dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 06:33:36 +02:00
Code Releases Activity

Changed to conform Linux kernel coding style

Browse Source 
Changed to conform Linux kernel coding style, except 80 characters
line length limit.

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
This commit is contained in:
Dmitry Kasatkin 2012-02-01 10:46:21 +02:00
parent e91cb01e9a
commit 7e89de565e
1 changed files with 177 additions and 181 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

358
src/evmctl.c
View File

@ -56,8 +56,8 @@
#define USE_FPRINTF #define USE_FPRINTF
#ifdef USE_FPRINTF #ifdef USE_FPRINTF
#define do_log(level, fmt, args...) if (level <= verbose) fprintf(stderr, fmt, ##args) #define do_log(level, fmt, args...) ({ if (level <= verbose) fprintf(stderr, fmt, ##args); })
#define do_log_dump(level, p, len) if (level <= verbose) do_dump(stderr, p, len) #define do_log_dump(level, p, len) ({ if (level <= verbose) do_dump(stderr, p, len); })
#else #else
#define do_log(level, fmt, args...) syslog(level, fmt, ##args) #define do_log(level, fmt, args...) syslog(level, fmt, ##args)
#define do_log_dump(p, len) #define do_log_dump(p, len)
@ -107,25 +107,23 @@ enum digest_algo {
}; };
struct pubkey_hdr { struct pubkey_hdr {
uint8_t version; /* key format version */ uint8_t version; /* key format version */
time_t timestamp; /* key made, always 0 for now */ time_t timestamp; /* key made, always 0 for now */
uint8_t algo; uint8_t algo;
uint8_t nmpi; uint8_t nmpi;
char mpi[0]; char mpi[0];
} __attribute__ ((packed)); } __attribute__ ((packed));
struct signature_hdr { struct signature_hdr {
uint8_t version; /* signature format version */ uint8_t version; /* signature format version */
time_t timestamp; /* signature made */ time_t timestamp; /* signature made */
uint8_t algo; uint8_t algo;
uint8_t hash; uint8_t hash;
uint8_t keyid[8]; uint8_t keyid[8];
uint8_t nmpi; uint8_t nmpi;
char mpi[0]; char mpi[0];
} __attribute__ ((packed)); } __attribute__ ((packed));
static char *evm_config_xattrnames[] = { static char *evm_config_xattrnames[] = {
"security.selinux", "security.selinux",
"security.SMACK64", "security.SMACK64",
@ -135,35 +133,34 @@ static char *evm_config_xattrnames[] = {
}; };
struct command { struct command {
char *name; char *name;
int (*func)(struct command *cmd); int (*func)(struct command *cmd);
int cmd; int cmd;
char *arg; char *arg;
char *msg; /* extra info message */ char *msg; /* extra info message */
}; };
static int verbose = LOG_INFO - 1; static int verbose = LOG_INFO - 1;
static int g_argc; static int g_argc;
static char **g_argv; static char **g_argv;
static int set_xattr = 1; static int set_xattr = 1;
static int digest = 0; static int digest;
static int digsig = 0; static int digsig;
static char *hash_algo = "sha1"; static char *hash_algo = "sha1";
static int binkey = 0; static int binkey;
static char *keypass; static char *keypass;
extern struct command cmds[]; struct command cmds[];
static void print_usage(struct command *cmd); static void print_usage(struct command *cmd);
static void do_dump(FILE *fp, const void *ptr, int len) static void do_dump(FILE *fp, const void *ptr, int len)
{ {
int i; int i;
uint8_t *data = (uint8_t *)ptr; uint8_t *data = (uint8_t *) ptr;
for (i = 0; i < len; i++) { for (i = 0; i < len; i++)
fprintf(fp, "%02x", data[i]); fprintf(fp, "%02x", data[i]);
} fprintf(fp, "\n");
fprintf(fp, "\n");
} }
static void dump(const void *ptr, int len) static void dump(const void *ptr, int len)
@ -176,7 +173,7 @@ static inline int get_filesize(const char *filename)
struct stat stats; struct stat stats;
/* Need to know the file length */ /* Need to know the file length */
stat(filename, &stats); stat(filename, &stats);
return (int) stats.st_size; return (int)stats.st_size;
} }
static inline int get_fdsize(int fd) static inline int get_fdsize(int fd)
