dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 14:43:37 +02:00
Code Releases Activity

Let user specified hash algo take precedence

Browse Source 
After applying previous patch, we will always get hash algo info from
signature and if user specified one on command line, that will be overridden.

This is like breaking old behavior. So keep track whether user specified
hash algo on command line or not. If user did not specify one then get
hash algo info from signature otherwise use the one user provided.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
This commit is contained in:
Vivek Goyal 2013-07-12 14:52:09 -04:00 committed by Dmitry Kasatkin
parent fa3c365cce
commit b49e2251a0
1 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/evmctl.c
View File

@ -245,6 +245,7 @@ static int sigdump;
static int digest; static int digest;
static int digsig; static int digsig;
static const char *hash_algo = "sha1"; static const char *hash_algo = "sha1";
static int user_hash_algo;
static char *keypass; static char *keypass;
static int sigfile; static int sigfile;
static int modsig; static int modsig;
@ -1228,7 +1229,7 @@ static int cmd_verify_evm(struct command *cmd)
return verify_evm(file, key); return verify_evm(file, key);
} }
static uint8_t get_hash_algo_from_sig(unsigned char *sig) static int get_hash_algo_from_sig(unsigned char *sig)
{ {
uint8_t hashalgo; uint8_t hashalgo;
@ -1283,6 +1284,8 @@ static int verify_ima(const char *file, const char *key)
return -1; return -1;
} }
/* If user specified an hash algo on command line, let it override */
if (!user_hash_algo) {
sig_hash_algo = get_hash_algo_from_sig(sig + 1); sig_hash_algo = get_hash_algo_from_sig(sig + 1);
if (sig_hash_algo < 0) { if (sig_hash_algo < 0) {
log_err("Invalid signature\n"); log_err("Invalid signature\n");
@ -1291,6 +1294,7 @@ static int verify_ima(const char *file, const char *key)
/* Use hash algorithm as retrieved from signature */ /* Use hash algorithm as retrieved from signature */
hash_algo = pkey_hash_algo[sig_hash_algo]; hash_algo = pkey_hash_algo[sig_hash_algo];
}
hashlen = calc_hash(file, hash); hashlen = calc_hash(file, hash);
if (hashlen <= 1) if (hashlen <= 1)
@ -1688,6 +1692,7 @@ int main(int argc, char *argv[])
break; break;
case 'a': case 'a':
hash_algo = optarg; hash_algo = optarg;
user_hash_algo = 1;
break; break;
case 'p': case 'p':
keypass = optarg; keypass = optarg;