Added RPM and TAR building rules

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>

COPYING

@@ -1,340 +0,0 @@
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-     59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			    NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-	    How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year  name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Library General
-Public License instead of this License.

ChangeLog

@@ -1,25 +1,3 @@
-2012-05-18  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
-
-	version 0.3
-	* llistxattr returns 0 if there are no xattrs and it is valid
-	* Added entry type to directory hash calculation
-	* inline block variable renamed
-	* Remove forced tag creation
-	* Use libexec for programs and scripts
-	* Some files updated
-	* Do not search for algorithm as it is known
-	* Refactored to remove redundant hash initialization code
-	* Added hash calculation for special files
-
-2012-04-05  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
-
-	version 0.2
-	* added RPM & TAR building makefile rules
-	* renamed evm-utils to ima-evm-utils
-	* added command options description
-	* updated error handling
-	* refactored redundant code
-
 2012-04-02  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
 
 	version 0.1.0

INSTALL

@@ -1,8 +1,8 @@
 Installation Instructions
 *************************
 
-Copyright (C) 1994-1996, 1999-2002, 2004-2011 Free Software Foundation,
+Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005,
-Inc.
+2006, 2007, 2008, 2009 Free Software Foundation, Inc.
 
    Copying and distribution of this file, with or without modification,
 are permitted in any medium without royalty provided the copyright
@@ -226,11 +226,6 @@ order to use an ANSI C compiler:
 
 and if that doesn't work, install pre-built binaries of GCC for HP-UX.
 
-   HP-UX `make' updates targets which have the same time stamps as
-their prerequisites, which makes it generally unusable when shipped
-generated files such as `configure' are involved.  Use GNU `make'
-instead.
-
    On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot
 parse its `<wchar.h>' header file.  The option `-nodtk' can be used as
 a workaround.  If GNU CC is not installed, it is therefore recommended

Makefile.am

@@ -1,4 +1,4 @@
-SUBDIRS = src
+SUBDIRS = src tests
 
 #EXTRA_DIST = LEGAL acinclude.m4 include
 
@@ -11,7 +11,8 @@ pkgname = $(PACKAGE_NAME)-$(PACKAGE_VERSION)
 tarname = $(pkgname).tar.gz
 
 $(tarname):
-	git archive --format=tar --prefix=$(pkgname)/ v$(PACKAGE_VERSION) $(FILES) | gzip >$@
+	git tag -f v$(PACKAGE_VERSION)
+	git archive --format=tar --prefix=$(pkgname)/ v$(PACKAGE_VERSION) $(FILES) | gzip >$@;
 
 tar: $(tarname)
 

README

@@ -1,79 +1,52 @@
-ima-evm-utils - IMA/EVM signing utility
-=========================================
 
-Contents:
+1. Generate private key
 
-   1. Key generation
+# plain key
-   2. Initialization
+openssl genrsa -out privkey_evm.pem 1024
-   3. Signing
 
+# encrypted key
+openssl genrsa -des3 -out privkey_evm.pem 1024
 
-Key generation
+# set password for the key
---------------
+openssl rsa -in /etc/keys/privkey_evm.pem -out privkey_evm_enc.pem -des3
+or
+openssl pkcs8 -topk8 -in /etc/keys/privkey_evm.pem -out privkey_evm_enc.pem
 
-Generate private key in plain text format
+2. Generate public key
 
-    $ openssl genrsa -out privkey_evm.pem 1024
+openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem
 
-Generate encrypted private key
+3. Copy public (+private if to sign on device) key to the device/qemu /etc/keys
 
-    $ openssl genrsa -des3 -out privkey_evm.pem 1024
+scp pubkey_evm.pem mad:/etc/keys
 
-Make encrypted private key from unencrypted
+4. Load keys and enable EVM
 
-    $ openssl rsa -in /etc/keys/privkey_evm.pem -out privkey_evm_enc.pem -des3
+evm_enable.sh
 
-Get public key
+This should be done at early phase, before mounting root filesystem.
 