@ -184,7 +181,7 @@ static inline int get_fdsize(int fd)
struct stat stats; struct stat stats;
/* Need to know the file length */ /* Need to know the file length */
fstat(fd, &stats); fstat(fd, &stats);
return (int) stats.st_size; return (int)stats.st_size;
} }
static int bin2file(const char *file, const char *ext, const unsigned char *data, int len) static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)
@ -192,7 +189,7 @@ static int bin2file(const char *file, const char *ext, const unsigned char *data
FILE *fp; FILE *fp;
char name[strlen(file) + (ext ? strlen(ext) : 0) + 2]; char name[strlen(file) + (ext ? strlen(ext) : 0) + 2];
int err; int err;
if (ext) if (ext)
sprintf(name, "%s.%s", file, ext); sprintf(name, "%s.%s", file, ext);
else else
@ -215,7 +212,7 @@ static char *file2bin(const char *file, int *size)
FILE *fp; FILE *fp;
int len; int len;
char *data; char *data;
len = get_filesize(file); len = get_filesize(file);
fp = fopen(file, "r"); fp = fopen(file, "r");
if (!fp) { if (!fp) {
@ -226,9 +223,9 @@ static char *file2bin(const char *file, int *size)
if (!fread(data, len, 1, fp)) if (!fread(data, len, 1, fp))
len = 0; len = 0;
fclose(fp); fclose(fp);
*size = len; *size = len;
return data; return data;
} }
/* /*
@ -244,24 +241,23 @@ static int key2bin(RSA *key, unsigned char *pub)
pkh->timestamp = 0; /* PEM has no timestamp?? */ pkh->timestamp = 0; /* PEM has no timestamp?? */
pkh->algo = PUBKEY_ALGO_RSA; pkh->algo = PUBKEY_ALGO_RSA;
pkh->nmpi = 2; pkh->nmpi = 2;
offset += sizeof(*pkh); offset += sizeof(*pkh);
// MPIs
len = BN_num_bytes(key->n); len = BN_num_bytes(key->n);
b = BN_num_bits(key->n); b = BN_num_bits(key->n);
pub[offset++] = b >> 8; pub[offset++] = b >> 8;
pub[offset++] = b & 0xff; pub[offset++] = b & 0xff;
BN_bn2bin(key->n, &pub[offset]); BN_bn2bin(key->n, &pub[offset]);
offset += len; offset += len;
len = BN_num_bytes(key->e); len = BN_num_bytes(key->e);
b = BN_num_bits(key->e); b = BN_num_bits(key->e);
pub[offset++] = b >> 8; pub[offset++] = b >> 8;
pub[offset++] = b & 0xff; pub[offset++] = b & 0xff;
BN_bn2bin(key->e, &pub[offset]); BN_bn2bin(key->e, &pub[offset]);
offset += len; offset += len;
return offset; return offset;
} }
@ -283,32 +279,31 @@ static int read_key(const char *inkey, unsigned char *pub)
log_errno("PEM_read_RSA_PUBKEY() failed"); log_errno("PEM_read_RSA_PUBKEY() failed");
return -1; return -1;
} }
len = key2bin(key, pub); len = key2bin(key, pub);
RSA_free(key); RSA_free(key);
return len; return len;
} }
static void calc_keyid(uint8_t *keyid, char *str, const unsigned char *pkey, int len) static void calc_keyid(uint8_t *keyid, char *str, const unsigned char *pkey, int len)
{ {
uint8_t sha1[SHA_DIGEST_LENGTH]; uint8_t sha1[SHA_DIGEST_LENGTH];
uint64_t id; uint64_t id;
log_debug("pkey:\n"); log_debug("pkey:\n");
log_debug_dump(pkey, len); log_debug_dump(pkey, len);
SHA1(pkey, len, sha1); SHA1(pkey, len, sha1);
//sha1[12 - 19] is exactly keyid from gpg file /* sha1[12 - 19] is exactly keyid from gpg file */
memcpy(keyid, sha1 + 12, 8); memcpy(keyid, sha1 + 12, 8);
log_debug("keyid:\n"); log_debug("keyid:\n");
log_debug_dump(keyid, 8); log_debug_dump(keyid, 8);
id = __be64_to_cpup((__be64 *)keyid); id = __be64_to_cpup((__be64 *) keyid);
sprintf(str, "%llX", (unsigned long long)id); sprintf(str, "%llX", (unsigned long long)id);
log_info("keyid: %s\n", str); log_info("keyid: %s\n", str);
} }
static int sign_hash(const unsigned char *hash, int size, const char *keyfile, unsigned char *sig) static int sign_hash(const unsigned char *hash, int size, const char *keyfile, unsigned char *sig)
@ -322,11 +317,11 @@ static int sign_hash(const unsigned char *hash, int size, const char *keyfile, u
unsigned char sighash[20]; unsigned char sighash[20];
struct signature_hdr *hdr = (struct signature_hdr *)sig; struct signature_hdr *hdr = (struct signature_hdr *)sig;
