ima-evm-utils: Release version 1.2.1

This release contains a few bug fixes:
autoconf, keys for v1 signature verification, return code error, and
openssl version.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

configure.ac

@@ -1,7 +1,7 @@
 # autoconf script
 
 AC_PREREQ([2.65])
-AC_INIT(ima-evm-utils, 1.2, zohar@linux.ibm.com)
+AC_INIT(ima-evm-utils, 1.2.1, zohar@linux.ibm.com)
 AM_INIT_AUTOMAKE
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
@@ -32,7 +32,7 @@ AC_CHECK_HEADERS(openssl/conf.h)
 
 AC_CHECK_PROG(TSSPCRREAD, [tsspcrread], yes, no)
 if test "x$TSSPCRREAD" = "xyes"; then
-	AC_DEFINE(HAVE_TSSPCRREAD, 1, [Define to 1 if you have tsspcrread binary installed])],
+	AC_DEFINE(HAVE_TSSPCRREAD, 1, [Define to 1 if you have tsspcrread binary installed])
 fi
 
 AC_CHECK_HEADERS(sys/xattr.h, , [AC_MSG_ERROR([sys/xattr.h header not found. You need the c-library development package.])])

packaging/ima-evm-utils.spec

@@ -1,5 +1,5 @@
 Name:		ima-evm-utils
-Version:	1.2
+Version:	1.2.1
 Release:	1%{?dist}
 Summary:	ima-evm-utils - IMA/EVM control utility
 Group:		System/Libraries

src/evmctl.c

@@ -843,10 +843,12 @@ static int cmd_verify_evm(struct command *cmd)
 		return -1;
 	}
 
+	if (imaevm_params.x509) {
 		if (imaevm_params.keyfile) /* Support multiple public keys */
 			init_public_keys(imaevm_params.keyfile);
 		else			   /* assume read pubkey from x509 cert */
 			init_public_keys("/etc/keys/x509_evm.der");
+	}
 
 	err = verify_evm(file);
 	if (!err && imaevm_params.verbose >= LOG_INFO)
@@ -887,12 +889,14 @@ static int verify_ima(const char *file)
 static int cmd_verify_ima(struct command *cmd)
 {
 	char *file = g_argv[optind++];
-	int err;
+	int err, fails = 0;
 
+	if (imaevm_params.x509) {
 		if (imaevm_params.keyfile) /* Support multiple public keys */
 			init_public_keys(imaevm_params.keyfile);
 		else			   /* assume read pubkey from x509 cert */
 			init_public_keys("/etc/keys/x509_evm.der");
+	}
 
 	errno = 0;
 	if (!file) {
@@ -903,10 +907,12 @@ static int cmd_verify_ima(struct command *cmd)
 
 	do {
 		err = verify_ima(file);
+		if (err)
+			fails++;
 		if (!err && imaevm_params.verbose >= LOG_INFO)
 			log_info("%s: verification is OK\n", file);
 	} while ((file = g_argv[optind++]));
-	return err;
+	return fails > 0;
 }
 
 static int cmd_convert(struct command *cmd)
@@ -1943,11 +1949,13 @@ int main(int argc, char *argv[])
 	int err = 0, c, lind;
 	ENGINE *eng = NULL;
 
+#if !(OPENSSL_VERSION_NUMBER < 0x10100000)
 	OPENSSL_init_crypto(
 #ifndef DISABLE_OPENSSL_CONF
 			    OPENSSL_INIT_LOAD_CONFIG |
 #endif
 			    OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL);
+#endif
 	g_argv = argv;
 	g_argc = argc;
 

src/libimaevm.c

@@ -612,6 +612,8 @@ int verify_hash(const char *file, const unsigned char *hash, int size, unsigned
 		/* Read pubkey from RSA key */
 		if (!imaevm_params.keyfile)
 			key = "/etc/keys/pubkey_evm.pem";
+		else
+			key = imaevm_params.keyfile;
 		return verify_hash_v1(file, hash, size, sig, siglen, key);
 	} else if (sig[0] == DIGSIG_VERSION_2) {
 		return verify_hash_v2(file, hash, size, sig, siglen);
@@ -977,7 +979,14 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c
 
 static void libinit()
 {
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000
+	OpenSSL_add_all_algorithms();
+	OPENSSL_add_all_algorithms_conf();
+#else
+
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS |
 			    OPENSSL_INIT_ADD_ALL_DIGESTS, NULL);
 	ERR_load_crypto_strings();
+#endif
 }