-    $ openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem
+5. Sign EVM and use hash value for IMA - common case
 
-Copy keys to /etc/keys
+evmctl sign --imahash test.txt
 
-    $ cp pubkey_evm.pem /etc/keys
+6. Sign IMA and EVM - for immutable files and modules
-    $ scp pubkey_evm.pem target:/etc/keys
 
+evmctl sign --imasig test.txt
 
-Initialization
+7. Sign whole filesystem
---------------
 
-IMA/EVM initialization should be normally done from initial RAM file system
+evm_sign_all.sh
-before mounting root filesystem.
+or
+find / \( -fstype rootfs -o -fstype ext3 -o -fstype ext4 \) ! -path "/lib/modules/*" -type f -uid 0 -exec evmctl sign --imahash '{}' \;
+find /lib/modules ! -name "*.ko" -type f -uid 0 -exec evmctl sign --imahash '{}' \;
+# security.ima needs to have signature for modules
+find /lib/modules -name "*.ko" -type f -uid 0 -exec evmctl sign --imasig '{}' \;
 
-Here is an example script /etc/initramfs-tools/scripts/local-top/ima.sh
+# generate signatures in .sig files
+find /lib/modules -name "*.ko" -type f -uid 0 -exec evmctl -n --sigfile ima_sign '{}' \;
 
-    # import EVM HMAC key
+8. Label filesystem in fix mode...
-    keyctl clear @u
-    keyctl add user kmk "testing123" @u
-    keyctl add encrypted evm-key "load `cat /etc/keys/evm-key`" @u
 
-    # import IMA public key
+ima_fix_dir.sh <dir>
-    ima_id=`keyctl newring _ima @u`
-    evmctl import /etc/keys/pubkey_evm.pem $ima_id
-
-    # import EVM public key
-    evm_id=`keyctl newring _evm @u`
-    evmctl import /etc/keys/pubkey_evm.pem $evm_id
-
-    # enable EVM
-    echo "1" > /sys/kernel/security/evm
-
-
-Signing
--------
-
-Sign file with EVM signature and use hash value for IMA - common case
-
-    $ evmctl sign --imahash test.txt
-
-Sign file with both IMA and EVM signatures - for immutable files
-
-    $ evmctl sign --imasig test.txt
-
-Label whole filesystem with EVM signatures
-
-    $ find / \( -fstype rootfs -o -fstype ext4 \) -exec evmctl sign --imahash '{}' \;
-
-Label filesystem in fix mode - kernel sets correct values to IMA and EVM xattrs
-
-    $ find / \( -fstype rootfs -o -fstype ext4 \) -exec sh -c "< '{}'" \;
 

configure.ac

@@ -1,7 +1,7 @@
 # autoconf script
 
 AC_PREREQ([2.65])
-AC_INIT(ima-evm-utils, 0.3, dmitry.kasatkin@intel.com)
+AC_INIT(ima-evm-utils, 0.1.1, dmitry.kasatkin@intel.com)
 AM_INIT_AUTOMAKE(AC_PACKAGE_NAME, AC_PACKAGE_VERSION)
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
@@ -46,6 +46,7 @@ fi
 
 AC_CONFIG_FILES([Makefile
 		src/Makefile
+		tests/Makefile
 		ima-evm-utils.spec
 		])
 AC_OUTPUT

src/evmctl.c

@@ -144,14 +144,12 @@ static int verbose = LOG_INFO - 1;
 static int g_argc;
 static char **g_argv;
 static int xattr = 1;
-static int sigdump;
 static int digest;
 static int digsig;
 static char *hash_algo = "sha1";
 static int binkey;
 static char *keypass;
 static int sigfile;
-static int modsig;
 
 struct command cmds[];
 static void print_usage(struct command *cmd);
@@ -210,24 +208,16 @@ static int bin2file(const char *file, const char *ext, const unsigned char *data
 	return err;
 }
 