uint16_t *blen; uint16_t *blen;
log_info("hash: "); log_info("hash: ");
log_dump(hash, size); log_dump(hash, size);
fp = fopen(keyfile, "r"); fp = fopen(keyfile, "r");
if (!fp) { if (!fp) {
log_errno("Unable to open keyfile %s", keyfile); log_errno("Unable to open keyfile %s", keyfile);
return -1; return -1;
@ -343,12 +338,12 @@ static int sign_hash(const unsigned char *hash, int size, const char *keyfile, u
time(&hdr->timestamp); time(&hdr->timestamp);
hdr->algo = PUBKEY_ALGO_RSA; hdr->algo = PUBKEY_ALGO_RSA;
hdr->hash = DIGEST_ALGO_SHA1; hdr->hash = DIGEST_ALGO_SHA1;
len = key2bin(key, pub); len = key2bin(key, pub);
calc_keyid(hdr->keyid, name, pub, len); calc_keyid(hdr->keyid, name, pub, len);
hdr->nmpi = 1; hdr->nmpi = 1;
SHA1_Init(&ctx); SHA1_Init(&ctx);
SHA1_Update(&ctx, hash, size); SHA1_Update(&ctx, hash, size);
SHA1_Update(&ctx, hdr, sizeof(*hdr)); SHA1_Update(&ctx, hdr, sizeof(*hdr));
@ -364,16 +359,16 @@ static int sign_hash(const unsigned char *hash, int size, const char *keyfile, u
} }
len = err; len = err;
/* we add bit length of the signature to make it gnupg compatible */ /* we add bit length of the signature to make it gnupg compatible */
blen = (uint16_t *)(sig + sizeof(*hdr)); blen = (uint16_t *) (sig + sizeof(*hdr));
*blen = __cpu_to_be16(len << 3); *blen = __cpu_to_be16(len << 3);
len += sizeof(*hdr) + 2; len += sizeof(*hdr) + 2;
log_info("evm/ima signature: %d bytes\n", len); log_info("evm/ima signature: %d bytes\n", len);
if (!set_xattr || verbose >= LOG_INFO) if (!set_xattr || verbose >= LOG_INFO)
dump(sig, len); dump(sig, len);
return len; return len;
} }
static int calc_evm_hash(const char *file, const char *keyfile, unsigned char *hash) static int calc_evm_hash(const char *file, const char *keyfile, unsigned char *hash)
@ -386,25 +381,25 @@ static int calc_evm_hash(const char *file, const char *keyfile, unsigned char *h
unsigned int mdlen; unsigned int mdlen;
char **xattrname; char **xattrname;
char xattr_value[1024]; char xattr_value[1024];
fd = open(file, 0); fd = open(file, 0);
if (fd < 0) { if (fd < 0) {
log_errno("Unable to open %s", file); log_errno("Unable to open %s", file);
return -1; return -1;
} }
if (fstat(fd, &st)) { if (fstat(fd, &st)) {
log_errno("fstat() failed"); log_errno("fstat() failed");
return -1; return -1;
} }
if (ioctl(fd, EXT34_IOC_GETVERSION, &generation)) { if (ioctl(fd, EXT34_IOC_GETVERSION, &generation)) {
log_errno("ioctl() failed"); log_errno("ioctl() failed");
return -1; return -1;
} }
close(fd); close(fd);
log_info("generation: %u\n", generation); log_info("generation: %u\n", generation);
md = EVP_get_digestbyname("sha1"); md = EVP_get_digestbyname("sha1");
@ -425,7 +420,7 @@ static int calc_evm_hash(const char *file, const char *keyfile, unsigned char *h
log_info("no attr: %s\n", *xattrname); log_info("no attr: %s\n", *xattrname);
continue; continue;
} }
//log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err); /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
log_info("name: %s, size: %d\n", *xattrname, err); log_info("name: %s, size: %d\n", *xattrname, err);
log_debug_dump(xattr_value, err); log_debug_dump(xattr_value, err);
err = EVP_DigestUpdate(&ctx, xattr_value, err); err = EVP_DigestUpdate(&ctx, xattr_value, err);
@ -441,8 +436,8 @@ static int calc_evm_hash(const char *file, const char *keyfile, unsigned char *h
hmac_misc.uid = st.st_uid; hmac_misc.uid = st.st_uid;
hmac_misc.gid = st.st_gid; hmac_misc.gid = st.st_gid;
hmac_misc.mode = st.st_mode; hmac_misc.mode = st.st_mode;
err = EVP_DigestUpdate(&ctx, (const unsigned char*)&hmac_misc, sizeof(hmac_misc)); err = EVP_DigestUpdate(&ctx, (const unsigned char *)&hmac_misc, sizeof(hmac_misc));
if (!err) { if (!err) {
log_errno("EVP_DigestUpdate() failed"); log_errno("EVP_DigestUpdate() failed");
return -1; return -1;
@ -452,7 +447,7 @@ static int calc_evm_hash(const char *file, const char *keyfile, unsigned char *h
