Compare commits
20 Commits
Author | SHA1 | Date | |
---|---|---|---|
510061c2b8 | |||
7b0cbf5e53 | |||
776183a642 | |||
c3d090abba | |||
bb79f7aaf2 | |||
a3c7609b80 | |||
d70816cbf1 | |||
c6c8cccb83 | |||
94de24e5ad | |||
3f2f98aef8 | |||
ae47101134 | |||
d98e4a9bed | |||
179664d7e9 | |||
c440d2d95f | |||
fed7fb6933 | |||
78494ab370 | |||
192f897b8e | |||
0799e24820 | |||
c94a0b9262 | |||
e2da6956c4 |
5
AUTHORS
5
AUTHORS
@ -1,5 +1,2 @@
|
|||||||
Dmitry Kasatkin <d.kasatkin@samsung.com>
|
Dmitry Kasatkin <dmitry.kasatkin@intel.com>
|
||||||
|
|
||||||
CONTRIBUTORS:
|
|
||||||
Vivek Goyal <vgoyal@redhat.com>
|
|
||||||
|
|
||||||
|
340
COPYING
340
COPYING
@ -1,340 +0,0 @@
|
|||||||
GNU GENERAL PUBLIC LICENSE
|
|
||||||
Version 2, June 1991
|
|
||||||
|
|
||||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
|
||||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
||||||
Everyone is permitted to copy and distribute verbatim copies
|
|
||||||
of this license document, but changing it is not allowed.
|
|
||||||
|
|
||||||
Preamble
|
|
||||||
|
|
||||||
The licenses for most software are designed to take away your
|
|
||||||
freedom to share and change it. By contrast, the GNU General Public
|
|
||||||
License is intended to guarantee your freedom to share and change free
|
|
||||||
software--to make sure the software is free for all its users. This
|
|
||||||
General Public License applies to most of the Free Software
|
|
||||||
Foundation's software and to any other program whose authors commit to
|
|
||||||
using it. (Some other Free Software Foundation software is covered by
|
|
||||||
the GNU Library General Public License instead.) You can apply it to
|
|
||||||
your programs, too.
|
|
||||||
|
|
||||||
When we speak of free software, we are referring to freedom, not
|
|
||||||
price. Our General Public Licenses are designed to make sure that you
|
|
||||||
have the freedom to distribute copies of free software (and charge for
|
|
||||||
this service if you wish), that you receive source code or can get it
|
|
||||||
if you want it, that you can change the software or use pieces of it
|
|
||||||
in new free programs; and that you know you can do these things.
|
|
||||||
|
|
||||||
To protect your rights, we need to make restrictions that forbid
|
|
||||||
anyone to deny you these rights or to ask you to surrender the rights.
|
|
||||||
These restrictions translate to certain responsibilities for you if you
|
|
||||||
distribute copies of the software, or if you modify it.
|
|
||||||
|
|
||||||
For example, if you distribute copies of such a program, whether
|
|
||||||
gratis or for a fee, you must give the recipients all the rights that
|
|
||||||
you have. You must make sure that they, too, receive or can get the
|
|
||||||
source code. And you must show them these terms so they know their
|
|
||||||
rights.
|
|
||||||
|
|
||||||
We protect your rights with two steps: (1) copyright the software, and
|
|
||||||
(2) offer you this license which gives you legal permission to copy,
|
|
||||||
distribute and/or modify the software.
|
|
||||||
|
|
||||||
Also, for each author's protection and ours, we want to make certain
|
|
||||||
that everyone understands that there is no warranty for this free
|
|
||||||
software. If the software is modified by someone else and passed on, we
|
|
||||||
want its recipients to know that what they have is not the original, so
|
|
||||||
that any problems introduced by others will not reflect on the original
|
|
||||||
authors' reputations.
|
|
||||||
|
|
||||||
Finally, any free program is threatened constantly by software
|
|
||||||
patents. We wish to avoid the danger that redistributors of a free
|
|
||||||
program will individually obtain patent licenses, in effect making the
|
|
||||||
program proprietary. To prevent this, we have made it clear that any
|
|
||||||
patent must be licensed for everyone's free use or not licensed at all.
|
|
||||||
|
|
||||||
The precise terms and conditions for copying, distribution and
|
|
||||||
modification follow.
|
|
||||||
|
|
||||||
GNU GENERAL PUBLIC LICENSE
|
|
||||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
|
||||||
|
|
||||||
0. This License applies to any program or other work which contains
|
|
||||||
a notice placed by the copyright holder saying it may be distributed
|
|
||||||
under the terms of this General Public License. The "Program", below,
|
|
||||||
refers to any such program or work, and a "work based on the Program"
|
|
||||||
means either the Program or any derivative work under copyright law:
|
|
||||||
that is to say, a work containing the Program or a portion of it,
|
|
||||||
either verbatim or with modifications and/or translated into another
|
|
||||||
language. (Hereinafter, translation is included without limitation in
|
|
||||||
the term "modification".) Each licensee is addressed as "you".
|
|
||||||
|
|
||||||
Activities other than copying, distribution and modification are not
|
|
||||||
covered by this License; they are outside its scope. The act of
|
|
||||||
running the Program is not restricted, and the output from the Program
|
|
||||||
is covered only if its contents constitute a work based on the
|
|
||||||
Program (independent of having been made by running the Program).
|
|
||||||
Whether that is true depends on what the Program does.
|
|
||||||
|
|
||||||
1. You may copy and distribute verbatim copies of the Program's
|
|
||||||
source code as you receive it, in any medium, provided that you
|
|
||||||
conspicuously and appropriately publish on each copy an appropriate
|
|
||||||
copyright notice and disclaimer of warranty; keep intact all the
|
|
||||||
notices that refer to this License and to the absence of any warranty;
|
|
||||||
and give any other recipients of the Program a copy of this License
|
|
||||||
along with the Program.
|
|
||||||
|
|
||||||
You may charge a fee for the physical act of transferring a copy, and
|
|
||||||
you may at your option offer warranty protection in exchange for a fee.
|
|
||||||
|
|
||||||
2. You may modify your copy or copies of the Program or any portion
|
|
||||||
of it, thus forming a work based on the Program, and copy and
|
|
||||||
distribute such modifications or work under the terms of Section 1
|
|
||||||
above, provided that you also meet all of these conditions:
|
|
||||||
|
|
||||||
a) You must cause the modified files to carry prominent notices
|
|
||||||
stating that you changed the files and the date of any change.
|
|
||||||
|
|
||||||
b) You must cause any work that you distribute or publish, that in
|
|
||||||
whole or in part contains or is derived from the Program or any
|
|
||||||
part thereof, to be licensed as a whole at no charge to all third
|
|
||||||
parties under the terms of this License.
|
|
||||||
|
|
||||||
c) If the modified program normally reads commands interactively
|
|
||||||
when run, you must cause it, when started running for such
|
|
||||||
interactive use in the most ordinary way, to print or display an
|
|
||||||
announcement including an appropriate copyright notice and a
|
|
||||||
notice that there is no warranty (or else, saying that you provide
|
|
||||||
a warranty) and that users may redistribute the program under
|
|
||||||
these conditions, and telling the user how to view a copy of this
|
|
||||||
License. (Exception: if the Program itself is interactive but
|
|
||||||
does not normally print such an announcement, your work based on
|
|
||||||
the Program is not required to print an announcement.)
|
|
||||||
|
|
||||||
These requirements apply to the modified work as a whole. If
|
|
||||||
identifiable sections of that work are not derived from the Program,
|
|
||||||
and can be reasonably considered independent and separate works in
|
|
||||||
themselves, then this License, and its terms, do not apply to those
|
|
||||||
sections when you distribute them as separate works. But when you
|
|
||||||
distribute the same sections as part of a whole which is a work based
|
|
||||||
on the Program, the distribution of the whole must be on the terms of
|
|
||||||
this License, whose permissions for other licensees extend to the
|
|
||||||
entire whole, and thus to each and every part regardless of who wrote it.
|
|
||||||
|
|
||||||
Thus, it is not the intent of this section to claim rights or contest
|
|
||||||
your rights to work written entirely by you; rather, the intent is to
|
|
||||||
exercise the right to control the distribution of derivative or
|
|
||||||
collective works based on the Program.
|
|
||||||
|
|
||||||
In addition, mere aggregation of another work not based on the Program
|
|
||||||
with the Program (or with a work based on the Program) on a volume of
|
|
||||||
a storage or distribution medium does not bring the other work under
|
|
||||||
the scope of this License.
|
|
||||||
|
|
||||||
3. You may copy and distribute the Program (or a work based on it,
|
|
||||||
under Section 2) in object code or executable form under the terms of
|
|
||||||
Sections 1 and 2 above provided that you also do one of the following:
|
|
||||||
|
|
||||||
a) Accompany it with the complete corresponding machine-readable
|
|
||||||
source code, which must be distributed under the terms of Sections
|
|
||||||
1 and 2 above on a medium customarily used for software interchange; or,
|
|
||||||
|
|
||||||
b) Accompany it with a written offer, valid for at least three
|
|
||||||
years, to give any third party, for a charge no more than your
|
|
||||||
cost of physically performing source distribution, a complete
|
|
||||||
machine-readable copy of the corresponding source code, to be
|
|
||||||
distributed under the terms of Sections 1 and 2 above on a medium
|
|
||||||
customarily used for software interchange; or,
|
|
||||||
|
|
||||||
c) Accompany it with the information you received as to the offer
|
|
||||||
to distribute corresponding source code. (This alternative is
|
|
||||||
allowed only for noncommercial distribution and only if you
|
|
||||||
received the program in object code or executable form with such
|
|
||||||
an offer, in accord with Subsection b above.)
