dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-27 14:22:31 +02:00
Code Releases Activity

Deprecate IMA signature version 1

Browse Source 
The original IMA file signatures were based on a SHA1 hash.  Kernel
support for other hash algorithms was subsequently upstreamed.  Deprecate
"--rsa" support.

Define "--enable-sigv1" option to configure signature v1 support.

Reviewed-by: Petr Vorel <pvorel@suse.cz>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar 2022-08-04 18:33:38 -04:00
parent 8e1da33b0c
commit 751a395772
5 changed files with 66 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
configure.ac
View File

@ -49,6 +49,11 @@ AC_ARG_ENABLE([openssl_conf],
AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by evmctl.])
fi], [enable_openssl_conf=yes])
AC_ARG_ENABLE(sigv1,
AS_HELP_STRING([--enable-sigv1], [Build ima-evm-utils with signature v1 support]))
AM_CONDITIONAL([CONFIG_SIGV1], [test "x$enable_sigv1" = "xyes"])
AS_IF([test "$enable_sigv1" != "yes"], [enable_sigv1="no"])
#debug support - yes for a while
PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support])
if test $pkg_cv_enable_debug = yes; then
@ -83,5 +88,6 @@ echo " openssl-conf: $enable_openssl_conf"
echo " tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free"
echo " tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode"
echo " ibmtss: $ac_cv_header_ibmtss_tss_h"
echo " sigv1: $enable_sigv1"
echo " doc: $have_doc"
echo

10
src/Makefile.am
View File

@ -7,6 +7,10 @@ libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS)
libimaevm_la_LDFLAGS = -version-info 3:0:0
libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS)
if CONFIG_SIGV1
libimaevm_la_CFLAGS = -DCONFIG_SIGV1
endif
include_HEADERS = imaevm.h
nodist_libimaevm_la_SOURCES = hash_info.h
@ -22,6 +26,12 @@ evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS)
evmctl_LDFLAGS = $(LDFLAGS_READLINE)
evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la
# Enable IMA signature version 1
if CONFIG_SIGV1
evmctl_CFLAGS = -DCONFIG_SIGV1
endif
# USE_PCRTSS uses the Intel TSS
if USE_PCRTSS
evmctl_SOURCES += pcr_tss.c

20
src/evmctl.c
View File

@ -990,7 +990,6 @@ static int cmd_verify_ima(struct command *cmd)
init_public_keys("/etc/keys/x509_evm.der");
}
errno = 0;
if (!file) {
log_err("Parameters missing\n");
print_usage(cmd);
@ -1007,6 +1006,7 @@ static int cmd_verify_ima(struct command *cmd)
return fails > 0;
}
#if CONFIG_SIGV1
static int cmd_convert(struct command *cmd)
{
char *inkey;
@ -1037,6 +1037,7 @@ static int cmd_convert(struct command *cmd)
RSA_free(key);
return err;
}
#endif
static int cmd_import(struct command *cmd)
{
@ -1091,6 +1092,7 @@ static int cmd_import(struct command *cmd)
calc_keyid_v2((uint32_t *)keyid, name, pkey);
EVP_PKEY_free(pkey);
} else {
#if CONFIG_SIGV1
RSA *key = read_pub_key(inkey, imaevm_params.x509);
if (!key)
@ -1098,6 +1100,10 @@ static int cmd_import(struct command *cmd)
len = key2bin(key, pub);
calc_keyid_v1(keyid, name, pub, len);
RSA_free(key);
#else
log_info("Importing public RSA key is not supported\n");
return 1;
#endif
}
log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id);
@ -2601,7 +2607,9 @@ static void usage(void)
" -d, --imahash make IMA hash\n"
" -f, --sigfile store IMA signature in .sig file instead of xattr\n"
" --xattr-user store xattrs in user namespace (for testing purposes)\n"
" --rsa use RSA key type and signing scheme v1\n"
#if CONFIG_SIGV1
" --rsa use RSA key type and signing scheme v1 (deprecated)\n"
#endif
" -k, --key path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)\n"
" or a pkcs11 URI\n"
" --keyid n overwrite signature keyid with a 32-bit value in hex (for signing)\n"
@ -2640,8 +2648,12 @@ static void usage(void)
struct command cmds[] = {
{"--version", NULL, 0, ""},
{"help", cmd_help, 0, "<command>"},
{"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring.\n"},
{"convert", cmd_convert, 0, "key", "convert public key into the keyring.\n"},
#if CONFIG_SIGV1
{"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring. ([--rsa] deprecated)\n"},
{"convert", cmd_convert, 0, "key", "convert public key into the keyring. (deprecated)\n"},
#else
{"import", cmd_import, 0, "pubkey keyring", "Import public key into the keyring.\n"},
#endif
{"sign", cmd_sign_evm, 0, "[-r] [--imahash | --imasig ] [--key key] [--pass [password] file", "Sign file metadata.\n"},
{"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"},
{"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--key key] [--pass [password] file", "Make file content signature.\n"},