log_errno("EVP_DigestFinal() failed"); log_errno("EVP_DigestFinal() failed");
return -1; return -1;
} }
return 0; return 0;
} }
@ -463,11 +458,11 @@ static int sign_evm(const char *file, const char *key)
int err; int err;
calc_evm_hash(file, key, hash); calc_evm_hash(file, key, hash);
err = sign_hash(hash, sizeof(hash), key, sig + 1); err = sign_hash(hash, sizeof(hash), key, sig + 1);
if (err < 0) if (err < 0)
return err; return err;
if (set_xattr) { if (set_xattr) {
err = setxattr(file, "security.evm", sig, err + 1, 0); err = setxattr(file, "security.evm", sig, err + 1, 0);
if (err < 0) { if (err < 0) {
@ -475,7 +470,7 @@ static int sign_evm(const char *file, const char *key)
return err; return err;
} }
} }
return 0; return 0;
} }
@ -483,7 +478,7 @@ static int calc_file_hash(const char *file, uint8_t *hash)
{ {
EVP_MD_CTX ctx; EVP_MD_CTX ctx;
const EVP_MD *md; const EVP_MD *md;
uint8_t *data; uint8_t *data;
int err, size, bs = DATA_SIZE; int err, size, bs = DATA_SIZE;
size_t len; size_t len;
unsigned int mdlen; unsigned int mdlen;
@ -494,13 +489,13 @@ static int calc_file_hash(const char *file, uint8_t *hash)
log_errno("malloc failed"); log_errno("malloc failed");
return -1; return -1;
} }
fp = fopen(file, "r"); fp = fopen(file, "r");
if (!fp) { if (!fp) {
log_errno("Unable to open %s", file); log_errno("Unable to open %s", file);
return -1; return -1;
} }
md = EVP_get_digestbyname(hash_algo); md = EVP_get_digestbyname(hash_algo);
if (!md) { if (!md) {
log_errno("EVP_get_digestbyname() failed"); log_errno("EVP_get_digestbyname() failed");
@ -537,9 +532,9 @@ static int calc_file_hash(const char *file, uint8_t *hash)
} }
fclose(fp); fclose(fp);
free(data); free(data);
return mdlen; return mdlen;
} }
@ -564,7 +559,7 @@ static int calc_dir_hash(const char *file, uint8_t *hash)
log_errno("Unable to open %s", file); log_errno("Unable to open %s", file);
return -1; return -1;
} }
md = EVP_get_digestbyname(hash_algo); md = EVP_get_digestbyname(hash_algo);
if (!md) { if (!md) {
log_errno("EVP_get_digestbyname() failed"); log_errno("EVP_get_digestbyname() failed");
@ -578,7 +573,7 @@ static int calc_dir_hash(const char *file, uint8_t *hash)
} }
while ((de = readdir(dir))) { while ((de = readdir(dir))) {
//printf("entry: ino: %lu, %s\n", de->d_ino, de->d_name); /*log_debug("entry: ino: %lu, %s\n", de->d_ino, de->d_name);*/
for (prev = NULL, pos = head; pos; prev = pos, pos = pos->next) { for (prev = NULL, pos = head; pos; prev = pos, pos = pos->next) {
if (de->d_ino < pos->de.d_ino) if (de->d_ino < pos->de.d_ino)
break; break;
@ -591,7 +586,7 @@ static int calc_dir_hash(const char *file, uint8_t *hash)
else else
prev->next = cur; prev->next = cur;
} }
for (cur = head; cur; cur = pos) { for (cur = head; cur; cur = pos) {
pos = cur->next; pos = cur->next;
ino = cur->de.d_ino; ino = cur->de.d_ino;
@ -608,7 +603,7 @@ static int calc_dir_hash(const char *file, uint8_t *hash)
} }
free(cur); free(cur);
} }
err = EVP_DigestFinal(&ctx, hash, &mdlen); err = EVP_DigestFinal(&ctx, hash, &mdlen);
if (!err) { if (!err) {
log_errno("EVP_DigestFinal() failed"); log_errno("EVP_DigestFinal() failed");
@ -616,13 +611,13 @@ static int calc_dir_hash(const char *file, uint8_t *hash)
} }
closedir(dir); closedir(dir);
return mdlen; return mdlen;
} }
static int hash_ima(const char *file) static int hash_ima(const char *file)
{ {
unsigned char hash[65] = "\x01";// MAX hash size + 1 unsigned char hash[65] = "\x01"; /* MAX hash size + 1 */
int err; int err;
struct stat st; struct stat st;
@ -639,7 +634,7 @@ static int hash_ima(const char *file)
err = calc_file_hash(file, hash + 1); err = calc_file_hash(file, hash + 1);
if (err < 0) if (err < 0)
return err; return err;
if (verbose >= LOG_INFO) if (verbose >= LOG_INFO)
log_info("hash: "); log_info("hash: ");
@ -653,7 +648,7 @@ static int hash_ima(const char *file)