|
|
||||||
|
|
||||||
The source code for a work means the preferred form of the work for
|
|
||||||
making modifications to it. For an executable work, complete source
|
|
||||||
code means all the source code for all modules it contains, plus any
|
|
||||||
associated interface definition files, plus the scripts used to
|
|
||||||
control compilation and installation of the executable. However, as a
|
|
||||||
special exception, the source code distributed need not include
|
|
||||||
anything that is normally distributed (in either source or binary
|
|
||||||
form) with the major components (compiler, kernel, and so on) of the
|
|
||||||
operating system on which the executable runs, unless that component
|
|
||||||
itself accompanies the executable.
|
|
||||||
|
|
||||||
If distribution of executable or object code is made by offering
|
|
||||||
access to copy from a designated place, then offering equivalent
|
|
||||||
access to copy the source code from the same place counts as
|
|
||||||
distribution of the source code, even though third parties are not
|
|
||||||
compelled to copy the source along with the object code.
|
|
||||||
|
|
||||||
4. You may not copy, modify, sublicense, or distribute the Program
|
|
||||||
except as expressly provided under this License. Any attempt
|
|
||||||
otherwise to copy, modify, sublicense or distribute the Program is
|
|
||||||
void, and will automatically terminate your rights under this License.
|
|
||||||
However, parties who have received copies, or rights, from you under
|
|
||||||
this License will not have their licenses terminated so long as such
|
|
||||||
parties remain in full compliance.
|
|
||||||
|
|
||||||
5. You are not required to accept this License, since you have not
|
|
||||||
signed it. However, nothing else grants you permission to modify or
|
|
||||||
distribute the Program or its derivative works. These actions are
|
|
||||||
prohibited by law if you do not accept this License. Therefore, by
|
|
||||||
modifying or distributing the Program (or any work based on the
|
|
||||||
Program), you indicate your acceptance of this License to do so, and
|
|
||||||
all its terms and conditions for copying, distributing or modifying
|
|
||||||
the Program or works based on it.
|
|
||||||
|
|
||||||
6. Each time you redistribute the Program (or any work based on the
|
|
||||||
Program), the recipient automatically receives a license from the
|
|
||||||
original licensor to copy, distribute or modify the Program subject to
|
|
||||||
these terms and conditions. You may not impose any further
|
|
||||||
restrictions on the recipients' exercise of the rights granted herein.
|
|
||||||
You are not responsible for enforcing compliance by third parties to
|
|
||||||
this License.
|
|
||||||
|
|
||||||
7. If, as a consequence of a court judgment or allegation of patent
|
|
||||||
infringement or for any other reason (not limited to patent issues),
|
|
||||||
conditions are imposed on you (whether by court order, agreement or
|
|
||||||
otherwise) that contradict the conditions of this License, they do not
|
|
||||||
excuse you from the conditions of this License. If you cannot
|
|
||||||
distribute so as to satisfy simultaneously your obligations under this
|
|
||||||
License and any other pertinent obligations, then as a consequence you
|
|
||||||
may not distribute the Program at all. For example, if a patent
|
|
||||||
license would not permit royalty-free redistribution of the Program by
|
|
||||||
all those who receive copies directly or indirectly through you, then
|
|
||||||
the only way you could satisfy both it and this License would be to
|
|
||||||
refrain entirely from distribution of the Program.
|
|
||||||
|
|
||||||
If any portion of this section is held invalid or unenforceable under
|
|
||||||
any particular circumstance, the balance of the section is intended to
|
|
||||||
apply and the section as a whole is intended to apply in other
|
|
||||||
circumstances.
|
|
||||||
|
|
||||||
It is not the purpose of this section to induce you to infringe any
|
|
||||||
patents or other property right claims or to contest validity of any
|
|
||||||
such claims; this section has the sole purpose of protecting the
|
|
||||||
integrity of the free software distribution system, which is
|
|
||||||
implemented by public license practices. Many people have made
|
|
||||||
generous contributions to the wide range of software distributed
|
|
||||||
through that system in reliance on consistent application of that
|
|
||||||
system; it is up to the author/donor to decide if he or she is willing
|
|
||||||
to distribute software through any other system and a licensee cannot
|
|
||||||
impose that choice.
|
|
||||||
|
|
||||||
This section is intended to make thoroughly clear what is believed to
|
|
||||||
be a consequence of the rest of this License.
|
|
||||||
|
|
||||||
8. If the distribution and/or use of the Program is restricted in
|
|
||||||
certain countries either by patents or by copyrighted interfaces, the
|
|
||||||
original copyright holder who places the Program under this License
|
|
||||||
may add an explicit geographical distribution limitation excluding
|
|
||||||
those countries, so that distribution is permitted only in or among
|
|
||||||
countries not thus excluded. In such case, this License incorporates
|
|
||||||
the limitation as if written in the body of this License.
|
|
||||||
|
|
||||||
9. The Free Software Foundation may publish revised and/or new versions
|
|
||||||
of the General Public License from time to time. Such new versions will
|
|
||||||
be similar in spirit to the present version, but may differ in detail to
|
|
||||||
address new problems or concerns.
|
|
||||||
|
|
||||||
Each version is given a distinguishing version number. If the Program
|
|
||||||
specifies a version number of this License which applies to it and "any
|
|
||||||
later version", you have the option of following the terms and conditions
|
|
||||||
either of that version or of any later version published by the Free
|
|
||||||
Software Foundation. If the Program does not specify a version number of
|
|
||||||
this License, you may choose any version ever published by the Free Software
|
|
||||||
Foundation.
|
|
||||||
|
|
||||||
10. If you wish to incorporate parts of the Program into other free
|
|
||||||
programs whose distribution conditions are different, write to the author
|
|
||||||
to ask for permission. For software which is copyrighted by the Free
|
|
||||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
|
||||||
make exceptions for this. Our decision will be guided by the two goals
|
|
||||||
of preserving the free status of all derivatives of our free software and
|
|
||||||
of promoting the sharing and reuse of software generally.
|
|
||||||
|
|
||||||
NO WARRANTY
|
|
||||||
|
|
||||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
|
||||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
|
||||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
|
||||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
|
||||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
|
||||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
|
||||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
|
||||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
|
||||||
REPAIR OR CORRECTION.
|
|
||||||
|
|
||||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
|
||||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
|
||||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
|
||||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
|
||||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
|
||||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
|
||||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
|
||||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
|
||||||
POSSIBILITY OF SUCH DAMAGES.
|
|
||||||
|
|
||||||
END OF TERMS AND CONDITIONS
|
|
||||||
|
|
||||||
How to Apply These Terms to Your New Programs
|
|
||||||
|
|
||||||
If you develop a new program, and you want it to be of the greatest
|
|
||||||
possible use to the public, the best way to achieve this is to make it
|
|
||||||
free software which everyone can redistribute and change under these terms.
|
|
||||||
|
|
||||||
To do so, attach the following notices to the program. It is safest
|
|
||||||
to attach them to the start of each source file to most effectively
|
|
||||||
convey the exclusion of warranty; and each file should have at least
|
|
||||||
the "copyright" line and a pointer to where the full notice is found.
|
|
||||||
|
|
||||||
<one line to give the program's name and a brief idea of what it does.>
|
|
||||||
Copyright (C) <year> <name of author>
|
|
||||||
|
|
||||||
This program is free software; you can redistribute it and/or modify
|
|
||||||
it under the terms of the GNU General Public License as published by
|
|
||||||
the Free Software Foundation; either version 2 of the License, or
|
|
||||||
(at your option) any later version.
|
|
||||||
|
|
||||||
This program is distributed in the hope that it will be useful,
|
|
||||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
GNU General Public License for more details.
|
|
||||||
|
|
||||||
You should have received a copy of the GNU General Public License
|
|
||||||
along with this program; if not, write to the Free Software
|
|
||||||
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
||||||
|
|
||||||
|
|
||||||
Also add information on how to contact you by electronic and paper mail.
|
|
||||||
|
|
||||||
If the program is interactive, make it output a short notice like this
|
|
||||||
when it starts in an interactive mode:
|
|
||||||
|
|
||||||
Gnomovision version 69, Copyright (C) year name of author
|
|
||||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
|
||||||
This is free software, and you are welcome to redistribute it
|
|
||||||
under certain conditions; type `show c' for details.
|
|
||||||
|
|
||||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
|
||||||
parts of the General Public License. Of course, the commands you use may
|
|
||||||
be called something other than `show w' and `show c'; they could even be
|
|
||||||
mouse-clicks or menu items--whatever suits your program.
|
|
||||||
|
|
||||||
You should also get your employer (if you work as a programmer) or your
|
|
||||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
|
||||||
necessary. Here is a sample; alter the names:
|
|
||||||
|
|
||||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
|
||||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
|
||||||
|
|
||||||
<signature of Ty Coon>, 1 April 1989
|
|
||||||
Ty Coon, President of Vice
|
|
||||||
|
|
||||||
This General Public License does not permit incorporating your program into
|
|
||||||
proprietary programs. If your program is a subroutine library, you may
|
|
||||||
consider it more useful to permit linking proprietary applications with the
|
|
||||||
library. If this is what you want to do, use the GNU Library General
|
|
||||||
Public License instead of this License.
