Release version 1.3.2

Refer to the NEWS file for a short summary and the git history for
details.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

.travis.yml

@@ -0,0 +1,78 @@
+dist: bionic
+language: C
+services:
+    - docker
+
+matrix:
+    include:
+        # 32 bit build
+        - os: linux
+          env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss
+          compiler: gcc
+
+        # cross compilation builds
+        - os: linux
+          env: DISTRO=debian:stable VARIANT=cross-compile ARCH=ppc64el TSS=ibmtss
+          compiler: powerpc64le-linux-gnu-gcc
+
+        - os: linux
+          env: DISTRO=debian:stable VARIANT=cross-compile ARCH=arm64 TSS=tpm2-tss
+          compiler: aarch64-linux-gnu-gcc
+
+        - os: linux
+          env: DISTRO=debian:stable VARIANT=cross-compile ARCH=s390x TSS=ibmtss
+          compiler: s390x-linux-gnu-gcc
+
+        # musl
+        - os: linux
+          env: DISTRO=alpine:latest TSS=tpm2-tss
+          compiler: gcc
+
+        # glibc (gcc/clang)
+        - os: linux
+          env: DISTRO=opensuse/tumbleweed TSS=ibmtss
+          compiler: clang
+
+        - os: linux
+          env: DISTRO=opensuse/leap TSS=tpm2-tss
+          compiler: gcc
+
+        - os: linux
+          env: DISTRO=ubuntu:eoan TSS=ibmtss
+          compiler: gcc
+
+        - os: linux
+          env: DISTRO=ubuntu:xenial TSS=tpm2-tss
+          compiler: clang
+
+        - os: linux
+          env: DISTRO=fedora:latest TSS=ibmtss
+          compiler: clang
+
+        - os: linux
+          env: DISTRO=centos:7 TSS=tpm2-tss
+          compiler: gcc
+
+        - os: linux
+          env: DISTRO=centos:latest TSS=tpm2-tss
+          compiler: clang
+
+        - os: linux
+          env: DISTRO=debian:testing TSS=tpm2-tss
+          compiler: clang
+
+        - os: linux
+          env: DISTRO=debian:stable TSS=ibmtss
+          compiler: gcc
+
+before_install:
+    - df -hT
+    - DIR="/usr/src/ima-evm-utils"
+    - printf "FROM $DISTRO\nRUN mkdir -p $DIR\nWORKDIR $DIR\nCOPY . $DIR\n" > Dockerfile
+    - cat Dockerfile
+    - docker build -t ima-evm-utils .
+
+script:
+    - INSTALL="${DISTRO%%:*}"
+    - INSTALL="${INSTALL%%/*}"
+    - docker run -t ima-evm-utils /bin/sh -c "cd travis && if [ \"$VARIANT\" ]; then ARCH=\"$ARCH\" ./$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./$INSTALL.sh && if [ ! \"$VARIANT\" ]; then which tpm_server || which swtpm || ../tests/install-swtpm.sh; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" ../build.sh"

ChangeLog

@@ -1,184 +0,0 @@
-2020-07-21  Mimi Zohar <zohar@linux.ibm.com>
-
-	version 1.3 new features:
-	* NEW ima-evm-utils regression test infrastructure with two initial
-	  tests:
-	  - ima_hash.test: calculate/verify different crypto hash algorithms
-	  - sign_verify.test: EVM and IMA sign/verify signature tests
-	* TPM 2.0 support
-	  - Calculate the new per TPM 2.0 bank template data digest
-	  - Support original padding the SHA1 template data digest
-	  - Compare ALL the re-calculated TPM 2.0 bank PCRs against the
-	    TPM 2.0 bank PCR values
-	  - Calculate the per TPM bank "boot_aggregate" values, including
-	    PCRs 8 & 9 in calculation
-	  - Support reading the per TPM 2.0 Bank PCRs using Intel's TSS
-	  - boot_aggregate.test: compare the calculated "boot_aggregate"
-	    values with the "boot_aggregate" value included in the IMA
-	    measurement.
-	* TPM 1.2 support
-	  - Additionally support reading the TPM 1.2 PCRs from a supplied file
-	    ("--pcrs" option)
-	* Based on original IMA LTP and standalone version support
-	  - Calculate the TPM 1.2 "boot_aggregate" based on the exported
-	    TPM 1.2 BIOS event log.
-	  - In addition to verifying the IMA measurement list against the
-	    the TPM PCRs, verify the IMA template data digest against the
-	    template data.  (Based on LTP "--verify" option.)
-	  - Ignore file measurement violations while verifying the IMA
-	    measurment list. (Based on LTP "--validate" option.)
-	  - Verify the file data signature included in the measurement list
-	    based on the file hash also included in the measurement list
-	    (--verify-sig)
-	  - Support original "ima" template (mixed templates not supported)
-	* Support "sm3" crypto name
-
-	Bug fixes and code cleanup:
-	* Don't exit with -1 on failure, exit with 125
-	* On signature verification failure, include pathname.
-	* Provide minimal hash_info.h file in case one doesn't exist, needed
-	  by the ima-evm-utils regression tests.
-	* On systems with TPM 1.2, skip "boot_aggregate.test" using sample logs
-	* Fix hash_algo type comparison mismatch
-	* Simplify/clean up code
-	* Address compiler complaints and failures
-	* Fix memory allocations and leaks
-	* Sanity check provided input files are regular files
-	* Revert making "tsspcrread" a compile build time decision.
-	* Limit additional messages based on log level (-v)
-
-2019-07-30  Mimi Zohar <zohar@linux.ibm.com>
-
-	version 1.2.1 Bug fixes:
-	* When verifying multiple file signatures, return correct status
-	* Don't automatically use keys from x509 certs if user supplied "--rsa"
-	* Fix verifying DIGSIG_VERSION_1 signatures
-	* autoconf, openssl fixes
-
-
-2019-07-24  Mimi Zohar <zohar@linux.ibm.com>
-
-	version 1.2 new features:
-	* Generate EVM signatures based on the specified hash algorithm
-	* include "security.apparmor" in EVM signature
-	* Add support for writing & verifying "user.xxxx" xattrs for testing
-	* Support Strebog/Gost hash functions
-	* Add OpenSSL engine support
-	* Use of EVP_PKEY OpenSSL API to generate/verify v2 signatures
-	* Support verifying multiple signatures at once
-	* Support new template "buf" field and warn about other unknown fields
-	* Improve OpenSSL error reporting
-	* Support reading TPM 2.0 PCRs using tsspcrread
-
-	Bug fixes and code cleanup:
-	* Update manpage stylesheet detection
-	* Fix xattr.h include file
-	* On error when reading TPM PCRs, don't log gargabe
-	* Properly return keyid string to calc_keyid_v1/v2 callers, caused by
-	  limiting keyid output to verbose mode
-	* Fix hash buffer overflow caused by EVM support for larger hashes,
-	  defined MAX_DIGEST_SIZE and MAX_SIGNATURE_SIZE, and added "asserts".
-	* Linked with libcrypto instead of OpenSSL
-	* Updated Autotools, replacing INCLUDES with AM_CPPFLAGS
-	* Include new "hash-info.gen" in tar
-	* Log the hash algorithm, not just the hash value
-	* Fixed memory leaks in: EV_MD_CTX, init_public_keys
-	* Fixed other warnings/bugs discovered by clang, coverity
-	* Remove indirect calls in verify_hash() to improve code readability
-	* Don't fallback to using sha1
-	* Namespace some too generic object names
-	* Make functions/arrays static if possible
-
-
-2018-01-28  Mimi Zohar <zohar@us.ibm.com>
-
-	version 1.1
-	* Support the new openssl 1.1 api
-	* Support for validating multiple pcrs
-	* Verify the measurement list signature based on the list digest
-	* Verify the "ima-sig" measurement list using multiple keys
-	* Fixed parsing the measurement template data field length
-	* Portable & immutable EVM signatures (new format)
-	* Multiple fixes that have been lingering in the next branch. Some
-	  are for experimental features that are not yet supported in the
-	  kernel.
-
-2014-07-30  Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
-
-	version 1.0
-	* Recursive hashing
-	* Immutable EVM signatures (experimental)
-	* Command 'ima_clear' to remove xattrs
-	* Support for passing password to the library
-	* Support for asking password safely from the user
-
-2014-09-23  Dmitry Kasatkin <d.kasatkin@samsung.com>
-
-	version 0.9
-	* Updated README
-	* man page generated and added to the package
-	* Use additional SMACK xattrs for EVM signature generation
-	* Signing functions moved to libimaevm for external use (RPM)
-	* Fixed setting of correct hash header
-
-2014-05-05  Dmitry Kasatkin <d.kasatkin@samsung.com>
-
-	version 0.8
-	* Symbilic names for keyrings
-	* Hash list signing
-	* License text fix for using OpenSSL
-	* Help output fix
-
-2014-02-17  Dmitry Kasatkin <d.kasatkin@samsung.com>
-
-	version 0.7
-	* Fix symbolic links related bugs
-	* Provide recursive fixing
-	* Provide recursive signing
-	* Move IMA verification to the library (first for LTP use)
-	* Support for target architecture data size
-	* Remove obsolete module signing code
-	* Code cleanup
-
-2013-08-28  Dmitry Kasatkin <d.kasatkin@samsung.com>
-
-	version 0.6
-	* support for asymmetric crypto keys and new signature format (v2)
-	* fixes to set correct hash algo for digital signature v1
-	* uuid support for EVM
-	* signature verification support
-	* test scripts removed
-	* README updates
-
-2012-05-18  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
-
-	version 0.3
-	* llistxattr returns 0 if there are no xattrs and it is valid
-	* Added entry type to directory hash calculation
-	* inline block variable renamed
-	* Remove forced tag creation
-	* Use libexec for programs and scripts
-	* Some files updated
-	* Do not search for algorithm as it is known
-	* Refactored to remove redundant hash initialization code
-	* Added hash calculation for special files
-
-2012-04-05  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
-
-	version 0.2
-	* added RPM & TAR building makefile rules
-	* renamed evm-utils to ima-evm-utils
-	* added command options description
-	* updated error handling
-	* refactored redundant code
-
-2012-04-02  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
-
-	version 0.1.0
-	* Fully functional version for lastest 3.x kernels
-
-2011-08-24  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
-
-	version 0.1
-	* Initial public version.
-

