dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-06-30 21:02:33 +02:00
Code Releases Activity

Disable use of OpenSSL "engine" support

Browse Source 
OpenSSL v3 "engine" support is deprecated and replaced with "providers".
Engine support will continue to work for a while, but results in
deprecated declaration and other messages.  One option is simply to hide
them ("-Wno-deprecated-declarations").  The other alternative is to
conditionally build ima-evm-utils without OpenSSL engine support and
without disabling deprecated declarations.

Based on "--disable-engine" or "--enable-engine=no" configuration
option, disable OpenSSL "engine" support.

As suggested by Vitaly,
- verify ENGINE_init symbol is defined in libcrypto
- disable engine support if either OPENSSL_NO_DYNAMIC_ENGINE or
OPENSSL_NO_ENGINE variables are defined

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar
2022-08-11 07:33:54 -04:00
parent a7b5bdbf36
commit c1635add22
5 changed files with 42 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/evmctl.c
View File

@ -65,7 +65,9 @@
#include <openssl/hmac.h>
#include <openssl/err.h>
#include <openssl/rsa.h>
#if CONFIG_IMA_EVM_ENGINE
#include <openssl/engine.h>
#endif
#include <openssl/x509v3.h>
#include "hash_info.h"
#include "pcr.h"
@ -2710,7 +2712,9 @@ static void usage(void)
" --selinux use custom Selinux label for EVM\n"
" --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n"
" --verify-sig verify measurement list signatures\n"
" --engine e preload OpenSSL engine e (such as: gost)\n"
#if CONFIG_IMA_EVM_ENGINE
" --engine e preload OpenSSL engine e (such as: gost) is deprecated\n"
#endif
" --ignore-violations ignore ToMToU measurement violations\n"
" -v increase verbosity level\n"
" -h, --help display this help and exit\n"
@ -2772,7 +2776,9 @@ static struct option opts[] = {
{"selinux", 1, 0, 136},
{"caps", 2, 0, 137},
{"verify-sig", 0, 0, 138},
#if CONFIG_IMA_EVM_ENGINE
{"engine", 1, 0, 139},
#endif
{"xattr-user", 0, 0, 140},
{"ignore-violations", 0, 0, 141},
{"pcrs", 1, 0, 142},
@ -2825,9 +2831,11 @@ static char *get_password(void)
return password;
}
#if CONFIG_IMA_EVM_ENGINE
static ENGINE *setup_engine(const char *engine_id)
{
ENGINE *eng = ENGINE_by_id(engine_id);
if (!eng) {
log_err("engine %s isn't available\n", optarg);
ERR_print_errors_fp(stderr);
@ -2841,6 +2849,7 @@ static ENGINE *setup_engine(const char *engine_id)
ENGINE_set_default(eng, ENGINE_METHOD_ALL);
return eng;
}
#endif
int main(int argc, char *argv[])
{
@ -2966,11 +2975,13 @@ int main(int argc, char *argv[])
case 138:
verify_list_sig = 1;
break;
#if CONFIG_IMA_EVM_ENGINE
case 139: /* --engine e */
imaevm_params.eng = setup_engine(optarg);
if (!imaevm_params.eng)
goto error;
break;
#endif
case 140: /* --xattr-user */
xattr_ima = "user.ima";
xattr_evm = "user.evm";
@ -3029,7 +3040,9 @@ int main(int argc, char *argv[])
if (imaevm_params.keyfile != NULL &&
imaevm_params.eng == NULL &&
!strncmp(imaevm_params.keyfile, "pkcs11:", 7)) {
#if CONFIG_IMA_EVM_ENGINE
imaevm_params.eng = setup_engine("pkcs11");
#endif
if (!imaevm_params.eng)
goto error;
}
@ -3055,6 +3068,7 @@ int main(int argc, char *argv[])
}
error:
#if CONFIG_IMA_EVM_ENGINE
if (imaevm_params.eng) {
ENGINE_finish(imaevm_params.eng);
ENGINE_free(imaevm_params.eng);
@ -3062,6 +3076,7 @@ error:
ENGINE_cleanup();
#endif
}
#endif
ERR_free_strings();
EVP_cleanup();
BIO_free(NULL);