|
|
||||||
|
43
ChangeLog
43
ChangeLog
@ -1,46 +1,3 @@
|
|||||||
2014-02-17 Dmitry Kasatkin <d.kasatkin@samsung.com>
|
|
||||||
|
|
||||||
version 0.7
|
|
||||||
* Fix symbolic links related bugs
|
|
||||||
* Provide recursive fixing
|
|
||||||
* Provide recursive signing
|
|
||||||
* Move IMA verification to the library (first for LTP use)
|
|
||||||
* Support for target architecture data size
|
|
||||||
* Remove obsolete module signing code
|
|
||||||
* Code cleanup
|
|
||||||
|
|
||||||
2013-08-28 Dmitry Kasatkin <d.kasatkin@samsung.com>
|
|
||||||
|
|
||||||
version 0.6
|
|
||||||
* support for asymmetric crypto keys and new signature format (v2)
|
|
||||||
* fixes to set correct hash algo for digital signature v1
|
|
||||||
* uuid support for EVM
|
|
||||||
* signature verification support
|
|
||||||
* test scripts removed
|
|
||||||
* README updates
|
|
||||||
|
|
||||||
2012-05-18 Dmitry Kasatkin <dmitry.kasatkin@intel.com>
|
|
||||||
|
|
||||||
version 0.3
|
|
||||||
* llistxattr returns 0 if there are no xattrs and it is valid
|
|
||||||
* Added entry type to directory hash calculation
|
|
||||||
* inline block variable renamed
|
|
||||||
* Remove forced tag creation
|
|
||||||
* Use libexec for programs and scripts
|
|
||||||
* Some files updated
|
|
||||||
* Do not search for algorithm as it is known
|
|
||||||
* Refactored to remove redundant hash initialization code
|
|
||||||
* Added hash calculation for special files
|
|
||||||
|
|
||||||
2012-04-05 Dmitry Kasatkin <dmitry.kasatkin@intel.com>
|
|
||||||
|
|
||||||
version 0.2
|
|
||||||
* added RPM & TAR building makefile rules
|
|
||||||
* renamed evm-utils to ima-evm-utils
|
|
||||||
* added command options description
|
|
||||||
* updated error handling
|
|
||||||
* refactored redundant code
|
|
||||||
|
|
||||||
2012-04-02 Dmitry Kasatkin <dmitry.kasatkin@intel.com>
|
2012-04-02 Dmitry Kasatkin <dmitry.kasatkin@intel.com>
|
||||||
|
|
||||||
version 0.1.0
|
version 0.1.0
|
||||||
|
15
INSTALL
15
INSTALL
@ -1,8 +1,8 @@
|
|||||||
Installation Instructions
|
Installation Instructions
|
||||||
*************************
|
*************************
|
||||||
|
|
||||||
Copyright (C) 1994-1996, 1999-2002, 2004-2013 Free Software Foundation,
|
Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005,
|
||||||
Inc.
|
2006, 2007, 2008, 2009 Free Software Foundation, Inc.
|
||||||
|
|
||||||
Copying and distribution of this file, with or without modification,
|
Copying and distribution of this file, with or without modification,
|
||||||
are permitted in any medium without royalty provided the copyright
|
are permitted in any medium without royalty provided the copyright
|
||||||
@ -226,11 +226,6 @@ order to use an ANSI C compiler:
|
|||||||
|
|
||||||
and if that doesn't work, install pre-built binaries of GCC for HP-UX.
|
and if that doesn't work, install pre-built binaries of GCC for HP-UX.
|
||||||
|
|
||||||
HP-UX `make' updates targets which have the same time stamps as
|
|
||||||
their prerequisites, which makes it generally unusable when shipped
|
|
||||||
generated files such as `configure' are involved. Use GNU `make'
|
|
||||||
instead.
|
|
||||||
|
|
||||||
On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot
|
On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot
|
||||||
parse its `<wchar.h>' header file. The option `-nodtk' can be used as
|
parse its `<wchar.h>' header file. The option `-nodtk' can be used as
|
||||||
a workaround. If GNU CC is not installed, it is therefore recommended
|
a workaround. If GNU CC is not installed, it is therefore recommended
|
||||||
@ -309,10 +304,9 @@ causes the specified `gcc' to be used as the C compiler (unless it is
|
|||||||
overridden in the site shell script).
|
overridden in the site shell script).
|
||||||
|
|
||||||
Unfortunately, this technique does not work for `CONFIG_SHELL' due to
|
Unfortunately, this technique does not work for `CONFIG_SHELL' due to
|
||||||
an Autoconf limitation. Until the limitation is lifted, you can use
|
an Autoconf bug. Until the bug is fixed you can use this workaround:
|
||||||
this workaround:
|
|
||||||
|
|
||||||
CONFIG_SHELL=/bin/bash ./configure CONFIG_SHELL=/bin/bash
|
CONFIG_SHELL=/bin/bash /bin/bash ./configure CONFIG_SHELL=/bin/bash
|
||||||
|
|
||||||
`configure' Invocation
|
`configure' Invocation
|
||||||
======================
|
======================
|
||||||
@ -368,3 +362,4 @@ operates.
|
|||||||
|
|
||||||
`configure' also accepts some other, not widely useful, options. Run
|
`configure' also accepts some other, not widely useful, options. Run
|
||||||
`configure --help' for more details.
|
`configure --help' for more details.
|
||||||
|
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
SUBDIRS = src
|
SUBDIRS = src tests
|
||||||
|
|
||||||
EXTRA_DIST = autogen.sh
|
#EXTRA_DIST = LEGAL acinclude.m4 include
|
||||||
|
|
||||||
ACLOCAL_AMFLAGS = -I m4
|
ACLOCAL_AMFLAGS = -I m4
|
||||||
|
|
||||||
@ -11,7 +11,8 @@ pkgname = $(PACKAGE_NAME)-$(PACKAGE_VERSION)
|
|||||||
tarname = $(pkgname).tar.gz
|
tarname = $(pkgname).tar.gz
|
||||||
|
|
||||||
$(tarname):
|
$(tarname):
|
||||||
git archive --format=tar --prefix=$(pkgname)/ v$(PACKAGE_VERSION) $(FILES) | gzip >$@
|
git tag -f v$(PACKAGE_VERSION)
|
||||||
|
git archive --format=tar --prefix=$(pkgname)/ v$(PACKAGE_VERSION) $(FILES) | gzip >$@;
|
||||||
|
|
||||||
tar: $(tarname)
|
tar: $(tarname)
|
||||||
|
|
||||||
|
163
README
163
README
@ -1,155 +1,52 @@
|
|||||||
ima-evm-utils - IMA/EVM signing utility
|
|
||||||
=========================================
|
|
||||||
|
|
||||||
Contents:
|
1. Generate private key
|
||||||
|
|
||||||
1. Key and signature formats
|
# plain key
|
||||||
2. Key generation
|
openssl genrsa -out privkey_evm.pem 1024
|
||||||
3. Initialization
|
|
||||||
4. Signing
|
|
||||||
|
|
||||||
|
# encrypted key
|
||||||
|
openssl genrsa -des3 -out privkey_evm.pem 1024
|
||||||
|
|
||||||
Key and signature formats
|
# set password for the key
|
||||||
-------------------------
|
openssl rsa -in /etc/keys/privkey_evm.pem -out privkey_evm_enc.pem -des3
|
||||||
|
|
||||||
EVM support (v2) in latest version of the kernel adds the file system UUID to
|
|
||||||
the HMAC calculation. It is controlled by the CONFIG_EVM_HMAC_VERSION and
|
|
||||||
version 2 is enabled by default. In this version default UUID is included by
|
|
||||||
default. Custom value can be supplied via '--uuid=UUID' or '-uUUID' parameter
|
|
||||||
to the 'sign' command. To use old format HMAC format use '-' as a parameter.
|
|
||||||
|
|
||||||
Latest kernel got IMA/EVM support for using X509 certificates and asymmetric key
|
|
||||||
support for verifying digital signatures. This version uses x509 format by default.
|
|
||||||
Use '--rsa' or '-1' parameter to use old signature format and API.
|
|
||||||
|
|
||||||
|
|
||||||
Key generation
|
|
||||||
--------------
|
|
||||||
|
|
||||||
Generate private key in plain text format
|
|
||||||
|
|
||||||
$ openssl genrsa -out privkey_evm.pem 1024
|
|
||||||
|
|
||||||
Generate encrypted private key
|
|
||||||
|
|
||||||
$ openssl genrsa -des3 -out privkey_evm.pem 1024
|
|
||||||
|
|
||||||
Make encrypted private key from unencrypted
|
|
||||||
|
|
||||||
$ openssl rsa -in /etc/keys/privkey_evm.pem -out privkey_evm_enc.pem -des3
|
|
||||||
|
|
||||||
Generate self-signed X509 certificate and private key for using kernel asymmetric
|
|
||||||
keys support
|
|
||||||
|
|
||||||
$ openssl req -new -nodes -utf8 -sha1 -days 36500 -batch \
|
|
||||||
-x509 -config x509_evm.genkey \
|
|
||||||
-outform DER -out x509_evm.der -keyout privkey_evm.pem
|
|
||||||
|
|
||||||
Configuration file x509_evm.genkey:
|
|
||||||
|
|
||||||
# Begining of the file
|
|
||||||
[ req ]
|
|
||||||
default_bits = 1024
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
prompt = no
|
|
||||||
string_mask = utf8only
|
|
||||||
x509_extensions = myexts
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
O = Magrathea
|
|
||||||
CN = Glacier signing key
|
|
||||||
emailAddress = slartibartfast@magrathea.h2g2
|
|
||||||
|
|
||||||
[ myexts ]
|
|
||||||
basicConstraints=critical,CA:FALSE
|
|
||||||
keyUsage=digitalSignature
|
|
||||||
subjectKeyIdentifier=hash
|
|
||||||
authorityKeyIdentifier=keyid
|
|
||||||
# EOF
|
|
||||||
|
|
||||||
|
|
||||||
Get public key
|
|
||||||
|
|
||||||
$ openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem
|
|
||||||
|
|
||||||
Copy keys to /etc/keys
|
|
||||||
|
|
||||||
$ cp pubkey_evm.pem /etc/keys
|
|
||||||
$ scp pubkey_evm.pem target:/etc/keys
|
|
||||||
|
|
||||||
or
|
or
|
||||||
$ cp x509_evm.pem /etc/keys
|
openssl pkcs8 -topk8 -in /etc/keys/privkey_evm.pem -out privkey_evm_enc.pem
|
||||||
$ scp x509_evm.pem target:/etc/keys
|
|
||||||
|
|
||||||
|
2. Generate public key
|
||||||
|
|
||||||
Generation of EVM keys
|
openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem
|
||||||
|
|
||||||
$ # create and save the kernel master key (user type)
|
3. Copy public (+private if to sign on device) key to the device/qemu /etc/keys
|
||||||
$ keyctl add user kmk "`dd if=/dev/urandom bs=1 count=32 2>/dev/null`" @u
|
|
||||||
$ keyctl pipe `keyctl search @u user kmk` > /etc/keys/kmk
|
|
||||||
$ # create the EVM encrypted key
|
|
||||||
$ keyctl add encrypted evm-key "new user:kmk 32" @u
|
|
||||||
$ keyctl pipe `keyctl search @u encrypted evm-key` >/etc/keys/evm-key
|
|
||||||
|
|
||||||
|
scp pubkey_evm.pem mad:/etc/keys
|
||||||
|
|
||||||
Initialization
|
4. Load keys and enable EVM
|
||||||
--------------
|
|
||||||
|
|
||||||
IMA/EVM initialization should be normally done from initial RAM file system
|
evm_enable.sh
|
||||||
before mounting root filesystem.
