dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-09-17 17:35:20 +02:00
Code Releases Activity

ima-evm-utils: verify the measurement list signature based on the list digest

Browse Source 
Instead of verifying file signatures included in the measurement list,
by calculating the local file hash, verify the file signature based on the
digest contained in the measurement list.

This patch defines a new option named "--list".

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
This commit is contained in:
Mimi Zohar
2018-01-17 15:31:31 -05:00
parent 9c79b7de72
commit 1a69e42ac1
4 changed files with 23 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/evmctl.c
View File

@@ -113,6 +113,7 @@ static char *caps_str;
static char *ima_str;
static char *selinux_str;
static char *search_type;
static int measurement_list;
static int recursive;
static int msize;
static dev_t fs_dev;
@@ -792,7 +793,7 @@ static int verify_ima(const char *file)
}
}
return ima_verify_signature(file, sig, len);
return ima_verify_signature(file, sig, len, NULL, 0);
}
static int cmd_verify_ima(struct command *cmd)
@@ -1392,7 +1393,11 @@ void ima_ng_show(struct template_entry *entry)
if (sig) {
log_info(" ");
log_dump(sig, sig_len);
ima_verify_signature(path, sig, sig_len);
if (measurement_list)
ima_verify_signature(path, sig, sig_len,
digest, digest_len);
else
ima_verify_signature(path, sig, sig_len, NULL, 0);
} else
log_info("\n");
@@ -1586,6 +1591,7 @@ static void usage(void)
" --ima use custom IMA signature for EVM\n"
" --selinux use custom Selinux label for EVM\n"
" --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n"
" --list measurement list verification\n"
" -v increase verbosity level\n"
" -h, --help display this help and exit\n"
"\n");
@@ -1637,6 +1643,7 @@ static struct option opts[] = {
{"ima", 1, 0, 135},
{"selinux", 1, 0, 136},
{"caps", 2, 0, 137},
{"list", 0, 0, 138},
{}
};
@@ -1785,6 +1792,9 @@ int main(int argc, char *argv[])
caps_str = optarg;
hmac_flags |= HMAC_FLAG_CAPS_SET;
break;
case 138:
measurement_list = 1;
break;
case '?':
exit(1);
break;