-static unsigned char *file2bin(const char *file, const char *ext, int *size)
+static unsigned char *file2bin(const char *file, int *size)
 {
 	FILE *fp;
 	int len;
 	unsigned char *data;
-	char name[strlen(file) + (ext ? strlen(ext) : 0) + 2];
 
-	if (ext)
+	len = get_filesize(file);
-		sprintf(name, "%s.%s", file, ext);
+	fp = fopen(file, "r");
-	else
-		sprintf(name, "%s", file);
-
-	log_info("Reading to %s\n", name);
-
-	len = get_filesize(name);
-	fp = fopen(name, "r");
 	if (!fp) {
-		log_err("Unable to open %s\n", name);
+		log_err("Unable to open %s\n", file);
 		return NULL;
 	}
 	data = malloc(len);
@@ -376,7 +366,7 @@ static int sign_hash(const unsigned char *hash, int size, const char *keyfile, u
 	*blen = __cpu_to_be16(len << 3);
 	len += sizeof(*hdr) + 2;
 	log_info("evm/ima signature: %d bytes\n", len);
-	if (sigdump || verbose >= LOG_INFO)
+	if (!xattr || verbose >= LOG_INFO)
 		dump(sig, len);
 
 	return len;
@@ -400,6 +390,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
 	int fd, err;
 	uint32_t generation;
 	EVP_MD_CTX ctx;
+	const EVP_MD *md;
 	unsigned int mdlen;
 	char **xattrname;
 	char xattr_value[1024];
@@ -427,12 +418,18 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
 	log_info("generation: %u\n", generation);
 
 	list_size = llistxattr(file, list, sizeof(list));
-	if (list_size < 0) {
+	if (list_size <= 0) {
 		log_err("llistxattr() failed\n");
 		return -1;
 	}
 
-	err = EVP_DigestInit(&ctx, EVP_sha1());
+	md = EVP_get_digestbyname("sha1");
+	if (!md) {
+		log_err("EVP_get_digestbyname() failed\n");
+		return 1;
+	}
+
+	err = EVP_DigestInit(&ctx, md);
 	if (!err) {
 		log_err("EVP_DigestInit() failed\n");
 		return 1;
@@ -504,11 +501,14 @@ static int sign_evm(const char *file, const char *key)
 	return 0;
 }
 
-static int add_file_hash(const char *file, EVP_MD_CTX *ctx)
+static int calc_file_hash(const char *file, uint8_t *hash)
 {
+	EVP_MD_CTX ctx;
+	const EVP_MD *md;
 	uint8_t *data;
 	int err, size, bs = DATA_SIZE;
 	size_t len;
+	unsigned int mdlen;
 	FILE *fp;
 
 	data = malloc(bs);
@@ -523,6 +523,18 @@ static int add_file_hash(const char *file, EVP_MD_CTX *ctx)
 		return -1;
 	}
 
+	md = EVP_get_digestbyname(hash_algo);
+	if (!md) {
+		log_err("EVP_get_digestbyname() failed\n");
+		return 1;
+	}
+
+	err = EVP_DigestInit(&ctx, md);
+	if (!err) {
+		log_err("EVP_DigestInit() failed\n");
+		return 1;
+	}
+
 	for (size = get_fdsize(fileno(fp)); size; size -= len) {
 		len = MIN(size, bs);
 		err = fread(data, len, 1, fp);
@@ -533,26 +545,41 @@ static int add_file_hash(const char *file, EVP_MD_CTX *ctx)
 			}
 			break;
 		}
-		err = EVP_DigestUpdate(ctx, data, len);
+		err = EVP_DigestUpdate(&ctx, data, len);
 		if (!err) {
 			log_err("EVP_DigestUpdate() failed\n");
 			return 1;
 		}
 	}
 
+	err = EVP_DigestFinal(&ctx, hash, &mdlen);
+	if (!err) {
+		log_err("EVP_DigestFinal() failed\n");
+		return 1;
+	}
+
 	fclose(fp);
+
 	free(data);
 