|
|
||||||
|
|
||||||
Here is an example script /etc/initramfs-tools/scripts/local-top/ima.sh
|
This should be done at early phase, before mounting root filesystem.
|
||||||
|
|
||||||
# import EVM HMAC key
|
5. Sign EVM and use hash value for IMA - common case
|
||||||
keyctl clear @u
|
|
||||||
cat /etc/keys/kmk | keyctl padd user kmk @u
|
|
||||||
keyctl add encrypted evm-key "load `cat /etc/keys/evm-key`" @u
|
|
||||||
|
|
||||||
# import IMA public key
|
evmctl sign --imahash test.txt
|
||||||
ima_id=`keyctl newring _ima @u`
|
|
||||||
evmctl --rsa import /etc/keys/pubkey_evm.pem $ima_id
|
|
||||||
|
|
||||||
# import EVM public key
|
6. Sign IMA and EVM - for immutable files and modules
|
||||||
evm_id=`keyctl newring _evm @u`
|
|
||||||
evmctl --rsa import /etc/keys/pubkey_evm.pem $evm_id
|
|
||||||
|
|
||||||
# enable EVM
|
evmctl sign --imasig test.txt
|
||||||
echo "1" > /sys/kernel/security/evm
|
|
||||||
|
|
||||||
|
7. Sign whole filesystem
|
||||||
|
|
||||||
Import X509 certificate into the kernel keyring (since kernel 3.9?)
|
evm_sign_all.sh
|
||||||
|
or
|
||||||
|
find / \( -fstype rootfs -o -fstype ext3 -o -fstype ext4 \) ! -path "/lib/modules/*" -type f -uid 0 -exec evmctl sign --imahash '{}' \;
|
||||||
|
find /lib/modules ! -name "*.ko" -type f -uid 0 -exec evmctl sign --imahash '{}' \;
|
||||||
|
# security.ima needs to have signature for modules
|
||||||
|
find /lib/modules -name "*.ko" -type f -uid 0 -exec evmctl sign --imasig '{}' \;
|
||||||
|
|
||||||
$ evmctl import /etc/keys/x509_evm.der `keyctl search @u keyring _ima`
|
# generate signatures in .sig files
|
||||||
$ evmctl import /etc/keys/x509_evm.der `keyctl search @u keyring _evm`
|
find /lib/modules -name "*.ko" -type f -uid 0 -exec evmctl -n --sigfile ima_sign '{}' \;
|
||||||
|
|
||||||
|
8. Label filesystem in fix mode...
|
||||||
|
|
||||||
Signing
|
ima_fix_dir.sh <dir>
|
||||||
-------
|
|
||||||
|
|
||||||
Default public key: /etc/keys/pubkey_evm.pem
|
|
||||||
Default private key: /etc/keys/privkey_evm.pem
|
|
||||||
Default X509 certificate: /etc/keys/x509_evm.der
|
|
||||||
|
|
||||||
Signing for using old RSA format is done using '-1' or '--rsa' parameter.
|
|
||||||
Signing for using old EVM HMAC format is done using '-u-' or '--uuid=-' parameter.
|
|
||||||
|
|
||||||
Sign file with EVM signature and use hash value for IMA - common case
|
|
||||||
|
|
||||||
$ evmctl sign [-u] [-1] --imahash test.txt
|
|
||||||
|
|
||||||
Sign file with both IMA and EVM signatures - for immutable files
|
|
||||||
|
|
||||||
$ evmctl sign [-u] [-1] --imasig test.txt
|
|
||||||
|
|
||||||
Sign file with IMA signature - for immutable files
|
|
||||||
|
|
||||||
$ evmctl ima_sign [-1] test.txt
|
|
||||||
|
|
||||||
Label whole filesystem with EVM signatures
|
|
||||||
|
|
||||||
$ find / \( -fstype rootfs -o -fstype ext4 \) -exec evmctl sign [-u] [-1] --imahash '{}' \;
|
|
||||||
|
|
||||||
Label filesystem in fix mode - kernel sets correct values to IMA and EVM xattrs
|
|
||||||
|
|
||||||
$ find / \( -fstype rootfs -o -fstype ext4 \) -exec sh -c "< '{}'" \;
|
|
||||||
|
|
||||||
|
10
configure.ac
10
configure.ac
@ -1,8 +1,8 @@
|
|||||||
# autoconf script
|
# autoconf script
|
||||||
|
|
||||||
AC_PREREQ([2.65])
|
AC_PREREQ([2.65])
|
||||||
AC_INIT(ima-evm-utils, 0.7, d.kasatkin@samsung.com)
|
AC_INIT(ima-evm-utils, 0.1.1, dmitry.kasatkin@intel.com)
|
||||||
AM_INIT_AUTOMAKE
|
AM_INIT_AUTOMAKE(AC_PACKAGE_NAME, AC_PACKAGE_VERSION)
|
||||||
AC_CONFIG_HEADERS([config.h])
|
AC_CONFIG_HEADERS([config.h])
|
||||||
AC_CONFIG_MACRO_DIR([m4])
|
AC_CONFIG_MACRO_DIR([m4])
|
||||||
|
|
||||||
@ -30,9 +30,6 @@ AC_SUBST(OPENSSL_LIBS)
|
|||||||
AC_CHECK_HEADER(unistd.h)
|
AC_CHECK_HEADER(unistd.h)
|
||||||
AC_CHECK_HEADERS(openssl/conf.h)
|
AC_CHECK_HEADERS(openssl/conf.h)
|
||||||
|
|
||||||
AC_CHECK_HEADERS(attr/xattr.h, , [AC_MSG_ERROR([attr/xattr.h header not found. You need the libattr development package.])])
|
|
||||||
AC_CHECK_HEADERS(keyutils.h, , [AC_MSG_ERROR([keyutils.h header not found. You need the libkeyutils development package.])])
|
|
||||||
|
|
||||||
#debug support - yes for a while
|
#debug support - yes for a while
|
||||||
PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support])
|
PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support])
|
||||||
if test $pkg_cv_enable_debug = yes; then
|
if test $pkg_cv_enable_debug = yes; then
|
||||||
@ -49,7 +46,8 @@ fi
|
|||||||
|
|
||||||
AC_CONFIG_FILES([Makefile
|
AC_CONFIG_FILES([Makefile
|
||||||
src/Makefile
|
src/Makefile
|
||||||
packaging/ima-evm-utils.spec
|
tests/Makefile
|
||||||
|
ima-evm-utils.spec
|
||||||
])
|
])
|
||||||
AC_OUTPUT
|
AC_OUTPUT
|
||||||
|
|
||||||
|
@ -1,29 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
GENKEY=ima-local-ca.genkey
|
|
||||||
|
|
||||||
cat << __EOF__ >$GENKEY
|
|
||||||
[ req ]
|
|
||||||
default_bits = 2048
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
prompt = no
|
|
||||||
string_mask = utf8only
|
|
||||||
x509_extensions = v3_ca
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
O = IMA-CA
|
|
||||||
CN = IMA/EVM certificate signing key
|
|
||||||
emailAddress = ca@ima-ca
|
|
||||||
|
|
||||||
[ v3_ca ]
|
|
||||||
basicConstraints=CA:TRUE
|
|
||||||
subjectKeyIdentifier=hash
|
|
||||||
authorityKeyIdentifier=keyid:always,issuer
|
|
||||||
# keyUsage = cRLSign, keyCertSign
|
|
||||||
__EOF__
|
|
||||||
|
|
||||||
openssl req -new -x509 -utf8 -sha1 -days 3650 -batch -config $GENKEY \
|
|
||||||
-outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv
|
|
||||||
|
|
||||||
openssl x509 -inform DER -in ima-local-ca.x509 -out ima-local-ca.pem
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
GENKEY=x509_evm.genkey
|
|
||||||
|
|
||||||
cat << __EOF__ >$GENKEY
|
|
||||||
[ req ]
|
|
||||||
default_bits = 1024
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
prompt = no
|
|
||||||
string_mask = utf8only
|
|
||||||
x509_extensions = myexts
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
O = `hostname`
|
|
||||||
CN = `whoami` signing key
|
|
||||||
emailAddress = `whoami`@`hostname`