Makefile.am

@@ -1,5 +1,7 @@
 SUBDIRS = src tests
+if MANPAGE_DOCBOOK_XSL
 dist_man_MANS = evmctl.1
+endif
 
 doc_DATA =  examples/ima-genkey-self.sh examples/ima-genkey.sh examples/ima-gen-local-ca.sh
 EXTRA_DIST = autogen.sh $(doc_DATA)
@@ -23,6 +25,7 @@ rpm: $(tarname)
 	cp $(tarname) $(SRCS)/
 	rpmbuild -ba --nodeps $(SPEC)
 
+if MANPAGE_DOCBOOK_XSL
 evmctl.1.html: README
 	@asciidoc -o $@ $<
 
@@ -35,5 +38,6 @@ rmman:
 	rm -f evmctl.1
 
 doc: evmctl.1.html rmman evmctl.1
+endif
 
 .PHONY: $(tarname)

NEWS

@@ -0,0 +1,202 @@
+2020-10-28  Mimi Zohar <zohar@linux.ibm.com>
+
+	version 1.3.2:
+	* Bugfixes: importing keys
+	* NEW: Docker based travis distro testing
+	* Travis bugfixes, code cleanup, software version update,
+	  and script removal
+	* Initial travis testing
+
+2020-08-11  Mimi Zohar <zohar@linux.ibm.com>
+
+	version 1.3.1:
+	* "--pcrs" support for per crypto algorithm
+	* Drop/rename "ima_measurement" options
+	* Moved this summary from "Changelog" to "NEWS", removing
+	  requirement for GNU empty files
+	* Distro build fixes
+
+2020-07-21  Mimi Zohar <zohar@linux.ibm.com>
+
+	version 1.3 new features:
+	* NEW ima-evm-utils regression test infrastructure with two initial
+	  tests:
+	  - ima_hash.test: calculate/verify different crypto hash algorithms
+	  - sign_verify.test: EVM and IMA sign/verify signature tests
+	* TPM 2.0 support
+	  - Calculate the new per TPM 2.0 bank template data digest
+	  - Support original padding the SHA1 template data digest
+	  - Compare ALL the re-calculated TPM 2.0 bank PCRs against the
+	    TPM 2.0 bank PCR values
+	  - Calculate the per TPM bank "boot_aggregate" values, including
+	    PCRs 8 & 9 in calculation
+	  - Support reading the per TPM 2.0 Bank PCRs using Intel's TSS
+	  - boot_aggregate.test: compare the calculated "boot_aggregate"
+	    values with the "boot_aggregate" value included in the IMA
+	    measurement.
+	* TPM 1.2 support
+	  - Additionally support reading the TPM 1.2 PCRs from a supplied file
+	    ("--pcrs" option)
+	* Based on original IMA LTP and standalone version support
+	  - Calculate the TPM 1.2 "boot_aggregate" based on the exported
+	    TPM 1.2 BIOS event log.
+	  - In addition to verifying the IMA measurement list against the
+	    the TPM PCRs, verify the IMA template data digest against the
+	    template data.  (Based on LTP "--verify" option.)
+	  - Ignore file measurement violations while verifying the IMA
+	    measurment list. (Based on LTP "--validate" option.)
+	  - Verify the file data signature included in the measurement list
+	    based on the file hash also included in the measurement list
+	    (--verify-sig)
+	  - Support original "ima" template (mixed templates not supported)
+	* Support "sm3" crypto name
+
+	Bug fixes and code cleanup:
+	* Don't exit with -1 on failure, exit with 125
+	* On signature verification failure, include pathname.
+	* Provide minimal hash_info.h file in case one doesn't exist, needed
+	  by the ima-evm-utils regression tests.
+	* On systems with TPM 1.2, skip "boot_aggregate.test" using sample logs
+	* Fix hash_algo type comparison mismatch
+	* Simplify/clean up code
+	* Address compiler complaints and failures
+	* Fix memory allocations and leaks
+	* Sanity check provided input files are regular files
+	* Revert making "tsspcrread" a compile build time decision.
+	* Limit additional messages based on log level (-v)
+
+2019-07-30  Mimi Zohar <zohar@linux.ibm.com>
+
+	version 1.2.1 Bug fixes:
+	* When verifying multiple file signatures, return correct status
+	* Don't automatically use keys from x509 certs if user supplied "--rsa"
+	* Fix verifying DIGSIG_VERSION_1 signatures
+	* autoconf, openssl fixes
+
+
+2019-07-24  Mimi Zohar <zohar@linux.ibm.com>
+
+	version 1.2 new features:
+	* Generate EVM signatures based on the specified hash algorithm
+	* include "security.apparmor" in EVM signature
+	* Add support for writing & verifying "user.xxxx" xattrs for testing
+	* Support Strebog/Gost hash functions
+	* Add OpenSSL engine support
+	* Use of EVP_PKEY OpenSSL API to generate/verify v2 signatures
+	* Support verifying multiple signatures at once
+	* Support new template "buf" field and warn about other unknown fields
+	* Improve OpenSSL error reporting
+	* Support reading TPM 2.0 PCRs using tsspcrread
+
+	Bug fixes and code cleanup:
+	* Update manpage stylesheet detection
+	* Fix xattr.h include file
+	* On error when reading TPM PCRs, don't log gargabe
+	* Properly return keyid string to calc_keyid_v1/v2 callers, caused by
+	  limiting keyid output to verbose mode
+	* Fix hash buffer overflow caused by EVM support for larger hashes,
+	  defined MAX_DIGEST_SIZE and MAX_SIGNATURE_SIZE, and added "asserts".
+	* Linked with libcrypto instead of OpenSSL
+	* Updated Autotools, replacing INCLUDES with AM_CPPFLAGS
+	* Include new "hash-info.gen" in tar
+	* Log the hash algorithm, not just the hash value
+	* Fixed memory leaks in: EV_MD_CTX, init_public_keys