-	return 0;
+	return mdlen;
 }
 
-static int add_dir_hash(const char *file, EVP_MD_CTX *ctx)
+struct dirent_list {
+	struct dirent_list *next;
+	struct dirent de;
+};
+
+static int calc_dir_hash(const char *file, uint8_t *hash)
 {
+	EVP_MD_CTX ctx;
+	const EVP_MD *md;
 	int err;
+	unsigned int mdlen;
 	struct dirent *de;
 	DIR *dir;
-	unsigned long long ino, off;
+	struct dirent_list *head = NULL, *pos, *prev, *cur;
-	unsigned int type;
+	uint64_t ino;
 
 	dir = opendir(file);
 	if (!dir) {
@@ -560,64 +587,6 @@ static int add_dir_hash(const char *file, EVP_MD_CTX *ctx)
 		return -1;
 	}
 
-	while ((de = readdir(dir))) {
-		ino = de->d_ino;
-		off = de->d_off;
-		type = de->d_type;
-		log_debug("entry: %s, ino: %llu, type: %u, off: %llu, reclen: %hu\n",
-			  de->d_name, ino, type, off, de->d_reclen);
-		err = EVP_DigestUpdate(ctx, de->d_name, strlen(de->d_name));
-		/*err |= EVP_DigestUpdate(ctx, &off, sizeof(off));*/
-		err |= EVP_DigestUpdate(ctx, &ino, sizeof(ino));
-		err |= EVP_DigestUpdate(ctx, &type, sizeof(type));
-		if (!err) {
-			log_err("EVP_DigestUpdate() failed\n");
-			return 1;
-		}
-	}
-
-	closedir(dir);
-
-	return 0;
-}
-
-static int add_link_hash(const char *path, EVP_MD_CTX *ctx)
-{
-	int err;
-	char buf[1024];
-
-	err = readlink(path, buf, sizeof(buf));
-	if (err <= 0)
-		return -1;
-
-	log_info("link: %s -> %.*s\n", path, err, buf);
-	return !EVP_DigestUpdate(ctx, buf, err);
-}
-
-static int add_dev_hash(struct stat *st, EVP_MD_CTX *ctx)
-{
-	uint32_t dev = st->st_rdev;
-	unsigned major = (dev & 0xfff00) >> 8;
-	unsigned minor = (dev & 0xff) | ((dev >> 12) & 0xfff00);
-	log_info("device: %u:%u\n", major, minor);
-	return !EVP_DigestUpdate(ctx, &dev, sizeof(dev));
-}
-
-static int calc_hash(const char *file, uint8_t *hash)
-{
-	struct stat st;
-	EVP_MD_CTX ctx;
-	const EVP_MD *md;
-	unsigned int mdlen;
-	int err;
-
-	/*  Need to know the file length */
-	err = lstat(file, &st);
-	if (err < 0) {
-		log_err("stat() failed\n");
-		return err;
-	}
-
 	md = EVP_get_digestbyname(hash_algo);
 	if (!md) {
 		log_err("EVP_get_digestbyname() failed\n");
@@ -630,27 +599,37 @@ static int calc_hash(const char *file, uint8_t *hash)
 		return 1;
 	}
 
-	switch (st.st_mode & S_IFMT) {
+	while ((de = readdir(dir))) {
-	case S_IFREG:
+		/*log_debug("entry: ino: %lu, %s\n", de->d_ino, de->d_name);*/
-		err = add_file_hash(file, &ctx);
+		for (prev = NULL, pos = head; pos; prev = pos, pos = pos->next) {
+			if (de->d_ino < pos->de.d_ino)
 				break;
-	case S_IFDIR:
+		}
-		err = add_dir_hash(file, &ctx);
+		cur = malloc(sizeof(*cur));
-		break;
+		cur->de = *de;
-	case S_IFLNK:
+		cur->next = pos;
-		err = add_link_hash(file, &ctx);
+		if (!head || !prev)
-		break;
+			head = cur;
-	case S_IFIFO: case S_IFSOCK:
+		else
-	case S_IFCHR: case S_IFBLK:
+			prev->next = cur;
-		err = add_dev_hash(&st, &ctx);
-		break;
-	default:
-		log_errno("Unsupported file type");
-		return -1;
 	}
 