|
|
||||||
|
|
||||||
[ myexts ]
|
|
||||||
basicConstraints=critical,CA:FALSE
|
|
||||||
keyUsage=digitalSignature
|
|
||||||
subjectKeyIdentifier=hash
|
|
||||||
authorityKeyIdentifier=keyid
|
|
||||||
__EOF__
|
|
||||||
|
|
||||||
openssl req -x509 -new -nodes -utf8 -sha1 -days 3650 -batch -config $GENKEY \
|
|
||||||
-outform DER -out x509_evm.der -keyout privkey_evm.pem
|
|
||||||
|
|
||||||
openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
GENKEY=ima.genkey
|
|
||||||
|
|
||||||
cat << __EOF__ >$GENKEY
|
|
||||||
[ req ]
|
|
||||||
default_bits = 1024
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
prompt = no
|
|
||||||
string_mask = utf8only
|
|
||||||
x509_extensions = v3_usr
|
|
||||||
|
|
||||||
[ req_distinguished_name ]
|
|
||||||
O = `hostname`
|
|
||||||
CN = `whoami` signing key
|
|
||||||
emailAddress = `whoami`@`hostname`
|
|
||||||
|
|
||||||
[ v3_usr ]
|
|
||||||
basicConstraints=critical,CA:FALSE
|
|
||||||
#basicConstraints=CA:FALSE
|
|
||||||
keyUsage=digitalSignature
|
|
||||||
#keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
||||||
subjectKeyIdentifier=hash
|
|
||||||
authorityKeyIdentifier=keyid
|
|
||||||
#authorityKeyIdentifier=keyid,issuer
|
|
||||||
__EOF__
|
|
||||||
|
|
||||||
openssl req -new -nodes -utf8 -sha1 -days 365 -batch -config $GENKEY \
|
|
||||||
-out csr_ima.pem -keyout privkey_ima.pem
|
|
||||||
openssl x509 -req -in csr_ima.pem -days 365 -extfile $GENKEY -extensions v3_usr \
|
|
||||||
-CA ima-local-ca.pem -CAkey ima-local-ca.priv -CAcreateserial \
|
|
||||||
-outform DER -out x509_ima.der
|
|
||||||
|
|
@ -3,7 +3,7 @@ Version: @PACKAGE_VERSION@
|
|||||||
Release: 1%{?dist}
|
Release: 1%{?dist}
|
||||||
Summary: @PACKAGE_NAME@ - IMA/EVM control utility
|
Summary: @PACKAGE_NAME@ - IMA/EVM control utility
|
||||||
Group: System/Libraries
|
Group: System/Libraries
|
||||||
License: GPLv2
|
License: LGPLv2
|
||||||
#URL:
|
#URL:
|
||||||
Source0: %{name}-%{version}.tar.gz
|
Source0: %{name}-%{version}.tar.gz
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
|
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
|
||||||
@ -44,8 +44,7 @@ exit 0
|
|||||||
%files
|
%files
|
||||||
%defattr(-,root,root,-)
|
%defattr(-,root,root,-)
|
||||||
%{_bindir}/*
|
%{_bindir}/*
|
||||||
%{_libdir}/libimaevm.*
|
%{_libdir}/*
|
||||||
%{_includedir}/*
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Thu Apr 05 2012 Dmitry Kasatkin <dmitry.kasatkin@intel.com>
|
* Thu Apr 05 2012 Dmitry Kasatkin <dmitry.kasatkin@intel.com>
|
@ -1,53 +0,0 @@
|
|||||||
Name: ima-evm-utils
|
|
||||||
Version: 0.7
|
|
||||||
Release: 1%{?dist}
|
|
||||||
Summary: ima-evm-utils - IMA/EVM control utility
|
|
||||||
Group: System/Libraries
|
|
||||||
License: GPLv2
|
|
||||||
#URL:
|
|
||||||
Source0: %{name}-%{version}.tar.gz
|
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
|
|
||||||
|
|
||||||
BuildRequires: autoconf
|
|
||||||
BuildRequires: automake
|
|
||||||
BuildRequires: openssl-devel
|
|
||||||
BuildRequires: libattr-devel
|
|
||||||
BuildRequires: keyutils-libs-devel
|
|
||||||
|
|
||||||
%description
|
|
||||||
This package provide IMA/EVM control utility
|
|
||||||
|
|
||||||
%prep
|
|
||||||
%setup -q
|
|
||||||
|
|
||||||
%build
|
|
||||||
./autogen.sh
|
|
||||||
%configure --prefix=/usr
|
|
||||||
make
|
|
||||||
|
|
||||||
%install
|
|
||||||
rm -rf %{buildroot}
|
|
||||||
make DESTDIR=%{buildroot} install
|
|
||||||
|
|
||||||
%clean
|
|
||||||
rm -rf %{buildroot}
|
|
||||||
|
|
||||||
%post
|
|
||||||
/sbin/ldconfig
|
|
||||||
exit 0
|
|
||||||
|
|
||||||
%preun -p /sbin/ldconfig
|
|
||||||
|
|
||||||
%postun
|
|
||||||
/sbin/ldconfig
|
|
||||||
|
|
||||||
%files
|
|
||||||
%defattr(-,root,root,-)
|
|
||||||
%{_bindir}/*
|
|
||||||
%{_libdir}/libimaevm.*
|
|
||||||
%{_includedir}/*
|
|
||||||
|
|
||||||
%changelog
|
|
||||||
* Thu Apr 05 2012 Dmitry Kasatkin <dmitry.kasatkin@intel.com>
|
|
||||||
- Initial RPM spec file
|
|
||||||
|
|
@ -1,20 +1,10 @@
|
|||||||
lib_LTLIBRARIES = libimaevm.la
|
|
||||||
|
|
||||||
libimaevm_la_SOURCES = libimaevm.c
|
|
||||||
libimaevm_la_CPPFLAGS = $(OPENSSL_CFLAGS)
|
|
||||||
# current[:revision[:age]]
|
|
||||||
# result: [current-age].age.revision
|
|
||||||
libimaevm_la_LDFLAGS = -version-info 0:0:0
|
|
||||||
libimaevm_la_LIBADD = $(OPENSSL_LIBS)
|
|
||||||
|
|
||||||
include_HEADERS = imaevm.h
|
|
||||||
|
|
||||||
bin_PROGRAMS = evmctl
|
bin_PROGRAMS = evmctl
|
||||||
|
|
||||||
evmctl_SOURCES = evmctl.c
|
evmctl_SOURCES = evmctl.c
|
||||||
evmctl_CPPFLAGS = $(OPENSSL_CFLAGS)
|
evmctl_CPPFLAGS = $(OPENSSL_CFLAGS)
|
||||||
evmctl_LDFLAGS = $(LDFLAGS_READLINE)
|
evmctl_LDFLAGS = $(LDFLAGS_READLINE)
|
||||||
evmctl_LDADD = $(OPENSSL_LIBS) -lkeyutils libimaevm.la
|
evmctl_LDADD = $(OPENSSL_LIBS) -lkeyutils
|
||||||
|
|
||||||
INCLUDES = -I$(top_srcdir) -include config.h
|
INCLUDES = -I$(top_srcdir) -include config.h
|
||||||
|
|
||||||
|
1535
src/evmctl.c
1535
src/evmctl.c
File diff suppressed because it is too large
Load Diff
155
src/imaevm.h
155
src/imaevm.h
@ -1,155 +0,0 @@
|
|||||||
#ifndef _LIBIMAEVM_H
|
|
||||||
#define _LIBIMAEVM_H
|
|
||||||
|
|
||||||
#include <stdint.h>
|
|
||||||
#include <syslog.h>
|
|
||||||
#include <stdbool.h>
|
|
||||||
#include <errno.h>
|
|
||||||
|
|
||||||
#include <openssl/rsa.h>
|
|
||||||
|
|
||||||
#ifdef USE_FPRINTF
|
|
||||||
#define do_log(level, fmt, args...) ({ if (level <= params.verbose) fprintf(stderr, fmt, ##args); })
|
|
||||||
#define do_log_dump(level, p, len, cr) ({ if (level <= params.verbose) do_dump(stderr, p, len, cr); })
|
|
||||||
#else
|
|
||||||
#define do_log(level, fmt, args...) syslog(level, fmt, ##args)
|
|
||||||
#define do_log_dump(level, p, len, cr)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef DEBUG
|
|
||||||
#define log_debug(fmt, args...) do_log(LOG_DEBUG, "%s:%d " fmt, __func__ , __LINE__ , ##args)
|
|
||||||
#define log_debug_dump(p, len) do_log_dump(LOG_DEBUG, p, len, true)
|
|
||||||
#define log_debug_dump_n(p, len) do_log_dump(LOG_DEBUG, p, len, false)
|
|
||||||
#else
|
|
||||||
#define log_debug(fmt, args...)