+	* Fixed other warnings/bugs discovered by clang, coverity
+	* Remove indirect calls in verify_hash() to improve code readability
+	* Don't fallback to using sha1
+	* Namespace some too generic object names
+	* Make functions/arrays static if possible
+
+
+2018-01-28  Mimi Zohar <zohar@us.ibm.com>
+
+	version 1.1
+	* Support the new openssl 1.1 api
+	* Support for validating multiple pcrs
+	* Verify the measurement list signature based on the list digest
+	* Verify the "ima-sig" measurement list using multiple keys
+	* Fixed parsing the measurement template data field length
+	* Portable & immutable EVM signatures (new format)
+	* Multiple fixes that have been lingering in the next branch. Some
+	  are for experimental features that are not yet supported in the
+	  kernel.
+
+2014-07-30  Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
+
+	version 1.0
+	* Recursive hashing
+	* Immutable EVM signatures (experimental)
+	* Command 'ima_clear' to remove xattrs
+	* Support for passing password to the library
+	* Support for asking password safely from the user
+
+2014-09-23  Dmitry Kasatkin <d.kasatkin@samsung.com>
+
+	version 0.9
+	* Updated README
+	* man page generated and added to the package
+	* Use additional SMACK xattrs for EVM signature generation
+	* Signing functions moved to libimaevm for external use (RPM)
+	* Fixed setting of correct hash header
+
+2014-05-05  Dmitry Kasatkin <d.kasatkin@samsung.com>
+
+	version 0.8
+	* Symbilic names for keyrings
+	* Hash list signing
+	* License text fix for using OpenSSL
+	* Help output fix
+
+2014-02-17  Dmitry Kasatkin <d.kasatkin@samsung.com>
+
+	version 0.7
+	* Fix symbolic links related bugs
+	* Provide recursive fixing
+	* Provide recursive signing
+	* Move IMA verification to the library (first for LTP use)
+	* Support for target architecture data size
+	* Remove obsolete module signing code
+	* Code cleanup
+
+2013-08-28  Dmitry Kasatkin <d.kasatkin@samsung.com>
+
+	version 0.6
+	* support for asymmetric crypto keys and new signature format (v2)
+	* fixes to set correct hash algo for digital signature v1
+	* uuid support for EVM
+	* signature verification support
+	* test scripts removed
+	* README updates
+
+2012-05-18  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
+
+	version 0.3
+	* llistxattr returns 0 if there are no xattrs and it is valid
+	* Added entry type to directory hash calculation
+	* inline block variable renamed
+	* Remove forced tag creation
+	* Use libexec for programs and scripts
+	* Some files updated
+	* Do not search for algorithm as it is known
+	* Refactored to remove redundant hash initialization code
+	* Added hash calculation for special files
+
+2012-04-05  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
+
+	version 0.2
+	* added RPM & TAR building makefile rules
+	* renamed evm-utils to ima-evm-utils
+	* added command options description
+	* updated error handling
+	* refactored redundant code
+
+2012-04-02  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
+
+	version 0.1.0
+	* Fully functional version for lastest 3.x kernels
+
+2011-08-24  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
+
+	version 0.1
+	* Initial public version.
+

README

@@ -28,10 +28,11 @@ COMMANDS
  import [--rsa] pubkey keyring
  sign [-r] [--imahash | --imasig ] [--portable] [--key key] [--pass password] file
  verify file
+ ima_boot_aggregate [--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log]
  ima_sign [--sigfile] [--key key] [--pass password] file
  ima_verify file
  ima_hash file
- ima_measurement [--validate] [--verify] [--verify-sig [--key "key1, key2, ..."]]  [--pcrs file] file
+ ima_measurement [--ignore-violations] [--verify-sig [--key "key1, key2, ..."]]  [--pcrs [hash-algorithm,]file [--pcrs hash-algorithm,file] ...] file
  ima_fix [-t fdsxm] path
  sign_hash [--key key] [--pass password]
  hmac [--imahash | --imasig ] file
@@ -59,9 +60,8 @@ OPTIONS
       --m32          force EVM hmac/signature for 32 bit target system
       --m64          force EVM hmac/signature for 64 bit target system
       --engine e     preload OpenSSL engine e (such as: gost)
-      --pcrs         file containing TPM 1.2 pcrs
+      --pcrs         file containing TPM pcrs, one per hash-algorithm/bank
-      --validate     ignore ToMToU measurement violations
+      --ignore-violations ignore ToMToU measurement violations
-      --verify       verify the template data digest
       --verify-sig   verify the file signature based on the file hash, both
                      stored in the template data.
   -v                 increase verbosity level

autogen.sh

@@ -1,16 +1,4 @@
 #! /bin/sh
-
 set -e
 
-# new way
+autoreconf -i
-# strange, but need this for Makefile.am, because it has -I m4
-test -d m4 || mkdir m4
-autoreconf -f -i
-
-# old way
-#libtoolize --automake --copy --force
-#aclocal
-#autoconf --force
-#autoheader --force
-#automake --add-missing --copy --force-missing --gnu
-