22
src/libimaevm.c
View File

@ -290,6 +290,7 @@ out:
return pkey;
}
#if CONFIG_SIGV1
RSA *read_pub_key(const char *keyfile, int x509)
{
EVP_PKEY *pkey;
@ -349,6 +350,7 @@ static int verify_hash_v1(const char *file, const unsigned char *hash, int size,
return 0;
}
#endif /* CONFIG_SIGV1 */
struct public_key_entry {
struct public_key_entry *next;
@ -684,6 +686,7 @@ int verify_hash(const char *file, const unsigned char *hash, int size,
{
/* Get signature type from sig header */
if (sig[1] == DIGSIG_VERSION_1) {
#if CONFIG_SIGV1
const char *key = NULL;
/* Read pubkey from RSA key */
@ -693,6 +696,10 @@ int verify_hash(const char *file, const unsigned char *hash, int size,
key = imaevm_params.keyfile;
return verify_hash_v1(file, hash, size, sig + 1, siglen - 1,
key);
#else
log_info("Signature version 1 deprecated.");
return -1;
#endif
} else if (sig[1] == DIGSIG_VERSION_2) {
return verify_hash_v2(file, hash, size, sig, siglen);
} else if (sig[1] == DIGSIG_VERSION_3) {
@ -740,6 +747,7 @@ int ima_verify_signature(const char *file, unsigned char *sig, int siglen,
return verify_hash(file, hash, hashlen, sig, siglen);
}
#if CONFIG_SIGV1
/*
* Create binary key representation suitable for kernel
*/
@ -798,6 +806,7 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len
if (imaevm_params.verbose > LOG_INFO)
log_info("keyid-v1: %s\n", str);
}
#endif /* CONFIG_SIGV1 */
/*
* Calculate keyid of the public_key part of EVP_PKEY
@ -986,6 +995,7 @@ err_engine:
return NULL;
}
#if CONFIG_SIGV1
static RSA *read_priv_key(const char *keyfile, const char *keypass)
{
EVP_PKEY *pkey;
@ -1096,6 +1106,7 @@ out:
RSA_free(key);
return len;
}
#endif /* CONFIG_SIGV1 */
/*
* @sig is assumed to be of (MAX_SIGNATURE_SIZE - 1) size
@ -1210,9 +1221,14 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c
if (keypass)
imaevm_params.keypass = keypass;
return imaevm_params.x509 ?
sign_hash_v2(hashalgo, hash, size, keyfile, sig) :
sign_hash_v1(hashalgo, hash, size, keyfile, sig);
if (imaevm_params.x509)
return sign_hash_v2(hashalgo, hash, size, keyfile, sig);
#if CONFIG_SIGV1
else
return sign_hash_v1(hashalgo, hash, size, keyfile, sig);
#endif
log_info("Signature version 1 deprecated.");
return -1;
}
static void libinit()

9
tests/sign_verify.test
View File

@ -17,6 +17,10 @@
cd "$(dirname "$0")" || exit 1
PATH=../src:$PATH
# set the env SIGV1=1 to execute the signature v1 tests
SIGV1=${SIGV1:-0}
source ./functions.sh
_require cmp evmctl getfattr openssl xxd
@ -368,6 +372,10 @@ try_different_sigs() {
## Test v1 signatures
# Signature v1 only supports sha1 and sha256 so any other should fail
if [ $SIGV1 -eq 0 ]; then
__skip() { echo "IMA signature v1 tests are skipped: not supported"; return $SKIP; }
expect_pass __skip
else
expect_fail \
check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa
@ -375,6 +383,7 @@ sign_verify rsa1024 sha1 0x0301 --rsa
sign_verify rsa1024 sha256 0x0301 --rsa
try_different_keys
try_different_sigs
fi
## Test v2 signatures with RSA PKCS#1
# List of allowed hashes much greater but not all are supported.