|
|
||||||
#define log_debug_dump(p, len)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#define log_dump(p, len) do_log_dump(LOG_INFO, p, len, true)
|
|
||||||
#define log_dump_n(p, len) do_log_dump(LOG_INFO, p, len, false)
|
|
||||||
#define log_info(fmt, args...) do_log(LOG_INFO, fmt, ##args)
|
|
||||||
#define log_err(fmt, args...) do_log(LOG_ERR, fmt, ##args)
|
|
||||||
#define log_errno(fmt, args...) do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno)
|
|
||||||
|
|
||||||
#define DATA_SIZE 4096
|
|
||||||
#define SHA1_HASH_LEN 20
|
|
||||||
|
|
||||||
#define EXT2_IOC_GETVERSION _IOR('v', 1, long)
|
|
||||||
#define EXT34_IOC_GETVERSION _IOR('f', 3, long)
|
|
||||||
|
|
||||||
#define FS_IOC_GETFLAGS _IOR('f', 1, long)
|
|
||||||
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
|
|
||||||
#define FS_IOC32_GETFLAGS _IOR('f', 1, int)
|
|
||||||
#define FS_IOC32_SETFLAGS _IOW('f', 2, int)
|
|
||||||
|
|
||||||
#define __packed __attribute__((packed))
|
|
||||||
|
|
||||||
struct h_misc {
|
|
||||||
unsigned long ino;
|
|
||||||
uint32_t generation;
|
|
||||||
uid_t uid;
|
|
||||||
gid_t gid;
|
|
||||||
unsigned short mode;
|
|
||||||
};
|
|
||||||
|
|
||||||
struct h_misc_32 {
|
|
||||||
uint32_t ino;
|
|
||||||
uint32_t generation;
|
|
||||||
uid_t uid;
|
|
||||||
gid_t gid;
|
|
||||||
unsigned short mode;
|
|
||||||
};
|
|
||||||
|
|
||||||
struct h_misc_64 {
|
|
||||||
uint64_t ino;
|
|
||||||
uint32_t generation;
|
|
||||||
uid_t uid;
|
|
||||||
gid_t gid;
|
|
||||||
unsigned short mode;
|
|
||||||
};
|
|
||||||
|
|
||||||
enum pubkey_algo {
|
|
||||||
PUBKEY_ALGO_RSA,
|
|
||||||
PUBKEY_ALGO_MAX,
|
|
||||||
};
|
|
||||||
|
|
||||||
enum digest_algo {
|
|
||||||
DIGEST_ALGO_SHA1,
|
|
||||||
DIGEST_ALGO_SHA256,
|
|
||||||
DIGEST_ALGO_MAX
|
|
||||||
};
|
|
||||||
|
|
||||||
enum digsig_version {
|
|
||||||
DIGSIG_VERSION_1 = 1,
|
|
||||||
DIGSIG_VERSION_2
|
|
||||||
};
|
|
||||||
|
|
||||||
struct pubkey_hdr {
|
|
||||||
uint8_t version; /* key format version */
|
|
||||||
uint32_t timestamp; /* key made, always 0 for now */
|
|
||||||
uint8_t algo;
|
|
||||||
uint8_t nmpi;
|
|
||||||
char mpi[0];
|
|
||||||
} __packed;
|
|
||||||
|
|
||||||
struct signature_hdr {
|
|
||||||
uint8_t version; /* signature format version */
|
|
||||||
uint32_t timestamp; /* signature made */
|
|
||||||
uint8_t algo;
|
|
||||||
uint8_t hash;
|
|
||||||
uint8_t keyid[8];
|
|
||||||
uint8_t nmpi;
|
|
||||||
char mpi[0];
|
|
||||||
} __packed;
|
|
||||||
|
|
||||||
enum pkey_hash_algo {
|
|
||||||
PKEY_HASH_MD4,
|
|
||||||
PKEY_HASH_MD5,
|
|
||||||
PKEY_HASH_SHA1,
|
|
||||||
PKEY_HASH_RIPE_MD_160,
|
|
||||||
PKEY_HASH_SHA256,
|
|
||||||
PKEY_HASH_SHA384,
|
|
||||||
PKEY_HASH_SHA512,
|
|
||||||
PKEY_HASH_SHA224,
|
|
||||||
PKEY_HASH__LAST
|
|
||||||
};
|
|
||||||
|
|
||||||
/*
|
|
||||||
* signature format v2 - for using with asymmetric keys
|
|
||||||
*/
|
|
||||||
struct signature_v2_hdr {
|
|
||||||
uint8_t version; /* signature format version */
|
|
||||||
uint8_t hash_algo; /* Digest algorithm [enum pkey_hash_algo] */
|
|
||||||
uint32_t keyid; /* IMA key identifier - not X509/PGP specific*/
|
|
||||||
uint16_t sig_size; /* signature size */
|
|
||||||
uint8_t sig[0]; /* signature payload */
|
|
||||||
} __packed;
|
|
||||||
|
|
||||||
|
|
||||||
typedef int (*verify_hash_fn_t)(const unsigned char *hash, int size, unsigned char *sig, int siglen, const char *keyfile);
|
|
||||||
|
|
||||||
struct libevm_params {
|
|
||||||
int verbose;
|
|
||||||
const char *hash_algo;
|
|
||||||
char *keyfile;
|
|
||||||
};
|
|
||||||
|
|
||||||
struct RSA_ASN1_template {
|
|
||||||
const uint8_t *data;
|
|
||||||
size_t size;
|
|
||||||
};
|
|
||||||
|
|
||||||
extern const struct RSA_ASN1_template RSA_ASN1_templates[PKEY_HASH__LAST];
|
|
||||||
extern struct libevm_params params;
|
|
||||||
|
|
||||||
void do_dump(FILE *fp, const void *ptr, int len, bool cr);
|
|
||||||
void dump(const void *ptr, int len);
|
|
||||||
int get_filesize(const char *filename);
|
|
||||||
int ima_calc_hash(const char *file, uint8_t *hash);
|
|
||||||
int get_hash_algo(const char *algo);
|
|
||||||
RSA *read_pub_key(const char *keyfile, int x509);
|
|
||||||
|
|
||||||
int verify_hash(const unsigned char *hash, int size, unsigned char *sig, int siglen);
|
|
||||||
int ima_verify_signature(const char *file, unsigned char *sig, int siglen);
|
|
||||||
|
|
||||||
#endif
|
|
520
src/libimaevm.c
520
src/libimaevm.c
@ -1,520 +0,0 @@
|
|||||||
/*
|
|
||||||
* ima-evm-utils - IMA/EVM support utilities
|
|
||||||
*
|
|
||||||
* Copyright (C) 2011 Nokia Corporation
|
|
||||||
* Copyright (C) 2011,2012,2013 Intel Corporation
|
|
||||||
* Copyright (C) 2013,2014 Samsung Electronics
|
|
||||||
*
|
|
||||||
* Authors:
|
|
||||||
* Dmitry Kasatkin <dmitry.kasatkin@nokia.com>
|
|
||||||
* <dmitry.kasatkin@intel.com>
|
|
||||||
* <d.kasatkin@samsung.com>
|
|
||||||
*
|
|
||||||
* This program is free software; you can redistribute it and/or
|
|
||||||
* modify it under the terms of the GNU General Public License
|
|
||||||
* version 2 as published by the Free Software Foundation.
|
|
||||||
*
|
|
||||||
* This program is distributed in the hope that it will be useful,
|
|
||||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
* GNU General Public License for more details.
|
|
||||||
*
|
|
||||||
* File: libevm.c
|
|
||||||
* IMA/EVM library
|
|
||||||
*/
|
|
||||||
|
|
||||||
/* should we use logger instead for library? */
|
|
||||||
#define USE_FPRINTF
|
|
||||||
|
|
||||||
#include <sys/types.h>
|
|
||||||
#include <sys/param.h>
|
|
||||||
#include <sys/stat.h>
|
|
||||||
#include <unistd.h>
|
|
||||||
#include <dirent.h>
|
|
||||||
#include <string.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
|
|
||||||
#include <openssl/pem.h>
|
|
||||||
#include <openssl/evp.h>
|
|
||||||
#include <openssl/x509.h>
|
|
||||||
|
|
||||||
#include "imaevm.h"
|
|
||||||
|
|
||||||
const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
|
|
||||||
[PKEY_HASH_MD4] = "md4",
|
|
||||||
[PKEY_HASH_MD5] = "md5",
|
|
||||||
[PKEY_HASH_SHA1] = "sha1",
|
|
||||||
[PKEY_HASH_RIPE_MD_160] = "rmd160",
|
|
||||||
[PKEY_HASH_SHA256] = "sha256",
|
|
||||||
[PKEY_HASH_SHA384] = "sha384",
|
|
||||||
[PKEY_HASH_SHA512] = "sha512",
|
|
||||||
[PKEY_HASH_SHA224] = "sha224",
|
|
||||||
};
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].