-	if (err)
+	for (cur = head; cur; cur = pos) {
-		return err;
+		pos = cur->next;
+		ino = cur->de.d_ino;
+		log_debug("entry: ino: %llu, %s\n", (unsigned long long)ino, cur->de.d_name);
+		err = EVP_DigestUpdate(&ctx, cur->de.d_name, strlen(cur->de.d_name));
+		if (!err) {
+			log_err("EVP_DigestUpdate() failed\n");
+			return 1;
+		}
+		err = EVP_DigestUpdate(&ctx, &ino, sizeof(ino));
+		if (!err) {
+			log_err("EVP_DigestUpdate() failed\n");
+			return 1;
+		}
+		free(cur);
+	}
 
 	err = EVP_DigestFinal(&ctx, hash, &mdlen);
 	if (!err) {
@@ -658,6 +637,8 @@ static int calc_hash(const char *file, uint8_t *hash)
 		return 1;
 	}
 
+	closedir(dir);
+
 	return mdlen;
 }
 
@@ -665,15 +646,26 @@ static int hash_ima(const char *file)
 {
 	unsigned char hash[65] = "\x01"; /* MAX hash size + 1 */
 	int len, err;
+	struct stat st;
 
-	len = calc_hash(file, hash + 1);
+	/*  Need to know the file length */
+	err = stat(file, &st);
+	if (err < 0) {
+		log_err("stat() failed\n");
+		return err;
+	}
+
+	if (S_ISDIR(st.st_mode))
+		len = calc_dir_hash(file, hash + 1);
+	else
+		len = calc_file_hash(file, hash + 1);
 	if (len <= 1)
 		return len;
 
 	if (verbose >= LOG_INFO)
 		log_info("hash: ");
 
-	if (sigdump || verbose >= LOG_INFO)
+	if (!xattr || verbose >= LOG_INFO)
 		dump(hash, len + 1);
 
 	if (xattr) {
@@ -704,10 +696,9 @@ static int sign_ima(const char *file, const char *key)
 {
 	unsigned char hash[64];
 	unsigned char sig[1024] = "\x03";
-	char magic[] = "This Is A Crypto Signed Module";
 	int len, err;
 
-	len = calc_hash(file, hash);
+	len = calc_file_hash(file, hash);
 	if (len <= 1)
 		return len;
 
@@ -715,24 +706,11 @@ static int sign_ima(const char *file, const char *key)
 	if (len <= 1)
 		return len;
 
-	/* add header */
-	len++;
-
-	if (modsig) {
-		/* add signature length */
-		*(uint16_t *)(sig + len) = __cpu_to_be16(len - 1);
-		len += sizeof(uint16_t);
-		memcpy(sig + len, magic, sizeof(magic) - 1);
-		len += sizeof(magic) - 1;
-		bin2file(file, "sig", sig + 1, len - 1);
-		return 0;
-	}
-
 	if (sigfile)
-		bin2file(file, "sig", sig + 1, len - 1);
+		bin2file(file, "sig", sig, len + 1);
 
 	if (xattr) {
-		err = setxattr(file, "security.ima", sig, len, 0);
+		err = setxattr(file, "security.ima", sig, len + 1, 0);
 		if (err < 0) {
 			log_err("setxattr failed: %s\n", file);
 			return err;
@@ -889,56 +867,6 @@ static int cmd_verify_evm(struct command *cmd)
 	return verify_evm(file, key);
 }
 