build.sh

@@ -0,0 +1,97 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+
+set -e
+
+CC="${CC:-gcc}"
+CFLAGS="${CFLAGS:--Wformat -Werror=format-security -Werror=implicit-function-declaration -Werror=return-type -fno-common}"
+PREFIX="${PREFIX:-$HOME/ima-evm-utils-install}"
+
+export LD_LIBRARY_PATH="$PREFIX/lib64:$PREFIX/lib:/usr/local/lib64:/usr/local/lib"
+export PATH="$PREFIX/bin:/usr/local/bin:$PATH"
+
+title()
+{
+	echo "===== $1 ====="
+}
+
+log_exit()
+{
+	local ret="${3:-$?}"
+	local log="$1"
+	local msg="$2"
+	local prefix
+
+	echo "=== $log ==="
+	[ $ret -eq 0 ] || prefix="FAIL: "
+	cat $log
+	echo
+	echo "$prefix$msg, see output of $log above"
+	exit $ret
+}
+
+cd `dirname $0`
+
+case "$VARIANT" in
+	i386)
+		echo "32-bit compilation"
+		export CFLAGS="-m32 $CFLAGS" LDFLAGS="-m32 $LDFLAGS"
+		export PKG_CONFIG_LIBDIR=/usr/lib/i386-linux-gnu/pkgconfig
+		;;
+	cross-compile)
+		host="${CC%-gcc}"
+		export CROSS_COMPILE="${host}-"
+		host="--host=$host"
+		echo "cross compilation: $host"
+		echo "CROSS_COMPILE: '$CROSS_COMPILE'"
+		;;
+	*)
+		if [ "$VARIANT" ]; then
+			echo "Wrong VARIANT: '$VARIANT'" >&2
+			exit 1
+		fi
+		echo "native build"
+		;;
+esac
+
+title "compiler version"
+$CC --version
+echo "CFLAGS: '$CFLAGS'"
+echo "LDFLAGS: '$LDFLAGS'"
+echo "PREFIX: '$PREFIX'"
+
+title "configure"
+./autogen.sh
+./configure --prefix=$PREFIX $host || log_exit config.log "configure failed"
+
+title "make"
+make -j$(nproc)
+make install
+
+title "test"
+if [ "$VARIANT" = "cross-compile" ]; then
+	echo "skip make check on cross compilation"
+	exit 0
+fi
+
+ret=0
+VERBOSE=1 make check || ret=$?
+
+title "logs"
+if [ $ret -eq 0 ]; then
+	tail -3 tests/ima_hash.log
+	tail -3 tests/sign_verify.log
+	tail -20 tests/boot_aggregate.log
+	exit 0
+fi
+
+cat tests/test-suite.log
+
+if [ $ret -eq 77 ]; then
+	msg="WARN: some tests skipped"
+	ret=0
+else
+	msg="FAIL: tests exited: $ret"
+fi
+
+log_exit tests/test-suite.log "$msg" $ret

configure.ac

@@ -1,8 +1,8 @@
 # autoconf script
 
 AC_PREREQ([2.65])
-AC_INIT(ima-evm-utils, 1.3, zohar@linux.ibm.com)
+AC_INIT(ima-evm-utils, 1.3.2, zohar@linux.ibm.com)
-AM_INIT_AUTOMAKE
+AM_INIT_AUTOMAKE([foreign])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 
@@ -30,9 +30,9 @@ AC_SUBST(KERNEL_HEADERS)
 AC_CHECK_HEADER(unistd.h)
 AC_CHECK_HEADERS(openssl/conf.h)
 
-AC_CHECK_LIB([tss2-esys], [Esys_PCR_Read])
+AC_CHECK_LIB([tss2-esys], [Esys_Free])
 AC_CHECK_LIB([tss2-rc], [Tss2_RC_Decode])
-AM_CONDITIONAL([USE_PCRTSS], [test "x$ac_cv_lib_tss2_esys_Esys_PCR_Read" = "xyes"])
+AM_CONDITIONAL([USE_PCRTSS], [test "x$ac_cv_lib_tss2_esys_Esys_Free" = "xyes"])
 
 AC_CHECK_HEADERS(sys/xattr.h, , [AC_MSG_ERROR([sys/xattr.h header not found. You need the c-library development package.])])
 AC_CHECK_HEADERS(keyutils.h, , [AC_MSG_ERROR([keyutils.h header not found. You need the libkeyutils development package.])])
@@ -77,6 +77,7 @@ echo
 echo	"Configuration:"
 echo	"          debug: $pkg_cv_enable_debug"
 echo	"   openssl-conf: $enable_openssl_conf"
-echo	"      tss2-esys: $ac_cv_lib_tss2_esys_Esys_PCR_Read"
+echo	"      tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free"
 echo	" tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode"
+echo	"            doc: $have_doc"
 echo

m4/manpage-docbook-xsl.m4

@@ -1,7 +1,10 @@
-dnl Copyright (c) 2018 Petr Vorel <pvorel@suse.cz>
+dnl Copyright (c) 2018-2020 Petr Vorel <pvorel@suse.cz>
 dnl Find docbook manpage stylesheet
 
 AC_DEFUN([EVMCTL_MANPAGE_DOCBOOK_XSL], [
+	DOCBOOK_XSL_URI="http://docbook.sourceforge.net/release/xsl/current"
+	DOCBOOK_XSL_PATH="manpages/docbook.xsl"
+
 	AC_PATH_PROGS(XMLCATALOG, xmlcatalog)
 	AC_ARG_WITH([xml-catalog],
 		AC_HELP_STRING([--with-xml-catalog=CATALOG],
@@ -9,20 +12,37 @@ AC_DEFUN([EVMCTL_MANPAGE_DOCBOOK_XSL], [
 				[with_xml_catalog=/etc/xml/catalog])
 	XML_CATALOG_FILE="$with_xml_catalog"
 	AC_SUBST([XML_CATALOG_FILE])
+
+	if test "x${XMLCATALOG}" = "x"; then
+		AC_MSG_WARN([xmlcatalog not found, cannot search for $DOCBOOK_XSL_PATH])
+	else
 		AC_MSG_CHECKING([for XML catalog ($XML_CATALOG_FILE)])
 		if test -f "$XML_CATALOG_FILE"; then
 			have_xmlcatalog_file=yes
 			AC_MSG_RESULT([found])
 		else
-		AC_MSG_RESULT([not found])
+			AC_MSG_RESULT([not found, cannot search for $DOCBOOK_XSL_PATH])
 		fi
+	fi
+
 	if test "x${XMLCATALOG}" != "x" -a "x$have_xmlcatalog_file" = "xyes"; then
-		DOCBOOK_XSL_URI="http://docbook.sourceforge.net/release/xsl/current"
+		MANPAGE_DOCBOOK_XSL=$(${XMLCATALOG} ${XML_CATALOG_FILE} ${DOCBOOK_XSL_URI}/${DOCBOOK_XSL_PATH} | sed 's|^file:/\+|/|')
-		DOCBOOK_XSL_PATH="manpages/docbook.xsl"
-		MANPAGE_DOCBOOK_XSL=$(${XMLCATALOG} ${XML_CATALOG_FILE} ${DOCBOOK_XSL_URI}/${DOCBOOK_XSL_PATH} | sed -n 's|^file:/\+|/|p;q')
 	fi
+
 	if test "x${MANPAGE_DOCBOOK_XSL}" = "x"; then
 		MANPAGE_DOCBOOK_XSL="/usr/share/xml/docbook/stylesheet/docbook-xsl/manpages/docbook.xsl"
+		AC_MSG_WARN([trying a default path for $DOCBOOK_XSL_PATH])
 	fi
+
+	if test -f "$MANPAGE_DOCBOOK_XSL"; then
+		have_doc=yes
+		AC_MSG_NOTICE([using $MANPAGE_DOCBOOK_XSL for generating doc])
+	else
+		AC_MSG_WARN([$DOCBOOK_XSL_PATH not found, generating doc will be skipped])
+		MANPAGE_DOCBOOK_XSL=
+		have_doc=no
+	fi
+	AM_CONDITIONAL(MANPAGE_DOCBOOK_XSL, test "x$have_doc" = xyes)
+
 	AC_SUBST(MANPAGE_DOCBOOK_XSL)
 ])