return err; return err;
} }
} }
return 0; return 0;
} }
@ -666,7 +661,7 @@ static int cmd_hash_ima(struct command *cmd)
print_usage(cmd); print_usage(cmd);
return 1; return 1;
} }
return hash_ima(file); return hash_ima(file);
} }
@ -675,15 +670,15 @@ static int sign_ima(const char *file, const char *key)
unsigned char hash[64]; unsigned char hash[64];
unsigned char sig[1024] = "\x03"; unsigned char sig[1024] = "\x03";
int err; int err;
err = calc_file_hash(file, hash); err = calc_file_hash(file, hash);
if (err < 0) if (err < 0)
return err; return err;
err = sign_hash(hash, err, key, sig + 1); err = sign_hash(hash, err, key, sig + 1);
if (err < 0) if (err < 0)
return err; return err;
if (set_xattr) { if (set_xattr) {
err = setxattr(file, "security.ima", sig, err + 1, 0); err = setxattr(file, "security.ima", sig, err + 1, 0);
if (err < 0) { if (err < 0) {
@ -691,55 +686,55 @@ static int sign_ima(const char *file, const char *key)
return err; return err;
} }
} }
return 0; return 0;
} }
static int cmd_sign_ima(struct command *cmd) static int cmd_sign_ima(struct command *cmd)
{ {
char *key, *file = g_argv[optind++]; char *key, *file = g_argv[optind++];
if (!file) { if (!file) {
log_err("Parameters missing\n"); log_err("Parameters missing\n");
print_usage(cmd); print_usage(cmd);
return 1; return 1;
} }
key = g_argv[optind++]; key = g_argv[optind++];
if (!key) if (!key)
key = "/etc/keys/privkey_evm.pem"; key = "/etc/keys/privkey_evm.pem";
return sign_ima(file, key); return sign_ima(file, key);
} }
static int cmd_sign_evm(struct command *cmd) static int cmd_sign_evm(struct command *cmd)
{ {
char *key, *file = g_argv[optind++]; char *key, *file = g_argv[optind++];
int err; int err;
if (!file) { if (!file) {
log_err("Parameters missing\n"); log_err("Parameters missing\n");
print_usage(cmd); print_usage(cmd);
return 1; return 1;
} }
key = g_argv[optind++]; key = g_argv[optind++];
if (!key) if (!key)
key = "/etc/keys/privkey_evm.pem"; key = "/etc/keys/privkey_evm.pem";
if (digsig) { if (digsig) {
err = sign_ima(file, key); err = sign_ima(file, key);
if (err) if (err)
return err; return err;
} }
if (digest) { if (digest) {
err = hash_ima(file); err = hash_ima(file);
if (err) if (err)
return err; return err;
} }
return sign_evm(file, key); return sign_evm(file, key);
} }
@ -752,11 +747,11 @@ static int verify_hash(const unsigned char *hash, int size, unsigned char *sig,
FILE *fp; FILE *fp;
unsigned char sighash[20]; unsigned char sighash[20];
struct signature_hdr *hdr = (struct signature_hdr *)sig; struct signature_hdr *hdr = (struct signature_hdr *)sig;
log_info("hash: "); log_info("hash: ");
log_dump(hash, size); log_dump(hash, size);
fp = fopen(keyfile, "r"); fp = fopen(keyfile, "r");
if (!fp) { if (!fp) {
log_errno("Unable to open keyfile %s", keyfile); log_errno("Unable to open keyfile %s", keyfile);
return -1; return -1;
@ -783,15 +778,15 @@ static int verify_hash(const unsigned char *hash, int size, unsigned char *sig,
} }
len = err; len = err;
if (len != sizeof(sighash) || memcmp(out, sighash, len) != 0) { if (len != sizeof(sighash) || memcmp(out, sighash, len) != 0) {
log_errno("Verification failed: %d", err); log_errno("Verification failed: %d", err);
return -1; return -1;
} else { } else {
//log_info("Verification is OK\n"); /*log_info("Verification is OK\n");*/
printf("Verification is OK\n"); printf("Verification is OK\n");
} }
return 0; return 0;
} }
@ -802,35 +797,35 @@ static int verify_evm(const char *file, const char *key)
int err; int err;
calc_evm_hash(file, key, hash); calc_evm_hash(file, key, hash);
err = getxattr(file, "security.evm", sig, sizeof(sig)); err = getxattr(file, "security.evm", sig, sizeof(sig));
if (err < 0) { if (err < 0) {
log_errno("getxattr failed"); log_errno("getxattr failed");
return err; return err;
} }
if (sig[0] != 0x03) { if (sig[0] != 0x03) {
