dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-27 14:22:31 +02:00
Code Releases Activity

Replace the low level HMAC calls when calculating the EVM HMAC

Browse Source 
Calculating the EVM HMAC and labeling the filesystem was originally
included in ima-evm-utils for debugging purposes only.  For now,
instead of removing EVM HMAC support just replace the low level
HMAC_ calls with EVP_ calls.

The '-a, --hashalgo' specifies the IMA hash or signature algorithm.
The kernel EVM HMAC is limited to SHA1.  Fix ima-evm-utils by hard
coding the EVM HMAC algorithm to SHA1.

Reviewed-by: Petr Vorel <pvorel@suse.cz>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar 2022-08-04 07:59:27 -04:00
parent b9c9759a7e
commit 67ca790435
1 changed files with 33 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
src/evmctl.c
View File

@ -61,6 +61,7 @@
#include <openssl/asn1.h>
#include <openssl/sha.h>
#include <openssl/pem.h>
#include <openssl/evp.h>
#include <openssl/hmac.h>
#include <openssl/err.h>
#include <openssl/rsa.h>
@ -1163,12 +1164,12 @@ static int cmd_setxattr_ima(struct command *cmd)
static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash)
{
const EVP_MD *md;
size_t mdlen;
EVP_MD_CTX *pctx;
EVP_PKEY *pkey = NULL;
struct stat st;
int err = -1;
uint32_t generation = 0;
HMAC_CTX *pctx;
unsigned int mdlen;
char **xattrname;
unsigned char xattr_value[1024];
unsigned char *key;
@ -1179,10 +1180,8 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
struct h_misc_64 hmac_misc;
int hmac_size;
#if OPENSSL_VERSION_NUMBER < 0x10100000
HMAC_CTX ctx;
EVP_MD_CTX ctx;
pctx = &ctx;
#else
pctx = HMAC_CTX_new();
#endif
key = file2bin(keyfile, NULL, &keylen);
@ -1229,16 +1228,23 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
goto out;
}
md = EVP_get_digestbyname(imaevm_params.hash_algo);
if (!md) {
log_err("EVP_get_digestbyname(%s) failed\n",
imaevm_params.hash_algo);
#if OPENSSL_VERSION_NUMBER >= 0x10100000
pctx = EVP_MD_CTX_new();
if (!pctx) {
log_err("EVP_MD_CTX_new failed\n");
goto out;
}
#endif
pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, evmkey, sizeof(evmkey));
if (!pkey) {
log_err("HMAC_Init() failed\n");
goto out;
}
err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL);
if (err) {
log_err("HMAC_Init() failed\n");
err = EVP_DigestSignInit(pctx, NULL, EVP_sha1(), NULL, pkey);
if (err != 1) {
log_err("EVP_DigestSignInit() failed\n");
goto out;
}
@ -1252,12 +1258,12 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
log_info("skipping xattr: %s\n", *xattrname);
continue;
}
/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
log_info("name: %s, size: %d\n", *xattrname, err);
log_debug_dump(xattr_value, err);
err = !HMAC_Update(pctx, xattr_value, err);
if (err) {
log_err("HMAC_Update() failed\n");
err = EVP_DigestSignUpdate(pctx, xattr_value, err);
if (err != 1) {
log_err("EVP_DigestSignUpdate() failed\n");
goto out_ctx_cleanup;
}
}
@ -1296,23 +1302,24 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
log_debug("hmac_misc (%d): ", hmac_size);
log_debug_dump(&hmac_misc, hmac_size);
err = !HMAC_Update(pctx, (const unsigned char *)&hmac_misc, hmac_size);
if (err) {
err = EVP_DigestSignUpdate(pctx, &hmac_misc, hmac_size);
if (err != 1) {
log_err("HMAC_Update() failed\n");
goto out_ctx_cleanup;
}
err = !HMAC_Final(pctx, hash, &mdlen);
if (err)
err = EVP_DigestSignFinal(pctx, hash, &mdlen);
if (err != 1)
log_err("HMAC_Final() failed\n");
out_ctx_cleanup:
#if OPENSSL_VERSION_NUMBER < 0x10100000
HMAC_CTX_cleanup(pctx);
#else
HMAC_CTX_free(pctx);
EVP_PKEY_free(pkey);
#if OPENSSL_VERSION_NUMBER >= 0x10100000
EVP_MD_CTX_free(pctx);
#endif
out:
free(key);
return err ?: mdlen;
if (err == 1)
return mdlen;
return err;
}
static int hmac_evm(const char *file, const char *key)