packaging/ima-evm-utils.spec

@@ -1,5 +1,5 @@
 Name:		ima-evm-utils
-Version:	1.3
+Version:	1.3.2
 Release:	1%{?dist}
 Summary:	ima-evm-utils - IMA/EVM control utility
 Group:		System/Libraries

src/evmctl.c

@@ -160,7 +160,10 @@ struct tpm_bank_info {
 	uint8_t pcr[NUM_PCRS][MAX_DIGEST_SIZE];
 };
 
-static char *pcrfile;
+/* One --pcrs file per hash-algorithm/bank */
+#define MAX_PCRFILE 2
+static char *pcrfile[MAX_PCRFILE];
+static unsigned npcrfile;
 
 static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)
 {
@@ -218,7 +221,7 @@ static unsigned char *file2bin(const char *file, const char *ext, int *size)
 		fclose(fp);
 		return NULL;
 	}
-	if (fread(data, len, 1, fp) != len) {
+	if (fread(data, len, 1, fp) != 1) {
 		log_err("Failed to fread %zu bytes: %s\n", len, name);
 		fclose(fp);
 		free(data);
@@ -1373,55 +1376,6 @@ static int cmd_ima_clear(struct command *cmd)
 	return do_cmd(cmd, ima_clear);
 }
 
-static char *pcrs = "/sys/class/tpm/tpm0/device/pcrs";  /* Kernels >= 4.0 */
-static char *misc_pcrs = "/sys/class/misc/tpm0/device/pcrs";
-
-/* Read all of the TPM 1.2 PCRs */
-static int tpm_pcr_read(struct tpm_bank_info *tpm_banks, int len)
-{
-	struct stat s;
-	FILE *fp = NULL;
-	char *p, pcr_str[8], buf[70]; /* length of the TPM string */
-	int result = -1;
-	int i = 0;
-
-	/* Use the provided TPM 1.2 pcrs file */
-	if (pcrfile) {
-		if (stat(pcrfile, &s) == -1) {
-			errno = 0;
-			return 1;
-		}
-
-		if (!S_ISREG(s.st_mode)) {
-			log_info("TPM 1.2 PCR file: not a regular file or link to regular file\n");
-			return 1;
-		}
-
-		fp = fopen(pcrfile, "r");
-	}
-
-	if (!fp)
-		fp = fopen(pcrs, "r");
-
-	if (!fp)
-		fp = fopen(misc_pcrs, "r");
-
-	if (!fp)
-		return -1;
-
-	for (;;) {
-		p = fgets(buf, sizeof(buf), fp);
-		if (!p || i > 99)
-			break;
-		sprintf(pcr_str, "PCR-%2.2d", i);
-		if (!strncmp(p, pcr_str, 6))
-			hex2bin(tpm_banks[0].pcr[i++], p + 7, len);
-		result = 0;
-	}
-	fclose(fp);
-	return result;
-}
-
 #define TCG_EVENT_NAME_LEN_MAX	255
 
 struct template_entry {
@@ -1438,8 +1392,7 @@ struct template_entry {
 
 static uint8_t zero[MAX_DIGEST_SIZE];
 
-static int validate = 0;
+static int ignore_violations = 0;
-static int verify = 0;
 
 static int ima_verify_template_hash(struct template_entry *entry)
 {
@@ -1786,7 +1739,7 @@ static void extend_tpm_banks(struct template_entry *entry, int num_banks,
 		 * size.
 		 */
 		if (memcmp(entry->header.digest, zero, SHA_DIGEST_LENGTH) == 0) {
-			if (!validate) {
+			if (!ignore_violations) {
 				memset(bank[i].digest, 0x00, bank[i].digest_size);
 				memset(padded_bank[i].digest, 0x00, padded_bank[i].digest_size);
 			} else {
@@ -1829,20 +1782,108 @@ static void extend_tpm_banks(struct template_entry *entry, int num_banks,
 #endif
 }
 
-/* Read TPM 1.2 PCRs */
+static int read_one_bank(struct tpm_bank_info *tpm_bank, FILE *fp)
-static int read_tpm_pcrs(int num_banks, struct tpm_bank_info *tpm_banks)
 {
-	int i;
+	char *p, pcr_str[8], buf[MAX_DIGEST_SIZE * 2 + 8];
-
+	int i = 0;
-	if (tpm_pcr_read(tpm_banks, SHA_DIGEST_LENGTH)) {
+	int result = -1;
-		log_debug("Failed to read TPM 1.2 PCRs.\n");
+	for (;;) {
-		return -1;
+		p = fgets(buf, sizeof(buf), fp);
+		if (!p || i >= NUM_PCRS)
+			break;
+		sprintf(pcr_str, "PCR-%2.2d", i);
+		if (!strncmp(p, pcr_str, 6))
+			hex2bin(tpm_bank->pcr[i++], p + 7, tpm_bank->digest_size);
+		result = 0;
+	}
+	return result;
 }
 
