dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 14:43:37 +02:00
Code Releases Activity

added support for kernel module signature

Browse Source 
Kernel module signature is appended to the kernel module.
Kernel signature also contains signature length and magic.
Added --modsig parameter to generate kernel module signature.

Signature can be added to the module like: cat module.sig >> module.ko

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
This commit is contained in:
Dmitry Kasatkin 2012-08-09 21:30:17 +03:00
parent 72ad26c3be
commit 203f058903
1 changed files with 25 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
src/evmctl.c
View File

@ -151,6 +151,7 @@ static char *hash_algo = "sha1";
static int binkey; static int binkey;
static char *keypass; static char *keypass;
static int sigfile; static int sigfile;
static int modsig;
struct command cmds[]; struct command cmds[];
static void print_usage(struct command *cmd); static void print_usage(struct command *cmd);
@ -721,6 +722,7 @@ static int sign_ima(const char *file, const char *key)
{ {
unsigned char hash[64]; unsigned char hash[64];
unsigned char sig[1024] = "\x03"; unsigned char sig[1024] = "\x03";
char magic[] = "This Is A Crypto Signed Module";
int len, err; int len, err;
len = calc_hash(file, hash); len = calc_hash(file, hash);
@ -731,11 +733,24 @@ static int sign_ima(const char *file, const char *key)
if (len <= 1) if (len <= 1)
return len; return len;
/* add header */
len++;
if (modsig) {
/* add signature length */
*(uint16_t *)(sig + len) = __cpu_to_be16(len - 1);
len += sizeof(uint16_t);
memcpy(sig + len, magic, sizeof(magic) - 1);
len += sizeof(magic) - 1;
bin2file(file, "sig", sig + 1, len - 1);
return 0;
}
if (sigfile) if (sigfile)
bin2file(file, "sig", sig, len + 1); bin2file(file, "sig", sig, len);
if (xattr) { if (xattr) {
err = setxattr(file, "security.ima", sig, len + 1, 0); err = setxattr(file, "security.ima", sig, len, 0);
if (err < 0) { if (err < 0) {
log_err("setxattr failed: %s\n", file); log_err("setxattr failed: %s\n", file);
return err; return err;
@ -1216,6 +1231,7 @@ static void usage(void)
" -s, --imasig also make IMA signature\n" " -s, --imasig also make IMA signature\n"
" -d, --imahash also make IMA hash\n" " -d, --imahash also make IMA hash\n"
" -f, --sigfile store IMA signature in .sig file instead of xattr\n" " -f, --sigfile store IMA signature in .sig file instead of xattr\n"
" -m, --modsig store module signature in .sig file instead of xattr\n"
" -b, --bin signing key is in binary format\n" " -b, --bin signing key is in binary format\n"
" -p, --pass password for encrypted signing key\n" " -p, --pass password for encrypted signing key\n"
" -n print result to stdout instead of setting xattr\n" " -n print result to stdout instead of setting xattr\n"
@ -1230,7 +1246,7 @@ struct command cmds[] = {
{"convert", cmd_convert, 0, "inkey outkey", "Convert PEM public key into IMA/EVM kernel friendly format.\n"}, {"convert", cmd_convert, 0, "inkey outkey", "Convert PEM public key into IMA/EVM kernel friendly format.\n"},
{"sign", cmd_sign_evm, 0, "[--imahash | --imasig ] [--pass password] file [key]", "Sign file metadata.\n"}, {"sign", cmd_sign_evm, 0, "[--imahash | --imasig ] [--pass password] file [key]", "Sign file metadata.\n"},
{"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"}, {"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"},
{"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--pass password] file [key]", "Make file content signature.\n"}, {"ima_sign", cmd_sign_ima, 0, "[--sigfile | --modsig] [--pass password] file [key]", "Make file content signature.\n"},
{"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"}, {"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"},
#ifdef DEBUG #ifdef DEBUG
{"hmac", cmd_hmac_evm, 0, "[--imahash | --imasig ] file [key]", "Sign file metadata with HMAC using symmetric key (for testing purpose).\n"}, {"hmac", cmd_hmac_evm, 0, "[--imahash | --imasig ] file [key]", "Sign file metadata with HMAC using symmetric key (for testing purpose).\n"},
@ -1246,6 +1262,7 @@ static struct option opts[] = {
{"bin", 0, 0, 'b'}, {"bin", 0, 0, 'b'},
{"pass", 1, 0, 'p'}, {"pass", 1, 0, 'p'},
{"sigfile", 0, 0, 'f'}, {"sigfile", 0, 0, 'f'},
{"modsig", 0, 0, 'm'},
{} {}
}; };
@ -1292,6 +1309,11 @@ int main(int argc, char *argv[])
break; break;
case 'f': case 'f':
sigfile = 1; sigfile = 1;
xattr = 0;
break;
case 'm':
modsig = 1;
xattr = 0;
break; break;
case '?': case '?':
exit(1); exit(1);