log_errno("security.evm has not signature"); log_errno("security.evm has not signature");
return err; return err;
} }
return verify_hash(hash, sizeof(hash), sig + 1, err - 1, key); return verify_hash(hash, sizeof(hash), sig + 1, err - 1, key);
} }
static int cmd_verify_evm(struct command *cmd) static int cmd_verify_evm(struct command *cmd)
{ {
char *key, *file = g_argv[optind++]; char *key, *file = g_argv[optind++];
if (!file) { if (!file) {
log_err("Parameters missing\n"); log_err("Parameters missing\n");
print_usage(cmd); print_usage(cmd);
return 1; return 1;
} }
key = g_argv[optind++]; key = g_argv[optind++];
if (!key) if (!key)
key = "/etc/keys/pubkey_evm.pem"; key = "/etc/keys/pubkey_evm.pem";
return verify_evm(file, key); return verify_evm(file, key);
} }
@ -841,24 +836,24 @@ static int cmd_convert(struct command *cmd)
char name[20]; char name[20];
int len; int len;
uint8_t keyid[8]; uint8_t keyid[8];
inkey = g_argv[optind++]; inkey = g_argv[optind++];
if (!inkey) if (!inkey)
inkey = "/etc/keys/pubkey_evm.pem"; inkey = "/etc/keys/pubkey_evm.pem";
else else
outkey = g_argv[optind++]; outkey = g_argv[optind++];
if (!outkey) if (!outkey)
outkey = "pubkey_evm.bin"; outkey = "pubkey_evm.bin";
log_info("Convert public key %s to %s\n", inkey, outkey); log_info("Convert public key %s to %s\n", inkey, outkey);
len = read_key(inkey, pub); len = read_key(inkey, pub);
if (len < 0) if (len < 0)
return -1; return -1;
calc_keyid(keyid, name, pub, len); calc_keyid(keyid, name, pub, len);
bin2file(outkey, name, pub, len); bin2file(outkey, name, pub, len);
return 0; return 0;
@ -871,26 +866,26 @@ static int cmd_import_bin(struct command *cmd)
char *key, name[20]; char *key, name[20];
key_serial_t id; key_serial_t id;
uint8_t keyid[8]; uint8_t keyid[8];
inkey = g_argv[optind++]; inkey = g_argv[optind++];
if (!inkey) if (!inkey)
inkey = "/etc/keys/pubkey_evm.bin"; inkey = "/etc/keys/pubkey_evm.bin";
else else
ring = g_argv[optind++]; ring = g_argv[optind++];
if (!ring) if (!ring)
id = KEY_SPEC_USER_KEYRING; id = KEY_SPEC_USER_KEYRING;
else else
id = atoi(ring); id = atoi(ring);
key = file2bin(inkey, &len); key = file2bin(inkey, &len);
if (!key) if (!key)
return -1; return -1;
calc_keyid(keyid, name, (unsigned char *)key, len); calc_keyid(keyid, name, (unsigned char *)key, len);
log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id);
id = add_key("user", name, key, len, id); id = add_key("user", name, key, len, id);
if (id < 0) { if (id < 0) {
log_errno("add_key failed"); log_errno("add_key failed");
@ -899,9 +894,9 @@ static int cmd_import_bin(struct command *cmd)
log_info("keyid: %d\n", id); log_info("keyid: %d\n", id);
printf("%d\n", id); printf("%d\n", id);
free(key); free(key);
return 0; return 0;
} }
@ -915,26 +910,26 @@ static int cmd_import(struct command *cmd)
if (binkey) if (binkey)
return cmd_import_bin(cmd); return cmd_import_bin(cmd);
inkey = g_argv[optind++]; inkey = g_argv[optind++];
if (!inkey) if (!inkey)
inkey = "/etc/keys/pubkey_evm.pem"; inkey = "/etc/keys/pubkey_evm.pem";
else else
ring = g_argv[optind++]; ring = g_argv[optind++];
if (!ring) if (!ring)
id = KEY_SPEC_USER_KEYRING; id = KEY_SPEC_USER_KEYRING;
else else
id = atoi(ring); id = atoi(ring);
len = read_key(inkey, key); len = read_key(inkey, key);
if (len < 0) if (len < 0)
return -1; return -1;
calc_keyid(keyid, name, key, len); calc_keyid(keyid, name, key, len);
log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id); log_info("Importing public key %s from file %s into keyring %d\n", name, inkey, id);
id = add_key("user", name, key, len, id); id = add_key("user", name, key, len, id);
if (id < 0) { if (id < 0) {
log_errno("add_key failed"); log_errno("add_key failed");
@ -943,7 +938,7 @@ static int cmd_import(struct command *cmd)
log_info("keyid: %d\n", id); log_info("keyid: %d\n", id);
printf("%d\n", id); printf("%d\n", id);
return 0; return 0;
