dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-09-16 08:55:22 +02:00
Code Releases Activity

ima-evm-utils: Extract digest algorithms from hash_info.h

Browse Source 
If configured with "--with-kernel-headers=PATH" try to extract hash
algorithms from "hash_info.h" from the kernel source tree or
kernel-headers package located in the specified path. (Otherwise, it
will be tried to get from the installed kernel.)

This also introduces two algorithm lists, one is built-in and another is
from the kernel source. (They should never contain conflicting algorithm
IDs by their append-only nature.) If the digest is not found in the
built-in list it will be searched in the list from kernel's
"hash_info.h".

This patch will allow evmctl to be just recompiled to work with digest
algorithms introduced in the newer kernels.

Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Vitaly Chikunov
2019-03-23 04:41:51 +03:00
committed by Mimi Zohar
parent 07d799cb6c
commit b628d8bfdb
4 changed files with 83 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/libimaevm.c
View File

@@ -50,6 +50,7 @@
#include <string.h>
#include <stdio.h>
#include <assert.h>
#include <ctype.h>
#include <openssl/crypto.h>
#include <openssl/pem.h>
@@ -58,6 +59,7 @@
#include <openssl/err.h>
#include "imaevm.h"
#include "hash_info.h"
const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
[PKEY_HASH_MD4] = "md4",
@@ -153,6 +155,17 @@ void dump(const void *ptr, int len)
do_dump(stdout, ptr, len, true);
}
const char *get_hash_algo_by_id(int algo)
{
if (algo < PKEY_HASH__LAST)
return pkey_hash_algo[algo];
if (algo < HASH_ALGO__LAST)
return hash_algo_name[algo];
log_err("digest %d not found\n", algo);
return "unknown";
}
int get_filesize(const char *filename)
{
struct stat stats;
@@ -532,11 +545,19 @@ int get_hash_algo(const char *algo)
{
int i;
/* first iterate over builtin algorithms */
for (i = 0; i < PKEY_HASH__LAST; i++)
if (pkey_hash_algo[i] &&
!strcmp(algo, pkey_hash_algo[i]))
return i;
/* iterate over algorithms provided by kernel-headers */
for (i = 0; i < HASH_ALGO__LAST; i++)
if (hash_algo_name[i] &&
!strcmp(algo, hash_algo_name[i]))
return i;
log_info("digest %s not found, fall back to sha1\n", algo);
return PKEY_HASH_SHA1;
}
@@ -611,7 +632,7 @@ int ima_verify_signature(const char *file, unsigned char *sig, int siglen,
return -1;
}
/* Use hash algorithm as retrieved from signature */
params.hash_algo = pkey_hash_algo[sig_hash_algo];
params.hash_algo = get_hash_algo_by_id(sig_hash_algo);
/*
* Validate the signature based on the digest included in the