+static char *pcrs = "/sys/class/tpm/tpm0/device/pcrs";  /* Kernels >= 4.0 */
+static char *misc_pcrs = "/sys/class/misc/tpm0/device/pcrs";
+
+/* Read one of the TPM 1.2 sysfs files if present */
+static int read_sysfs_pcrs(int num_banks, struct tpm_bank_info *tpm_banks)
+{
+	FILE *fp;
+	int i, result;
+
+	fp = fopen(pcrs, "r");
+	if (!fp)
+		fp = fopen(misc_pcrs, "r");
+	if (!fp)
+		return -1;
+
+	result = read_one_bank(&tpm_banks[0], fp);
+	fclose(fp);
+	if (result < 0)
+		return result;
 	tpm_banks[0].supported = 1;
 	for (i = 1; i < num_banks; i++)
 		tpm_banks[i].supported = 0;
 	return 0;
+
+}
+
+/* Read PCRs from per-bank file(s) specified via --pcrs */
+static int read_file_pcrs(int num_banks, struct tpm_bank_info *tpm_banks)
+{
+	struct stat s;
+	FILE *fp;
+	char *p;
+	const char *alg, *path;
+	int i, j, bank, result;
+
+	for (i = 0; i < num_banks; i++)
+		tpm_banks[i].supported = 0;
+
+	for (i = 0; i < npcrfile; i++) {
+		p = strchr(pcrfile[i], ',');
+		if (p) {
+			*p = 0;
+			alg = pcrfile[i];
+			path = ++p;
+		} else {
+			alg = "sha1";
+			path = pcrfile[i];
+		}
+
+		bank = -1;
+		for (j = 0; j < num_banks; j++) {
+			if (!strcmp(tpm_banks[j].algo_name, alg)) {
+				bank = j;
+				break;
+			}
+		}
+		if (bank < 0) {
+			log_err("Unknown algorithm '%s'\n", alg);
+			return -1;
+		}
+
+		if (stat(path, &s) == -1) {
+			log_err("Could not stat '%s'\n", path);
+			return -1;
+		}
+
+		if (!S_ISREG(s.st_mode)) {
+			log_err("PCR file: not a regular file or link to regular file\n");
+			return -1;
+		}
+
+		fp = fopen(path, "r");
+		if (!fp) {
+			log_err("Could not open '%s'\n", path);
+			return -1;
+		}
+
+		result = read_one_bank(&tpm_banks[bank], fp);
+		fclose(fp);
+		if (result < 0)
+			return result;
+		tpm_banks[bank].supported = 1;
+	}
+
+	return 0;
 }
 
 /*
@@ -1857,8 +1898,12 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank)
 	int i, j;
 	int err;
 
-	/* First try reading PCRs from exported TPM 1.2 sysfs file */
+	/* If --pcrs was specified, read only from the specified file(s) */
-	if (read_tpm_pcrs(num_banks, bank) == 0)
+	if (npcrfile)
+		return read_file_pcrs(num_banks, bank);
+
+	/* Else try reading PCRs from the sysfs file if present */
+	if (read_sysfs_pcrs(num_banks, bank) == 0)
 		return 0;
 
 	/* Any userspace applications available for reading TPM 2.0 PCRs? */
@@ -1899,7 +1944,7 @@ static int ima_measurement(const char *file)
 
 	struct template_entry entry = { .template = 0 };
 	FILE *fp;
-	int verified_template_digest = 0;
+	int invalid_template_digest = 0;
 	int err_padded = -1;
 	int err = -1;
 
@@ -2029,11 +2074,9 @@ static int ima_measurement(const char *file)
 				 pseudo_padded_banks);
 
 		/* Recalculate and verify template data digest */
-		if (verify) {
 		err = ima_verify_template_hash(&entry);
 		if (err)
-				verified_template_digest = 1;
+			invalid_template_digest = 1;
-		}
 
 		if (is_ima_template)
 			ima_show(&entry);
@@ -2070,7 +2113,7 @@ static int ima_measurement(const char *file)
 			log_info("Failed to match per TPM bank or SHA1 padded TPM digest(s).\n");
 	}
 
-	if (verified_template_digest) {
+	if (invalid_template_digest) {
 		log_info("Failed to verify template data digest.\n");
 		err = 1;
 	}
@@ -2424,6 +2467,7 @@ static void usage(void)
 		"      --caps         use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n"
 		"      --verify-sig   verify measurement list signatures\n"
 		"      --engine e     preload OpenSSL engine e (such as: gost)\n"
+		"      --ignore-violations ignore ToMToU measurement violations\n"
 		"  -v                 increase verbosity level\n"
 		"  -h, --help         display this help and exit\n"
 		"\n");
@@ -2440,8 +2484,8 @@ struct command cmds[] = {
 	{"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"},
 	{"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"},
 	{"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"},
-	{"ima_measurement", cmd_ima_measurement, 0, "[--validate] [--verify] [--verify-sig [--key key1, key2, ...]] [--pcrs file] file", "Verify measurement list (experimental).\n"},
+	{"ima_measurement", cmd_ima_measurement, 0, "[--ignore-violations] [--verify-sig [--key key1, key2, ...]] [--pcrs [hash-algorithm,]file [--pcrs hash-algorithm,file] ...] file", "Verify measurement list (experimental).\n"},
-	{"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[file]", "Calculate per TPM bank boot_aggregate digests\n"},
+	{"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log]", "Calculate per TPM bank boot_aggregate digests\n"},
 	{"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"},
 	{"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"},
 	{"sign_hash", cmd_sign_hash, 0, "[--key key] [--pass [password]", "Sign hashes from shaXsum output.\n"},
@@ -2479,9 +2523,8 @@ static struct option opts[] = {
 	{"verify-sig", 0, 0, 138},
 	{"engine", 1, 0, 139},
 	{"xattr-user", 0, 0, 140},
-	{"validate", 0, 0, 141},
+	{"ignore-violations", 0, 0, 141},
-	{"verify", 0, 0, 142},
+	{"pcrs", 1, 0, 142},
-	{"pcrs", 1, 0, 143},
 	{}
 
 };
@@ -2660,14 +2703,15 @@ int main(int argc, char *argv[])
 			xattr_ima = "user.ima";
 			xattr_evm = "user.evm";
 			break;
-		case 141: /* --validate */
+		case 141: /* --ignore-violations */
-			validate = 1;
+			ignore_violations = 1;
 			break;
-		case 142: /* --verify */
+		case 142:
-			verify = 1;
+			if (npcrfile >= MAX_PCRFILE) {
-			break;
+				log_err("too many --pcrfile options\n");
-		case 143:
+				exit(1);
-			pcrfile = optarg;
+			}
+			pcrfile[npcrfile++] = optarg;
 			break;
 		case '?':
 			exit(1);

src/imaevm.h

@@ -46,7 +46,7 @@
 #include <syslog.h>
 #include <stdbool.h>
 #include <errno.h>
-
+#include <sys/types.h>
 #include <openssl/rsa.h>
 
 #ifdef USE_FPRINTF
@@ -203,7 +203,7 @@ struct RSA_ASN1_template {
 	size_t size;
 };
 
-#define	NUM_PCRS 20
+#define	NUM_PCRS 24
 #define DEFAULT_PCR 10
 
 extern struct libimaevm_params imaevm_params;

src/pcr_tss.c

@@ -68,14 +68,17 @@ int tpm2_pcr_supported(void)
 
 static int pcr_selections_match(TPML_PCR_SELECTION *a, TPML_PCR_SELECTION *b)
 {
+	int i, j;
+
 	if (a->count != b->count)
 		return 0;
-	for (int i = 0; i < a->count; i++) {
+
+	for (i = 0; i < a->count; i++) {
 		if (a->pcrSelections[i].hash != b->pcrSelections[i].hash)
 			return 0;
 		if (a->pcrSelections[i].sizeofSelect != b->pcrSelections[i].sizeofSelect)
 			return 0;
-		for (int j = 0; j < a->pcrSelections[i].sizeofSelect; j++) {
+		for (j = 0; j < a->pcrSelections[i].sizeofSelect; j++) {
 			if (a->pcrSelections[i].pcrSelect[j] != b->pcrSelections[i].pcrSelect[j])
 				return 0;
 		}

tests/boot_aggregate.test

@@ -26,44 +26,49 @@ TSSDIR="$(dirname -- "$(which tssstartup)")"
 PCRFILE="/sys/class/tpm/tpm0/device/pcrs"
 MISC_PCRFILE="/sys/class/misc/tpm0/device/pcrs"
 