} }
@ -961,13 +956,13 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
char *key; char *key;
int keylen; int keylen;
unsigned char evmkey[MAX_KEY_SIZE]; unsigned char evmkey[MAX_KEY_SIZE];
key = file2bin(keyfile, &keylen); key = file2bin(keyfile, &keylen);
if (!key) { if (!key) {
log_errno("Unable to read a key: %s\n", keyfile); log_errno("Unable to read a key: %s\n", keyfile);
return -1; return -1;
} }
if (keylen > sizeof(evmkey)) { if (keylen > sizeof(evmkey)) {
log_errno("key is too long\n"); log_errno("key is too long\n");
return -1; return -1;
@ -976,25 +971,25 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
/* EVM key is 128 bytes */ /* EVM key is 128 bytes */
memcpy(evmkey, key, keylen); memcpy(evmkey, key, keylen);
memset(evmkey + keylen, 0, sizeof(evmkey) - keylen); memset(evmkey + keylen, 0, sizeof(evmkey) - keylen);
fd = open(file, 0); fd = open(file, 0);
if (fd < 0) { if (fd < 0) {
log_errno("Unable to open %s", file); log_errno("Unable to open %s", file);
return -1; return -1;
} }
if (fstat(fd, &st)) { if (fstat(fd, &st)) {
log_errno("fstat() failed"); log_errno("fstat() failed");
return -1; return -1;
} }
if (ioctl(fd, EXT34_IOC_GETVERSION, &generation)) { if (ioctl(fd, EXT34_IOC_GETVERSION, &generation)) {
log_errno("ioctl() failed"); log_errno("ioctl() failed");
return -1; return -1;
} }
close(fd); close(fd);
log_info("generation: %u\n", generation); log_info("generation: %u\n", generation);
HMAC_Init(&ctx, evmkey, sizeof(evmkey), EVP_sha1()); HMAC_Init(&ctx, evmkey, sizeof(evmkey), EVP_sha1());
@ -1005,7 +1000,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
log_info("no attr: %s\n", *xattrname); log_info("no attr: %s\n", *xattrname);
continue; continue;
} }
//log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err); /*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
log_info("name: %s, size: %d\n", *xattrname, err); log_info("name: %s, size: %d\n", *xattrname, err);
log_debug_dump(xattr_value, err); log_debug_dump(xattr_value, err);
HMAC_Update(&ctx, xattr_value, err); HMAC_Update(&ctx, xattr_value, err);
@ -1017,11 +1012,11 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
hmac_misc.uid = st.st_uid; hmac_misc.uid = st.st_uid;
hmac_misc.gid = st.st_gid; hmac_misc.gid = st.st_gid;
hmac_misc.mode = st.st_mode; hmac_misc.mode = st.st_mode;
HMAC_Update(&ctx, (const unsigned char*)&hmac_misc, sizeof(hmac_misc)); HMAC_Update(&ctx, (const unsigned char *)&hmac_misc, sizeof(hmac_misc));
HMAC_Final(&ctx, hash, &mdlen); HMAC_Final(&ctx, hash, &mdlen);
HMAC_CTX_cleanup(&ctx); HMAC_CTX_cleanup(&ctx);
free(key); free(key);
return 0; return 0;
@ -1034,12 +1029,12 @@ static int hmac_evm(const char *file, const char *key)
int err; int err;
calc_evm_hmac(file, key, hash); calc_evm_hmac(file, key, hash);
log_info("hmac: "); log_info("hmac: ");
log_dump(hash, sizeof(hash)); log_dump(hash, sizeof(hash));
memcpy(sig + 1, hash, sizeof(hash)); memcpy(sig + 1, hash, sizeof(hash));
err = sizeof(hash); err = sizeof(hash);
if (set_xattr) { if (set_xattr) {
err = setxattr(file, "security.evm", sig, err + 1, 0); err = setxattr(file, "security.evm", sig, err + 1, 0);
if (err < 0) { if (err < 0) {
@ -1047,7 +1042,7 @@ static int hmac_evm(const char *file, const char *key)
return err; return err;
} }
} }
return 0; return 0;
} }
@ -1055,29 +1050,29 @@ static int cmd_hmac_evm(struct command *cmd)
{ {
char *key, *file = g_argv[optind++]; char *key, *file = g_argv[optind++];
int err; int err;
if (!file) { if (!file) {
log_err("Parameters missing\n"); log_err("Parameters missing\n");
print_usage(cmd); print_usage(cmd);
return 1; return 1;
} }
key = g_argv[optind++]; key = g_argv[optind++];
if (!key) if (!key)
key = "/etc/keys/privkey_evm.pem"; key = "/etc/keys/privkey_evm.pem";
if (digsig) { if (digsig) {
err = sign_ima(file, key); err = sign_ima(file, key);
if (err) if (err)