|
|
||||||
*/
|
|
||||||
static const uint8_t RSA_digest_info_MD5[] = {
|
|
||||||
0x30, 0x20, 0x30, 0x0C, 0x06, 0x08,
|
|
||||||
0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, /* OID */
|
|
||||||
0x05, 0x00, 0x04, 0x10
|
|
||||||
};
|
|
||||||
|
|
||||||
static const uint8_t RSA_digest_info_SHA1[] = {
|
|
||||||
0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
|
|
||||||
0x2B, 0x0E, 0x03, 0x02, 0x1A,
|
|
||||||
0x05, 0x00, 0x04, 0x14
|
|
||||||
};
|
|
||||||
|
|
||||||
static const uint8_t RSA_digest_info_RIPE_MD_160[] = {
|
|
||||||
0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
|
|
||||||
0x2B, 0x24, 0x03, 0x02, 0x01,
|
|
||||||
0x05, 0x00, 0x04, 0x14
|
|
||||||
};
|
|
||||||
|
|
||||||
static const uint8_t RSA_digest_info_SHA224[] = {
|
|
||||||
0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
|
|
||||||
0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
|
|
||||||
0x05, 0x00, 0x04, 0x1C
|
|
||||||
};
|
|
||||||
|
|
||||||
static const uint8_t RSA_digest_info_SHA256[] = {
|
|
||||||
0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
|
|
||||||
0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
|
|
||||||
0x05, 0x00, 0x04, 0x20
|
|
||||||
};
|
|
||||||
|
|
||||||
static const uint8_t RSA_digest_info_SHA384[] = {
|
|
||||||
0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
|
|
||||||
0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
|
|
||||||
0x05, 0x00, 0x04, 0x30
|
|
||||||
};
|
|
||||||
|
|
||||||
static const uint8_t RSA_digest_info_SHA512[] = {
|
|
||||||
0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
|
|
||||||
0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
|
|
||||||
0x05, 0x00, 0x04, 0x40
|
|
||||||
};
|
|
||||||
|
|
||||||
const struct RSA_ASN1_template RSA_ASN1_templates[PKEY_HASH__LAST] = {
|
|
||||||
#define _(X) { RSA_digest_info_##X, sizeof(RSA_digest_info_##X) }
|
|
||||||
[PKEY_HASH_MD5] = _(MD5),
|
|
||||||
[PKEY_HASH_SHA1] = _(SHA1),
|
|
||||||
[PKEY_HASH_RIPE_MD_160] = _(RIPE_MD_160),
|
|
||||||
[PKEY_HASH_SHA256] = _(SHA256),
|
|
||||||
[PKEY_HASH_SHA384] = _(SHA384),
|
|
||||||
[PKEY_HASH_SHA512] = _(SHA512),
|
|
||||||
[PKEY_HASH_SHA224] = _(SHA224),
|
|
||||||
#undef _
|
|
||||||
};
|
|
||||||
|
|
||||||
struct libevm_params params = {
|
|
||||||
.verbose = LOG_INFO - 1,
|
|
||||||
.hash_algo = "sha1",
|
|
||||||
};
|
|
||||||
|
|
||||||
void do_dump(FILE *fp, const void *ptr, int len, bool cr)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
uint8_t *data = (uint8_t *) ptr;
|
|
||||||
|
|
||||||
for (i = 0; i < len; i++)
|
|
||||||
fprintf(fp, "%02x", data[i]);
|
|
||||||
if (cr)
|
|
||||||
fprintf(fp, "\n");
|
|
||||||
}
|
|
||||||
|
|
||||||
void dump(const void *ptr, int len)
|
|
||||||
{
|
|
||||||
do_dump(stdout, ptr, len, true);
|
|
||||||
}
|
|
||||||
|
|
||||||
int get_filesize(const char *filename)
|
|
||||||
{
|
|
||||||
struct stat stats;
|
|
||||||
/* Need to know the file length */
|
|
||||||
stat(filename, &stats);
|
|
||||||
return (int)stats.st_size;
|
|
||||||
}
|
|
||||||
|
|
||||||
static inline int get_fdsize(int fd)
|
|
||||||
{
|
|
||||||
struct stat stats;
|
|
||||||
/* Need to know the file length */
|
|
||||||
fstat(fd, &stats);
|
|
||||||
return (int)stats.st_size;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int add_file_hash(const char *file, EVP_MD_CTX *ctx)
|
|
||||||
{
|
|
||||||
uint8_t *data;
|
|
||||||
int err, size, bs = DATA_SIZE;
|
|
||||||
size_t len;
|
|
||||||
FILE *fp;
|
|
||||||
|
|
||||||
data = malloc(bs);
|
|
||||||
if (!data) {
|
|
||||||
log_err("malloc failed\n");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
fp = fopen(file, "r");
|
|
||||||
if (!fp) {
|
|
||||||
log_err("Unable to open %s\n", file);
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
for (size = get_fdsize(fileno(fp)); size; size -= len) {
|
|
||||||
len = MIN(size, bs);
|
|
||||||
err = fread(data, len, 1, fp);
|
|
||||||
if (!err) {
|
|
||||||
if (ferror(fp)) {
|
|
||||||
log_err("fread() error\n\n");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
err = EVP_DigestUpdate(ctx, data, len);
|
|
||||||
if (!err) {
|
|
||||||
log_err("EVP_DigestUpdate() failed\n");
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
fclose(fp);
|
|
||||||
free(data);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int add_dir_hash(const char *file, EVP_MD_CTX *ctx)
|
|
||||||
{
|
|
||||||
int err;
|
|
||||||
struct dirent *de;
|
|
||||||
DIR *dir;
|
|
||||||
unsigned long long ino, off;
|
|
||||||
unsigned int type;
|
|
||||||
|
|
||||||
dir = opendir(file);
|
|
||||||
if (!dir) {
|
|
||||||
log_err("Unable to open %s\n", file);
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
while ((de = readdir(dir))) {
|
|
||||||
ino = de->d_ino;
|
|
||||||
off = de->d_off;
|
|
||||||
type = de->d_type;
|
|
||||||
log_debug("entry: %s, ino: %llu, type: %u, off: %llu, reclen: %hu\n",
|
|
||||||
de->d_name, ino, type, off, de->d_reclen);
|
|
||||||
err = EVP_DigestUpdate(ctx, de->d_name, strlen(de->d_name));
|
|
||||||
/*err |= EVP_DigestUpdate(ctx, &off, sizeof(off));*/
|
|
||||||
err |= EVP_DigestUpdate(ctx, &ino, sizeof(ino));
|
|
||||||
err |= EVP_DigestUpdate(ctx, &type, sizeof(type));
|
|
||||||
if (!err) {
|
|
||||||
log_err("EVP_DigestUpdate() failed\n");
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
closedir(dir);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int add_link_hash(const char *path, EVP_MD_CTX *ctx)
|
|
||||||
{
|
|
||||||
int err;
|
|
||||||
char buf[1024];
|
|
||||||
|
|
||||||
err = readlink(path, buf, sizeof(buf));
|
|
||||||
if (err <= 0)
|
|
||||||
return -1;
|
|
||||||
|
|
||||||
log_info("link: %s -> %.*s\n", path, err, buf);
|
|
||||||
return !EVP_DigestUpdate(ctx, buf, err);
|
|
||||||
}
|
|
||||||
|
|
||||||
static int add_dev_hash(struct stat *st, EVP_MD_CTX *ctx)
|
|
||||||
{
|
|
||||||
uint32_t dev = st->st_rdev;
|
|
||||||
unsigned major = (dev & 0xfff00) >> 8;
|
|
||||||
unsigned minor = (dev & 0xff) | ((dev >> 12) & 0xfff00);
|
|
||||||
log_info("device: %u:%u\n", major, minor);
|
|
||||||
return !EVP_DigestUpdate(ctx, &dev, sizeof(dev));
|
|
||||||
}
|
|
||||||
|
|
||||||
int ima_calc_hash(const char *file, uint8_t *hash)
|
|
||||||
{
|
|
||||||
struct stat st;
|
|
||||||
EVP_MD_CTX ctx;
|
|
||||||
const EVP_MD *md;
|
|
||||||
unsigned int mdlen;
|
|
||||||
int err;
|
|
||||||
|
|
||||||
/* Need to know the file length */
|
|
||||||
err = lstat(file, &st);
|
|
||||||
if (err < 0) {
|
|
||||||
log_err("stat() failed\n");
|
|
||||||
return err;
|
|
||||||
}
|
|
||||||
|
|
||||||
md = EVP_get_digestbyname(params.hash_algo);
|
|
||||||
if (!md) {
|
|
||||||
log_err("EVP_get_digestbyname() failed\n");
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
err = EVP_DigestInit(&ctx, md);
|
|
||||||
if (!err) {
|
|
||||||
log_err("EVP_DigestInit() failed\n");
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
switch (st.st_mode & S_IFMT) {
|
|
||||||
case S_IFREG:
|
|
||||||
err = add_file_hash(file, &ctx);
|
|
||||||
break;
|
|
||||||
case S_IFDIR:
|
|
||||||
err = add_dir_hash(file, &ctx);
|
|
||||||
break;
|
|
||||||
case S_IFLNK:
|
|
||||||
err = add_link_hash(file, &ctx);
|
|
||||||
break;
|
|
||||||
case S_IFIFO: case S_IFSOCK:
|
|
||||||
case S_IFCHR: case S_IFBLK:
|
|
||||||
err = add_dev_hash(&st, &ctx);
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
log_errno("Unsupported file type");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (err)
|
|
||||||
return err;
|
|
||||||
|
|
||||||
err = EVP_DigestFinal(&ctx, hash, &mdlen);
|
|
||||||
if (!err) {
|
|
||||||
log_err("EVP_DigestFinal() failed\n");
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
return mdlen;
|
|
||||||
}
|
|
||||||
|
|
||||||
RSA *read_pub_key(const char *keyfile, int x509)
|
|
||||||
{
|
|
||||||
FILE *fp;
|
|
||||||
RSA *key = NULL;
|
|
||||||
X509 *crt = NULL;
|
|
||||||
EVP_PKEY *pkey = NULL;
|
|
||||||
|
|
||||||
fp = fopen(keyfile, "r");
|
|
||||||
if (!fp) {
|
|
||||||
log_err("Unable to open keyfile %s\n", keyfile);
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (x509) {
|
|
||||||
crt = d2i_X509_fp(fp, NULL);
|
|
||||||
if (!crt) {
|
|
||||||
log_err("d2i_X509_fp() failed\n");
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
pkey = X509_extract_key(crt);
|
|
||||||
if (!pkey) {
|
|
||||||
log_err("X509_extract_key() failed\n");
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
key = EVP_PKEY_get1_RSA(pkey);
|
|
||||||
} else {
|
|
||||||
key = PEM_read_RSA_PUBKEY(fp, NULL, NULL, NULL);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!key)
|
|
||||||
log_err("PEM_read_RSA_PUBKEY() failed\n");
|
|
||||||
|
|
||||||
out:
|
|
||||||
if (pkey)
|
|
||||||