-static int verify_ima(const char *file, const char *key)
-{
-	unsigned char hash[20];
-	unsigned char sig[1024];
-	int len;
-
-	len = calc_hash(file, hash);
-	if (len <= 1)
-		return len;
-
-	if (xattr) {
-		len = getxattr(file, "security.ima", sig, sizeof(sig));
-		if (len < 0) {
-			log_err("getxattr failed\n");
-			return len;
-		}
-	}
-
-	if (sigfile) {
-		void *tmp;
-		tmp = file2bin(file, "sig", &len);
-		memcpy(sig, tmp, len);
-		free(tmp);
-	}
-
-	if (sig[0] != 0x03) {
-		log_err("security.ima has no signature\n");
-		return -1;
-	}
-
-	return verify_hash(hash, sizeof(hash), sig + 1, len - 1, key);
-}
-
-static int cmd_verify_ima(struct command *cmd)
-{
-	char *key, *file = g_argv[optind++];
-
-	if (!file) {
-		log_err("Parameters missing\n");
-		print_usage(cmd);
-		return -1;
-	}
-
-	key = g_argv[optind++];
-	if (!key)
-		key = "/etc/keys/pubkey_evm.pem";
-
-	return verify_ima(file, key);
-}
-
 static int cmd_convert(struct command *cmd)
 {
 	char *inkey, *outkey = NULL;
@@ -992,7 +920,7 @@ static int cmd_import(struct command *cmd)
 		id = atoi(ring);
 
 	if (binkey) {
-		key = file2bin(inkey, NULL, &len);
+		key = file2bin(inkey, &len);
 		if (!key)
 			return -1;
 	} else {
@@ -1037,7 +965,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
 	char list[1024];
 	ssize_t list_size;
 
-	key = file2bin(keyfile, NULL, &keylen);
+	key = file2bin(keyfile, &keylen);
 	if (!key) {
 		log_err("Unable to read a key: %s\n\n", keyfile);
 		return -1;
@@ -1263,7 +1191,6 @@ static void usage(void)
 		"  -s, --imasig       also make IMA signature\n"
 		"  -d, --imahash      also make IMA hash\n"
 		"  -f, --sigfile      store IMA signature in .sig file instead of xattr\n"
-		"  -m, --modsig       store module signature in .sig file instead of xattr\n"
 		"  -b, --bin          signing key is in binary format\n"
 		"  -p, --pass         password for encrypted signing key\n"
 		"  -n                 print result to stdout instead of setting xattr\n"
@@ -1278,8 +1205,7 @@ struct command cmds[] = {
 	{"convert", cmd_convert, 0, "inkey outkey", "Convert PEM public key into IMA/EVM kernel friendly format.\n"},
 	{"sign", cmd_sign_evm, 0, "[--imahash | --imasig ] [--pass password] file [key]", "Sign file metadata.\n"},
 	{"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"},
-	{"ima_sign", cmd_sign_ima, 0, "[--sigfile | --modsig] [--pass password] file [key]", "Make file content signature.\n"},
+	{"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--pass password] file [key]", "Make file content signature.\n"},
-	{"ima_verify", cmd_verify_ima, 0, "file  [key]", "Verify IMA signature (for debugging).\n"},
 	{"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"},
 #ifdef DEBUG
 	{"hmac", cmd_hmac_evm, 0, "[--imahash | --imasig ] file [key]", "Sign file metadata with HMAC using symmetric key (for testing purpose).\n"},
@@ -1295,7 +1221,6 @@ static struct option opts[] = {
 	{"bin", 0, 0, 'b'},
 	{"pass", 1, 0, 'p'},
 	{"sigfile", 0, 0, 'f'},
-	{"modsig", 0, 0, 'm'},
 	{}
 
 };
@@ -1329,7 +1254,6 @@ int main(int argc, char *argv[])
 		case 'n':
 			/* do not set Extended Attributes... just print signature */
 			xattr = 0;
-			sigdump = 1;
 			break;
 		case 'a':
 			hash_algo = optarg;
@@ -1342,11 +1266,6 @@ int main(int argc, char *argv[])
 			break;
 		case 'f':
 			sigfile = 1;
-			xattr = 0;
-			break;
-		case 'm':
-			modsig = 1;
-			xattr = 0;
 			break;
 		case '?':
 			exit(1);
@@ -1365,14 +1284,14 @@ int main(int argc, char *argv[])
 		err = call_command(cmds, argv[optind++]);
 