return err; return err;
} }
if (digest) { if (digest) {
err = hash_ima(file); err = hash_ima(file);
if (err) if (err)
return err; return err;
} }
return hmac_evm(file, "/etc/keys/evm-key-plain"); return hmac_evm(file, "/etc/keys/evm-key-plain");
} }
@ -1097,7 +1092,7 @@ static void print_full_usage(struct command *cmd)
static int print_command_usage(struct command *cmds, char *command) static int print_command_usage(struct command *cmds, char *command)
{ {
struct command *cmd; struct command *cmd;
for (cmd = cmds; cmd->name; cmd++) { for (cmd = cmds; cmd->name; cmd++) {
if (strcmp(cmd->name, command) == 0) { if (strcmp(cmd->name, command) == 0) {
@ -1106,13 +1101,13 @@ static int print_command_usage(struct command *cmds, char *command)
} }
} }
printf("invalid command: %s\n", command); printf("invalid command: %s\n", command);
return 1; return 1;
} }
static void print_all_usage(struct command *cmds) static void print_all_usage(struct command *cmds)
{ {
struct command *cmd; struct command *cmd;
for (cmd = cmds; cmd->name; cmd++) { for (cmd = cmds; cmd->name; cmd++) {
if (cmd->arg) if (cmd->arg)
printf("%s %s\n", cmd->name, cmd->arg); printf("%s %s\n", cmd->name, cmd->arg);
@ -1123,8 +1118,8 @@ static void print_all_usage(struct command *cmds)
static int call_command(struct command *cmds, char *command) static int call_command(struct command *cmds, char *command)
{ {
struct command *cmd; struct command *cmd;
for (cmd = cmds; cmd->name; cmd++) { for (cmd = cmds; cmd->name; cmd++) {
if (strcasecmp(cmd->name, command) == 0) if (strcasecmp(cmd->name, command) == 0)
return cmd->func(cmd); return cmd->func(cmd);
@ -1151,17 +1146,17 @@ static void usage(void)
struct command cmds[] = { struct command cmds[] = {
{"help", cmd_help, 0, "<command>"}, {"help", cmd_help, 0, "<command>"},
{"import", cmd_import, 0, "[--bin] inkey keyring", "Import public key (PEM/bin) into the keyring.\n" }, {"import", cmd_import, 0, "[--bin] inkey keyring", "Import public key (PEM/bin) into the keyring.\n"},
{"convert", cmd_convert, 0, "inkey outkey", "Convert PEM public key into IMA/EVM kernel friendly format.\n" }, {"convert", cmd_convert, 0, "inkey outkey", "Convert PEM public key into IMA/EVM kernel friendly format.\n"},
{"sign", cmd_sign_evm, 0, "[--imahash | --imasig ] file [key]", "Sign file metadata.\n" }, {"sign", cmd_sign_evm, 0, "[--imahash | --imasig ] file [key]", "Sign file metadata.\n"},
{"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n" }, {"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"},
{"ima_sign", cmd_sign_ima, 0, "file [key]", "Sign file content.\n" }, {"ima_sign", cmd_sign_ima, 0, "file [key]", "Sign file content.\n"},
{"ima_hash", cmd_hash_ima, 0, "file", "Hash file content.\n" }, {"ima_hash", cmd_hash_ima, 0, "file", "Hash file content.\n"},
{"hmac", cmd_hmac_evm, 0, "[--imahash | --imasig ] file [key]", "Sign file metadata with HMAC (for debugging).\n" }, {"hmac", cmd_hmac_evm, 0, "[--imahash | --imasig ] file [key]", "Sign file metadata with HMAC (for debugging).\n"},
{0, 0, 0, NULL} {0, 0, 0, NULL}
}; };
static struct option opts[] = { static struct option opts[] = {
{"help", 0, 0, 'h'}, {"help", 0, 0, 'h'},
{"inkey", 1, 0, 'k'}, {"inkey", 1, 0, 'k'},
{"imasig", 0, 0, 's'}, {"imasig", 0, 0, 's'},
@ -1184,7 +1179,7 @@ int main(int argc, char *argv[])
c = getopt_long(argc, argv, "hk:vnsda:bp:", opts, &lind); c = getopt_long(argc, argv, "hk:vnsda:bp:", opts, &lind);
if (c == -1) if (c == -1)
break; break;
switch (c) { switch (c) {
case 'h': case 'h':
usage(); usage();
@ -1203,7 +1198,8 @@ int main(int argc, char *argv[])
digsig = 1; digsig = 1;
break; break;
case 'n': case 'n':
set_xattr = 0; // do not set Extended Attributes... just print signature /* do not set Extended Attributes... just print signature */
set_xattr = 0;
break; break;
case 'a': case 'a':
hash_algo = optarg; hash_algo = optarg;