From 3328f6efed7621ae30c4da08a0cecf7630e48805 Mon Sep 17 00:00:00 2001 From: Bruno Meneguele Date: Fri, 10 Sep 2021 15:47:01 -0300 Subject: [PATCH] make SHA-256 the default hash algorithm The SHA-1 algorithm is considered a weak hash algorithm and there has been some movement within certain distros to drop its support completely or at least drop it from the default behavior. ima-evm-utils uses it as the default algorithm in case the user doesn't explicitly ask for another through the --with-default-hash configuration time option or --hashalgo/-a runtime option. With that, make SHA-256 the default hash algorithm instead. Signed-off-by: Bruno Meneguele Signed-off-by: Mimi Zohar --- m4/default-hash-algo.m4 | 2 +- src/imaevm.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4 index b6164a5..92390fd 100644 --- a/m4/default-hash-algo.m4 +++ b/m4/default-hash-algo.m4 @@ -9,7 +9,7 @@ AC_DEFUN([AX_DEFAULT_HASH_ALGO], [ AC_ARG_WITH([default_hash], AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]), [HASH_ALGO=$withval], - [HASH_ALGO=sha1]) + [HASH_ALGO=sha256]) AC_PROG_SED() HASH_ALGO="$(echo $HASH_ALGO | $SED 's/\(.*\)/\L\1\E/')" diff --git a/src/imaevm.h b/src/imaevm.h index ec8551f..0d53a02 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -76,7 +76,7 @@ #define log_errno(fmt, args...) do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno) #ifndef DEFAULT_HASH_ALGO -#define DEFAULT_HASH_ALGO "sha1" +#define DEFAULT_HASH_ALGO "sha256" #endif #define DATA_SIZE 4096