dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-27 22:32:31 +02:00
Code Releases Activity

ima-evm-utils: log unknown keyid's as errors

Browse Source 
Each tima a new unknown key is encountered, emit a message of the format
"key #: <keyid> (unknown keyid)".  The individual files using unknown
keys are then only logged in verbose mode.  Also update the message
emitted to be consistent with other "verification failed" messages.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

Changlog:
- Incorporated Vitaly's fix to prevent a null dereference in `tail->next`
This commit is contained in:
Mimi Zohar 2019-07-18 09:49:51 -04:00
parent 15afdbeae7
commit 3eac3710a9
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/libimaevm.c
View File

@ -424,13 +424,29 @@ static struct public_key_entry *public_keys = NULL;
static EVP_PKEY *find_keyid(uint32_t keyid)
{
struct public_key_entry *entry;
struct public_key_entry *entry, *tail = public_keys;
int i = 1;
for (entry = public_keys; entry != NULL; entry = entry->next) {
if (entry->keyid == keyid)
return entry->key;
i++;
tail = entry;
}
return NULL;
/* add unknown keys to list */
entry = calloc(1, sizeof(struct public_key_entry));
if (!entry) {
perror("calloc");
return 0;
}
entry->keyid = keyid;
if (tail)
tail->next = entry;
else
public_keys = entry;
log_err("key %d: %x (unknown keyid)\n", i, __be32_to_cpup(&keyid));
return 0;
}
void init_public_keys(const char *keyfiles)
@ -493,8 +509,8 @@ static int verify_hash_v2(const char *file, const unsigned char *hash, int size,
if (!pkey) {
uint32_t keyid = hdr->keyid;
log_err("%s: unknown keyid: %x\n", file,
__be32_to_cpup(&keyid));
log_info("%s: verification failed: unknown keyid %x\n",
file, __be32_to_cpup(&keyid));
return -1;
}