dh/ima-evm-utils
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Provide command parameter to include extra SMACK xattrs for EVM signature

Browse Source 
Latest versions of smack uses additional xattrs. This patch adds them to
EVM protection. Linux kernel configuration option CONFIG_EVM_EXTRA_SMACK_XATTRS
has to be enabled.

Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
This commit is contained in:
Dmitry Kasatkin 2014-09-17 13:57:04 +03:00
parent 6261753e1e
commit a99a8a517c
1 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/evmctl.c
View File

@ -65,7 +65,7 @@
#include "imaevm.h" #include "imaevm.h"
static char *evm_config_xattrnames[] = { static char *evm_default_xattrs[] = {
XATTR_NAME_SELINUX, XATTR_NAME_SELINUX,
XATTR_NAME_SMACK, XATTR_NAME_SMACK,
XATTR_NAME_IMA, XATTR_NAME_IMA,
@ -73,6 +73,19 @@ static char *evm_config_xattrnames[] = {
NULL NULL
}; };
static char *evm_extra_smack_xattrs[] = {
XATTR_NAME_SELINUX,
XATTR_NAME_SMACK,
XATTR_NAME_SMACKEXEC,
XATTR_NAME_SMACKTRANSMUTE,
XATTR_NAME_SMACKMMAP,
XATTR_NAME_IMA,
XATTR_NAME_CAPS,
NULL
};
static char **evm_config_xattrnames = evm_default_xattrs;
struct command { struct command {
char *name; char *name;
int (*func)(struct command *cmd); int (*func)(struct command *cmd);
@ -1460,6 +1473,7 @@ static void usage(void)
" m - stay on the same filesystem (like 'find -xdev')\n" " m - stay on the same filesystem (like 'find -xdev')\n"
" -n print result to stdout instead of setting xattr\n" " -n print result to stdout instead of setting xattr\n"
" -u, --uuid use custom FS UUID for EVM (unspecified: from FS, empty: do not use)\n" " -u, --uuid use custom FS UUID for EVM (unspecified: from FS, empty: do not use)\n"
" --smack use extra SMACK xattrs for EVM\n"
" --m32 force EVM hmac/signature for 32 bit target system\n" " --m32 force EVM hmac/signature for 32 bit target system\n"
" --m64 force EVM hmac/signature for 64 bit target system\n" " --m64 force EVM hmac/signature for 64 bit target system\n"
" -v increase verbosity level\n" " -v increase verbosity level\n"
@ -1498,6 +1512,7 @@ static struct option opts[] = {
{"recursive", 0, 0, 'r'}, {"recursive", 0, 0, 'r'},
{"m32", 0, 0, '3'}, {"m32", 0, 0, '3'},
{"m64", 0, 0, '6'}, {"m64", 0, 0, '6'},
{"smack", 0, 0, 256},
{} {}
}; };
@ -1568,6 +1583,9 @@ int main(int argc, char *argv[])
case '6': case '6':
msize = 64; msize = 64;
break; break;
case 256:
evm_config_xattrnames = evm_extra_smack_xattrs;
break;
case '?': case '?':
exit(1); exit(1);
break; break;