 	if (err) {
-		unsigned long error;
+		unsigned long err;
 		if (errno)
 			log_err("errno: %s (%d)\n", strerror(errno), errno);
 		for (;;) {
-			error = ERR_get_error();
+			err = ERR_get_error();
-			if (!error)
+			if (!err)
 				break;
-			log_err("%s\n", ERR_error_string(error, NULL));
+			log_err("%s\n", ERR_error_string(err, NULL));
 		}
 	}
 

tests/Makefile.am

@@ -0,0 +1,7 @@
+pkglib_PROGRAMS = openclose
+
+openclose_SOURCES = openclose.c
+
+dist_pkglib_SCRIPTS = evm_enable.sh evm_genkey.sh evm_sign_all.sh evm_sign_modules.sh ima_fix_dir.sh \
+			evm_hmac_all.sh evm_hmac_modules.sh
+

tests/evm_enable.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+# import EVM HMAC key
+keyctl clear @u
+keyctl add user kmk "testing123" @u
+keyctl add encrypted evm-key "load `cat /etc/keys/evm-key`" @u
+
+# import Moule public key
+mod_id=`keyctl newring _module @u`
+evmctl import /etc/keys/pubkey_evm.pem $mod_id
+
+# import IMA public key
+ima_id=`keyctl newring _ima @u`
+evmctl import /etc/keys/pubkey_evm.pem $ima_id
+
+# import EVM public key
+evm_id=`keyctl newring _evm @u`
+evmctl import /etc/keys/pubkey_evm.pem $evm_id
+
+# enable EVM
+echo "1" > /sys/kernel/security/evm
+
+# enable module checking
+echo "1" > /sys/kernel/security/ima/module_check
+

tests/evm_genkey.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+keyctl add user kmk "testing123" @u
+key=`keyctl add encrypted evm-key "new user:kmk 32" @u`
+keyctl print $key >/etc/keys/evm-key
+
+keyctl list @u
+

tests/evm_hmac_all.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+verbose=""
+if [ "$1" = "-v" ] ; then
+	verbose="-v"
+	shift 1
+fi
+
+dir=${1:-/}
+
+echo "Label: $dir"
+
+find $dir \( -fstype rootfs -o -fstype ext3 -o -fstype ext4 \) \( -type f -o -type d \) -exec evmctl hmac --imahash $verbose '{}' \;
+

tests/evm_hmac_modules.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+verbose=""
+if [ "$1" = "-v" ] ; then
+	verbose="-v"
+	shift 1
+fi
+
+dir=${1:-/lib/modules}
+
+echo "HMAC modules: $dir"
+
+find $dir -name "*.ko" -type f -exec evmctl hmac --imasig $verbose '{}' \;
+

tests/evm_sign_all.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+verbose=""
+if [ "$1" = "-v" ] ; then
+	verbose="-v"
+	shift 1
+fi
+
+dir=${1:-/}
+
+echo "Label: $dir"
+
+find $dir \( -fstype rootfs -o -fstype ext3 -o -fstype ext4 \) -type f -exec evmctl sign --imahash $verbose '{}' \;
+

tests/evm_sign_modules.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+verbose=""
+if [ "$1" = "-v" ] ; then
+	verbose="-v"
+	shift 1
+fi
+
+dir=${1:-/lib/modules}
+
+echo "Signing modules: $dir"
+
+find $dir -name "*.ko" -type f -exec evmctl sign --imasig $verbose '{}' \;
+

tests/ima_fix_dir.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+dir=${1:-/}
+
+echo "Fixing dir: $dir"
+
+find $dir \( -fstype rootfs -o -fstype ext3 -o -fstype ext4 \) -type f -exec openclose '{}' \;
+

tests/openclose.c

@@ -0,0 +1,20 @@
+#include <unistd.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <stdlib.h>
+
+int main(int argc, char *argv[])
+{
+	int fd;
+
+	fd = open(argv[1], O_RDONLY);
+	if (fd < 0) {
+		perror("open()");
+		exit(1);
+	}
+
+	close(fd);
+
+	return 0;
+}
+