-if [ "$(id -u)" = 0 ] && [ -c "/dev/tpm0" ]; then
+# Only stop this test's software TPM
-	ASCII_RUNTIME_MEASUREMENTS="/sys/kernel/security/ima/ascii_runtime_measurements"
-else
-	BINARY_BIOS_MEASUREMENTS="./sample-binary_bios_measurements-pcrs-8-9"
-	ASCII_RUNTIME_MEASUREMENTS="./sample-ascii_runtime_measurements-pcrs-8-9"
-	export TPM_INTERFACE_TYPE="socsim"
-	export TPM_COMMAND_PORT=2321
-fi
-
-# Only stop this test's software TPM.  Preferred method: "tsstpmcmd -stop"
 cleanup() {
-	if [ ! -z "${SWTPM_PPID}" ]; then
+	if [ -n "${SWTPM_PID}" ]; then
-		if [ -f "${TSSDIR}/tsstpmcmd" ]; then
+		kill -SIGTERM "${SWTPM_PID}"
+	elif [ -n "${TPMSERVER_PID}" ]; then
 		"${TSSDIR}/tsstpmcmd" -stop
-		else
-			pkill -P "${SWTPM_PPID}"
-		fi
 	fi
 }
 
 # Try to start a software TPM if needed.
 swtpm_start() {
-	local swtpm
+	local tpm_server swtpm
 
-	swtpm="$(which tpm_server)"
+	tpm_server="$(which tpm_server)"
-	if [ -z "${swtpm}" ]; then
+	swtpm="$(which swtpm)"
-		echo "${CYAN}SKIP: Softare TPM (tpm_server) not found${NORM}"
+	if [ -z "${tpm_server}" ] && [ -z "${swtpm}" ]; then
+		echo "${CYAN}SKIP: Software TPM (tpm_server and swtpm) not found${NORM}"
 		return "$SKIP"
 	fi
 
+	if [ -n "${swtpm}" ]; then
+		pgrep swtpm
+		if [ $? -eq 0 ]; then
+			echo "INFO: Software TPM (swtpm) already running"
+			return 114
+		else
+			echo "INFO: Starting software TPM: ${swtpm}"
+			mkdir -p ./myvtpm
+			${swtpm} socket --tpmstate dir=./myvtpm --tpm2 --ctrl type=tcp,port=2322 --server type=tcp,port=2321 --flags not-need-init > /dev/null 2>&1 &
+			SWTPM_PID=$!
+		fi
+	elif [ -n "${tpm_server}" ]; then
+		# tpm_server uses the Microsoft simulator encapsulated packet format
+		export TPM_SERVER_TYPE="mssim"
 		pgrep tpm_server
 		if [ $? -eq 0 ]; then
 			echo "INFO: Software TPM (tpm_server) already running"
 			return 114
 		else
-		echo "INFO: Starting software TPM: ${swtpm}"
+			echo "INFO: Starting software TPM: ${tpm_server}"
-		${swtpm} > /dev/null 2>&1 &
+			${tpm_server} > /dev/null 2>&1 &
-		SWTPM_PPID=$!
+			TPMSERVER_PID=$!
+		fi
 	fi
 	return 0
 }
@@ -75,8 +80,20 @@ swtpm_init() {
 		return "$SKIP"
 	fi
 
-	echo "INFO: Walking ${BINARY_BIOS_MEASUREMENTS} initializing the software TPM"
+	echo "INFO: Sending software TPM startup"
 	"${TSSDIR}/tssstartup"
+	if [ $? -ne 0 ]; then
+		echo "INFO: Retry sending software TPM startup"
+		sleep 1
+		"${TSSDIR}/tssstartup"
+	fi
+
+	if [ $? -ne 0 ]; then
+		echo "INFO: Software TPM startup failed"
+		return "$SKIP"
+	fi
+
+	echo "INFO: Walking ${BINARY_BIOS_MEASUREMENTS} initializing the software TPM"
 #	$(${TSSDIR}/tsseventextend -tpm -if "${BINARY_BIOS_MEASUREMENTS}" -v) 2>&1 > /dev/null
 	"${TSSDIR}/tsseventextend" -tpm -if "${BINARY_BIOS_MEASUREMENTS}" -v > /dev/null 2>&1
 }
@@ -101,7 +118,7 @@ display_pcrs() {
 	done
 }
 
-# The first entry in the IMA measuremnet list is the "boot_aggregate".
+# The first entry in the IMA measurement list is the "boot_aggregate".
 # For each kexec, an additional "boot_aggregate" will appear in the
 # measurement list, assuming the previous measurement list is carried
 # across the kexec.
@@ -133,6 +150,24 @@ check() {
 	return "$FAIL"
 }
 
+if [ "$(id -u)" = 0 ] && [ -c "/dev/tpm0" ]; then
+	ASCII_RUNTIME_MEASUREMENTS="/sys/kernel/security/ima/ascii_runtime_measurements"
+	if [ ! -d "/sys/kernel/security/ima" ]; then
+		echo "${CYAN}SKIP: CONFIG_IMA not enabled${NORM}"
+		exit "$SKIP"
+	fi
+else
+	BINARY_BIOS_MEASUREMENTS="./sample-binary_bios_measurements-pcrs-8-9"
+	ASCII_RUNTIME_MEASUREMENTS="./sample-ascii_runtime_measurements-pcrs-8-9"
+	export TPM_INTERFACE_TYPE="socsim"
+	export TPM_COMMAND_PORT=2321
+	export TPM_PLATFORM_PORT=2322
+	export TPM_SERVER_NAME="localhost"
+
+	# swtpm uses the raw, unencapsulated packet format
+	export TPM_SERVER_TYPE="raw"
+fi
+
 # Start and initialize a software TPM as needed
 if [ "$(id -u)" != 0 ] || [ ! -c "/dev/tpm0" ]; then
 	if [ -f "$PCRFILE" ] || [ -f "$MISC_PCRFILE" ]; then

tests/install-swtpm.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -ex
+
+version=1637
+
+wget --no-check-certificate https://sourceforge.net/projects/ibmswtpm2/files/ibmtpm${version}.tar.gz/download
+mkdir ibmtpm$version
+cd ibmtpm$version
+tar -xvzf ../download
+cd src
+make -j$(nproc)
+sudo cp tpm_server /usr/local/bin/
+cd ../..

tests/install-tss.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -ex
+git clone https://git.code.sf.net/p/ibmtpm20tss/tss
+cd tss
+autoreconf -i && ./configure --disable-tpm-1.2 --disable-hwtpm && make -j$(nproc) && sudo make install
+cd ..
+rm -rf tss

tests/sign_verify.test

@@ -18,7 +18,14 @@
 cd "$(dirname "$0")" || exit 1
 PATH=../src:$PATH
 source ./functions.sh
-_require evmctl openssl xxd getfattr
+
+_require cmp evmctl getfattr openssl xxd
+
+if cmp -b 2>&1 | grep -q "invalid option"; then
+	echo "cmp does not support -b (cmp from busybox?) Use cmp from diffutils"
+	exit "$HARDFAIL"
+fi
+
 ./gen-keys.sh >/dev/null 2>&1
 
 trap _report_exit EXIT
@@ -93,7 +100,8 @@ _test_sigfile() {
     return "$FAIL"
   fi
 
