hM9JlwSatvQCAfpjxLY2+PUIe5zYZ Lc8xIIEXsmvsxOi77ocAwkTzArMEerU57hLYLGyZzIuPbblYnJRZ7EquZsiJjmqzhc/d IronghYXQLc7iCjOSE9tpnUJINQTLk00ZTBhzNndud83n3zRVYAIAnQsxURq61v1edvz RaY+S4JUMR37ld6rCBRV5D9H1FZgm7jn4T+HJ2WXFm6LInEz1uz0pTUUQ810qzdxz4yV iufLoa3N8sYb+pZQ5BvRyB9mRXhcfUQMNnSiRcjZpOXZRlHBNGaD298m+bEoI9E5DbBQ KA== Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3wgyqm85bq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:12 +0000 Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 41QGRMcn021756; Mon, 26 Feb 2024 18:21:12 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3wfu5yu2sn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 26 Feb 2024 18:21:12 +0000 Received: from smtpav02.wdc07v.mail.ibm.com (smtpav02.wdc07v.mail.ibm.com [10.39.53.229]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 41QIL91w18612982 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 26 Feb 2024 18:21:11 GMT Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E84815806C; Mon, 26 Feb 2024 18:21:08 +0000 (GMT) Received: from smtpav02.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6042D58059; Mon, 26 Feb 2024 18:21:08 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav02.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 26 Feb 2024 18:21:08 +0000 (GMT) From: Stefan Berger To: linux-integrity@vger.kernel.org Cc: zohar@linux.ibm.com, roberto.sassu@huawei.com, vt@altlinux.org, Stefan Berger Subject: [PATCH v3 ima-evm-utils 7/7] ci: Install pkcs11-provider where available Date: Mon, 26 Feb 2024 13:21:01 -0500 Message-ID: <20240226182101.25210-8-stefanb@linux.ibm.com> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240226182101.25210-1-stefanb@linux.ibm.com> References: <20240226182101.25210-1-stefanb@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-integrity@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: RMT9O6yG4Bmz_sBGyy-MMQVXRAATU5kl X-Proofpoint-ORIG-GUID: RMT9O6yG4Bmz_sBGyy-MMQVXRAATU5kl X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-26_11,2024-02-26_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 lowpriorityscore=0 adultscore=0 priorityscore=1501 impostorscore=0 suspectscore=0 bulkscore=0 mlxscore=0 mlxlogscore=841 spamscore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2402260139 Install the pkcs11-provider package. For it to be useful softhsm and gnutls are also needed, so in some cases install them together so that if one of the packages cannot be installed then none of them are installed. Signed-off-by: Stefan Berger --- ci/alt.sh | 2 ++ ci/debian.sh | 1 + ci/fedora.sh | 1 + ci/tumbleweed.sh | 2 ++ 4 files changed, 6 insertions(+) diff --git a/ci/alt.sh b/ci/alt.sh index 36ff657..f86dcec 100755 --- a/ci/alt.sh +++ b/ci/alt.sh @@ -27,3 +27,5 @@ apt-get install -y \ xsltproc \ xxd \ && control openssl-gost enabled + +apt-get install -y pkcs11-provider || true diff --git a/ci/debian.sh b/ci/debian.sh index 7676191..740eb9e 100755 --- a/ci/debian.sh +++ b/ci/debian.sh @@ -59,3 +59,4 @@ $apt \ $apt xxd || $apt vim-common $apt libengine-gost-openssl1.1$ARCH || true $apt softhsm gnutls-bin libengine-pkcs11-openssl1.1$ARCH || true +$apt softhsm gnutls-bin pkcs11-provider || true diff --git a/ci/fedora.sh b/ci/fedora.sh index 1d17c6b..44fd956 100755 --- a/ci/fedora.sh +++ b/ci/fedora.sh @@ -60,6 +60,7 @@ if [ -f /etc/centos-release ]; then yum -y install epel-release fi yum -y install softhsm || true +yum -y install softhsm pkcs11-provider || true # haveged is available via EPEL on CentOS stream8. yum -y install haveged || true diff --git a/ci/tumbleweed.sh b/ci/tumbleweed.sh index bc111fe..a58c296 100755 --- a/ci/tumbleweed.sh +++ b/ci/tumbleweed.sh @@ -48,6 +48,8 @@ zypper --non-interactive install --force-resolution --no-recommends \ zypper --non-interactive install --force-resolution --no-recommends \ gnutls openssl-engine-libp11 softhsm || true +zypper --non-interactive install --force-resolution --no-recommends \ + gnutls pkcs11-provider softhsm || true if [ -f /usr/lib/ibmtss/tpm_server -a ! -e /usr/local/bin/tpm_server ]; then ln -s /usr/lib/ibmtss/tpm_server /usr/local/bin