dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-07-02 13:43:16 +02:00
Code Releases Activity

ima_evm_utils: erroneous "verification failed: 0 (invalid padding)" message

Browse Source 
When public keys are specified on the boot command line (--key "<public
key file>,[<public key file>,...]"), the appropriate public key is used
to verify EVM or file signatures.  If no keys are specified, the default
x509_evm.der or pubkey_evm.pem file is used to verify the DIGSIG_VERSION_2
or DIGSIG_VERSION_1 signatures respectively, without first checking the
keyids.  Instead of emitting a "verification failed: 0 (invalid
padding)" message, an "unknown keyid" message would be clearer.

To address this problem, when no public keys are specified, this patch
loads the x509_evm.der default public key onto the "public_keys" list,
while the pubkey_evm.pem continues to be passed to verify_hash_v1()

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar
2019-07-16 21:36:29 -04:00
parent a225728550
commit 388f807a0f
2 changed files with 18 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/evmctl.c
View File

@ -838,6 +838,11 @@ static int cmd_verify_evm(struct command *cmd)
return -1;
}
if (params.keyfile) /* Support multiple public keys */
init_public_keys(params.keyfile);
else /* assume read pubkey from x509 cert */
init_public_keys("/etc/keys/x509_evm.der");
err = verify_evm(file);
if (!err && params.verbose >= LOG_INFO)
log_info("%s: verification is OK\n", file);
@ -879,8 +884,10 @@ static int cmd_verify_ima(struct command *cmd)
char *file = g_argv[optind++];
int err;
if (params.keyfile)
if (params.keyfile) /* Support multiple public keys */
init_public_keys(params.keyfile);
else /* assume read pubkey from x509 cert */
init_public_keys("/etc/keys/x509_evm.der");
errno = 0;
if (!file) {
@ -1602,9 +1609,10 @@ static int ima_measurement(const char *file)
return -1;
}
/* Support multiple public keys */
if (params.keyfile)
if (params.keyfile) /* Support multiple public keys */
init_public_keys(params.keyfile);
else /* assume read pubkey from x509 cert */
init_public_keys("/etc/keys/x509_evm.der");
while (fread(&entry.header, sizeof(entry.header), 1, fp)) {
ima_extend_pcr(pcr[entry.header.pcr], entry.header.digest,