-  rm "$file_sig" "$file_sig2"
+  # Leave '$file_sig' for ima_verify --sigfile test.
+  rm "$file_sig2"
 }
 
 # Run single sign command
@@ -254,9 +262,12 @@ sign_verify() {
 
     # Normal verify with proper key should pass
     expect_pass check_verify
+    expect_pass check_verify OPTS="--sigfile"
 
     # Multiple files and some don't verify
     expect_fail check_verify FILE="/dev/null $file"
+
+    rm "$FILE.sig"
   fi
 
   TYPE=evm

travis/alpine.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -ex
+
+if [ -z "$CC" ]; then
+	echo "missing \$CC!" >&2
+	exit 1
+fi
+
+case "$TSS" in
+ibmtss) echo "No IBM TSS package, will be installed from git" >&2; TSS=;;
+tpm2-tss) TSS="tpm2-tss-dev";;
+'') echo "Missing TSS!" >&2; exit 1;;
+*) echo "Unsupported TSS: '$TSS'!" >&2; exit 1;;
+esac
+
+# ibmswtpm2 requires gcc
+[ "$CC" = "gcc" ] || CC="gcc $CC"
+
+apk update
+
+apk add \
+	$CC $TSS \
+	asciidoc \
+	attr \
+	attr-dev \
+	autoconf \
+	automake \
+	diffutils \
+	docbook-xml \
+	docbook-xsl \
+	keyutils-dev \
+	libtool \
+	libxslt \
+	linux-headers \
+	make \
+	musl-dev \
+	openssl \
+	openssl-dev \
+	pkgconfig \
+	procps \
+	sudo \
+	wget \
+	which \
+	xxd
+
+if [ ! "$TSS" ]; then
+	apk add git
+	../tests/install-tss.sh
+fi

travis/centos.sh

@@ -0,0 +1 @@
+fedora.sh

travis/debian.cross-compile.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -ex
+
+if [ -z "$ARCH" ]; then
+	echo "missing \$ARCH!" >&2
+	exit 1
+fi
+
+case "$ARCH" in
+arm64) gcc_arch="aarch64";;
+ppc64el) gcc_arch="powerpc64le";;
+s390x) gcc_arch="$ARCH";;
+*) echo "unsupported arch: '$ARCH'!" >&2; exit 1;;
+esac
+
+dpkg --add-architecture $ARCH
+apt update
+
+apt install -y --no-install-recommends \
+	dpkg-dev \
+	gcc-${gcc_arch}-linux-gnu \
+	libc6-dev-${ARCH}-cross

travis/debian.i386.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -ex
+
+dpkg --add-architecture i386
+apt update
+
+apt install -y --no-install-recommends \
+	linux-libc-dev:i386 \
+	gcc-multilib \
+	pkg-config:i386

travis/debian.sh

@@ -0,0 +1,54 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -ex
+
+if [ -z "$CC" ]; then
+	echo "missing \$CC!" >&2
+	exit 1
+fi
+
+# debian.*.sh must be run first
+if [ "$ARCH" ]; then
+	ARCH=":$ARCH"
+	unset CC
+else
+	apt update
+fi
+
+# ibmswtpm2 requires gcc
+[ "$CC" = "gcc" ] || CC="gcc $CC"
+
+case "$TSS" in
+ibmtss) TSS="libtss-dev";;
+tpm2-tss) TSS="libtss2-dev";;
+'') echo "Missing TSS!" >&2; exit 1;;
+*) [ "$TSS" ] && echo "Unsupported TSS: '$TSS'!" >&2; exit 1;;
+esac
+
+apt="apt install -y --no-install-recommends"
+
+$apt \
+	$CC $TSS \
+	asciidoc \
+	attr \
+	autoconf \
+	automake \
+	diffutils \
+	debianutils \
+	docbook-xml \
+	docbook-xsl \
+	gzip \
+	libattr1-dev$ARCH \
+	libkeyutils-dev$ARCH \
+	libssl-dev$ARCH \
+	libtool \
+	make \
+	openssl \
+	pkg-config \
+	procps \
+	sudo \
+	wget \
+	xsltproc \
+
+$apt xxd || $apt vim-common
+$apt libengine-gost-openssl1.1$ARCH || true

travis/fedora.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -e
+
+if [ -z "$CC" ]; then
+	echo "missing \$CC!" >&2
+	exit 1
+fi
+
+case "$TSS" in
+ibmtss) TSS="tss2-devel";;
+tpm2-tss) TSS="tpm2-tss-devel";;
+'') echo "Missing TSS!" >&2; exit 1;;
+*) echo "Unsupported TSS: '$TSS'!" >&2; exit 1;;
+esac
+
+# ibmswtpm2 requires gcc
+[ "$CC" = "gcc" ] || CC="gcc $CC"
+
+yum -y install \
+	$CC $TSS \
+	asciidoc \
+	attr \
+	autoconf \
+	automake \
+	diffutils \
+	docbook-xsl \
+	gzip \
+	keyutils-libs-devel \
+	libattr-devel \
+	libtool \
+	libxslt \
+	make \
+	openssl \
+	openssl-devel \
+	pkg-config \
+	procps \
+	sudo \
+	vim-common \
+	wget \
+	which
+
+yum -y install docbook5-style-xsl || true
+yum -y install swtpm || true

travis/opensuse.sh

@@ -0,0 +1 @@
+tumbleweed.sh

travis/tumbleweed.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -ex
+
+if [ -z "$CC" ]; then
+	echo "missing \$CC!" >&2
+	exit 1
+fi
+
+case "$TSS" in
+ibmtss) TSS="ibmtss-devel";;
+tpm2-tss) TSS="tpm2-0-tss-devel";;
+'') echo "Missing TSS!" >&2; exit 1;;
+*) echo "Unsupported TSS: '$TSS'!" >&2; exit 1;;
+esac
+
+# clang has some gcc dependency
+[ "$CC" = "gcc" ] || CC="gcc $CC"
+
+zypper --non-interactive install --force-resolution --no-recommends \
+	$CC $TSS \
+	asciidoc \
+	attr \
+	autoconf \
+	automake \
+	diffutils \
+	docbook_5 \
+	docbook5-xsl-stylesheets \
+	gzip \
+	ibmswtpm2 \
+	keyutils-devel \
+	libattr-devel \
+	libopenssl-devel \
+	libtool \
+	make \
+	openssl \
+	pkg-config \
+	procps \
+	sudo \
+	vim \
+	wget \
+	which \
+	xsltproc
+
+if [ -f /usr/lib/ibmtss/tpm_server ]; then
+	ln -s /usr/lib/ibmtss/tpm_server /usr/local/bin
+fi

travis/ubuntu.sh

@@ -0,0 +1 @@
+debian.sh