EVP_PKEY_free(pkey);
|
|
||||||
if (crt)
|
|
||||||
X509_free(crt);
|
|
||||||
fclose(fp);
|
|
||||||
return key;
|
|
||||||
}
|
|
||||||
|
|
||||||
int verify_hash_v1(const unsigned char *hash, int size, unsigned char *sig, int siglen, const char *keyfile)
|
|
||||||
{
|
|
||||||
int err, len;
|
|
||||||
SHA_CTX ctx;
|
|
||||||
unsigned char out[1024];
|
|
||||||
RSA *key;
|
|
||||||
unsigned char sighash[20];
|
|
||||||
struct signature_hdr *hdr = (struct signature_hdr *)sig;
|
|
||||||
|
|
||||||
log_info("hash: ");
|
|
||||||
log_dump(hash, size);
|
|
||||||
|
|
||||||
key = read_pub_key(keyfile, 0);
|
|
||||||
if (!key)
|
|
||||||
return 1;
|
|
||||||
|
|
||||||
SHA1_Init(&ctx);
|
|
||||||
SHA1_Update(&ctx, hash, size);
|
|
||||||
SHA1_Update(&ctx, hdr, sizeof(*hdr));
|
|
||||||
SHA1_Final(sighash, &ctx);
|
|
||||||
log_info("sighash: ");
|
|
||||||
log_dump(sighash, sizeof(sighash));
|
|
||||||
|
|
||||||
err = RSA_public_decrypt(siglen - sizeof(*hdr) - 2, sig + sizeof(*hdr) + 2, out, key, RSA_PKCS1_PADDING);
|
|
||||||
RSA_free(key);
|
|
||||||
if (err < 0) {
|
|
||||||
log_err("RSA_public_decrypt() failed: %d\n", err);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
len = err;
|
|
||||||
|
|
||||||
if (len != sizeof(sighash) || memcmp(out, sighash, len) != 0) {
|
|
||||||
log_err("Verification failed: %d\n", err);
|
|
||||||
return -1;
|
|
||||||
} else {
|
|
||||||
/*log_info("Verification is OK\n");*/
|
|
||||||
printf("Verification is OK\n");
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
int verify_hash_v2(const unsigned char *hash, int size, unsigned char *sig, int siglen, const char *keyfile)
|
|
||||||
{
|
|
||||||
int err, len;
|
|
||||||
unsigned char out[1024];
|
|
||||||
RSA *key;
|
|
||||||
struct signature_v2_hdr *hdr = (struct signature_v2_hdr *)sig;
|
|
||||||
const struct RSA_ASN1_template *asn1;
|
|
||||||
|
|
||||||
log_info("hash: ");
|
|
||||||
log_dump(hash, size);
|
|
||||||
|
|
||||||
key = read_pub_key(keyfile, 1);
|
|
||||||
if (!key)
|
|
||||||
return 1;
|
|
||||||
|
|
||||||
err = RSA_public_decrypt(siglen - sizeof(*hdr), sig + sizeof(*hdr), out, key, RSA_PKCS1_PADDING);
|
|
||||||
RSA_free(key);
|
|
||||||
if (err < 0) {
|
|
||||||
log_err("RSA_public_decrypt() failed: %d\n", err);
|
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
len = err;
|
|
||||||
|
|
||||||
asn1 = &RSA_ASN1_templates[hdr->hash_algo];
|
|
||||||
|
|
||||||
if (len < asn1->size || memcmp(out, asn1->data, asn1->size)) {
|
|
||||||
log_err("Verification failed: %d\n", err);
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
len -= asn1->size;
|
|
||||||
|
|
||||||
if (len != size || memcmp(out + asn1->size, hash, len)) {
|
|
||||||
log_err("Verification failed: %d\n", err);
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*log_info("Verification is OK\n");*/
|
|
||||||
printf("Verification is OK\n");
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
int get_hash_algo(const char *algo)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
for (i = 0; i < PKEY_HASH__LAST; i++)
|
|
||||||
if (!strcmp(algo, pkey_hash_algo[i]))
|
|
||||||
return i;
|
|
||||||
|
|
||||||
return PKEY_HASH_SHA1;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int get_hash_algo_from_sig(unsigned char *sig)
|
|
||||||
{
|
|
||||||
uint8_t hashalgo;
|
|
||||||
|
|
||||||
if (sig[0] == 1) {
|
|
||||||
hashalgo = ((struct signature_hdr *)sig)->hash;
|
|
||||||
|
|
||||||
if (hashalgo >= DIGEST_ALGO_MAX)
|
|
||||||
return -1;
|
|
||||||
|
|
||||||
switch (hashalgo) {
|
|
||||||
case DIGEST_ALGO_SHA1:
|
|
||||||
return PKEY_HASH_SHA1;
|
|
||||||
case DIGEST_ALGO_SHA256:
|
|
||||||
return PKEY_HASH_SHA256;
|
|
||||||
default:
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
} else if (sig[0] == 2) {
|
|
||||||
hashalgo = ((struct signature_v2_hdr *)sig)->hash_algo;
|
|
||||||
if (hashalgo >= PKEY_HASH__LAST)
|
|
||||||
return -1;
|
|
||||||
return hashalgo;
|
|
||||||
} else
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
int verify_hash(const unsigned char *hash, int size, unsigned char *sig, int siglen)
|
|
||||||
{
|
|
||||||
char *key;
|
|
||||||
int x509;
|
|
||||||
verify_hash_fn_t verify_hash;
|
|
||||||
|
|
||||||
/* Get signature type from sig header */
|
|
||||||
if (sig[0] == DIGSIG_VERSION_1) {
|
|
||||||
verify_hash = verify_hash_v1;
|
|
||||||
/* Read pubkey from RSA key */
|
|
||||||
x509 = 0;
|
|
||||||
} else if (sig[0] == DIGSIG_VERSION_2) {
|
|
||||||
verify_hash = verify_hash_v2;
|
|
||||||
/* Read pubkey from x509 cert */
|
|
||||||
x509 = 1;
|
|
||||||
} else
|
|
||||||
return -1;
|
|
||||||
|
|
||||||
/* Determine what key to use for verification*/
|
|
||||||
key = params.keyfile ? : x509 ?
|
|
||||||
"/etc/keys/x509_evm.der" :
|
|
||||||
"/etc/keys/pubkey_evm.pem";
|
|
||||||
|
|
||||||
return verify_hash(hash, size, sig, siglen, key);
|
|
||||||
}
|
|
||||||
|
|
||||||
int ima_verify_signature(const char *file, unsigned char *sig, int siglen)
|
|
||||||
{
|
|
||||||
unsigned char hash[64];
|
|
||||||
int hashlen, sig_hash_algo;
|
|
||||||
|
|
||||||
if (sig[0] != 0x03) {
|
|
||||||
log_err("security.ima has no signature\n");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
sig_hash_algo = get_hash_algo_from_sig(sig + 1);
|
|
||||||
if (sig_hash_algo < 0) {
|
|
||||||
log_err("Invalid signature\n");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
/* Use hash algorithm as retrieved from signature */
|
|
||||||
params.hash_algo = pkey_hash_algo[sig_hash_algo];
|
|
||||||
|
|
||||||
hashlen = ima_calc_hash(file, hash);
|
|
||||||
if (hashlen <= 1)
|
|
||||||
return hashlen;
|
|
||||||
|
|
||||||
return verify_hash(hash, hashlen, sig + 1, siglen - 1);
|
|
||||||
}
|
|
7
tests/Makefile.am
Normal file
7
tests/Makefile.am
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
pkglib_PROGRAMS = openclose
|
||||||
|
|
||||||
|
openclose_SOURCES = openclose.c
|
||||||
|
|
||||||
|
dist_pkglib_SCRIPTS = evm_enable.sh evm_genkey.sh evm_sign_all.sh evm_sign_modules.sh ima_fix_dir.sh \
|
||||||
|
evm_hmac_all.sh evm_hmac_modules.sh
|
||||||
|
|
25
tests/evm_enable.sh
Executable file
25
tests/evm_enable.sh
Executable file
@ -0,0 +1,25 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
# import EVM HMAC key
|
||||||
|
keyctl clear @u
|
||||||
|
keyctl add user kmk "testing123" @u
|
||||||
|
keyctl add encrypted evm-key "load `cat /etc/keys/evm-key`" @u
|
||||||
|
|
||||||
|
# import Moule public key
|
||||||
|
mod_id=`keyctl newring _module @u`
|
||||||
|
evmctl import /etc/keys/pubkey_evm.pem $mod_id
|
||||||
|
|
||||||
|
# import IMA public key
|
||||||
|
ima_id=`keyctl newring _ima @u`
|
||||||
|
evmctl import /etc/keys/pubkey_evm.pem $ima_id
|
||||||
|
|
||||||
|
# import EVM public key
|
||||||
|
evm_id=`keyctl newring _evm @u`
|
||||||
|
evmctl import /etc/keys/pubkey_evm.pem $evm_id
|
||||||
|
|
||||||
|
# enable EVM
|
||||||
|
echo "1" > /sys/kernel/security/evm
|
||||||
|
|
||||||
|
# enable module checking
|
||||||
|
echo "1" > /sys/kernel/security/ima/module_check
|
||||||
|
|
8
tests/evm_genkey.sh
Executable file
8
tests/evm_genkey.sh
Executable file
@ -0,0 +1,8 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
keyctl add user kmk "testing123" @u
|
||||||
|
key=`keyctl add encrypted evm-key "new user:kmk 32" @u`
|
||||||
|
keyctl print $key >/etc/keys/evm-key
|
||||||
|
|
||||||
|
keyctl list @u
|
||||||
|
|
14
tests/evm_hmac_all.sh
Executable file
14
tests/evm_hmac_all.sh
Executable file
@ -0,0 +1,14 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
verbose=""
|
||||||
|
if [ "$1" = "-v" ] ; then
|
||||||
|
verbose="-v"
|
||||||
|
shift 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
dir=${1:-/}
|
||||||
|
|
||||||
|
echo "Label: $dir"
|
||||||
|
|
||||||
|
find $dir \( -fstype rootfs -o -fstype ext3 -o -fstype ext4 \) \( -type f -o -type d \) -exec evmctl hmac --imahash $verbose '{}' \;
|
||||||
|
|
14
tests/evm_hmac_modules.sh
Executable file
14
tests/evm_hmac_modules.sh
Executable file
@ -0,0 +1,14 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
verbose=""
|
||||||
|
if [ "$1" = "-v" ] ; then
|
||||||
|
verbose="-v"
|
||||||
|
shift 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
dir=${1:-/lib/modules}
|
||||||
|
|
||||||
|
echo "HMAC modules: $dir"
|
||||||
|
|
||||||
|
find $dir -name "*.ko" -type f -exec evmctl hmac --imasig $verbose '{}' \;
|
||||||
|
|
14
tests/evm_sign_all.sh
Executable file
14
tests/evm_sign_all.sh
Executable file
@ -0,0 +1,14 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
verbose=""
|
||||||
|
if [ "$1" = "-v" ] ; then
|
||||||
|
verbose="-v"
|
||||||
|
shift 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
dir=${1:-/}
|
||||||
|
|
||||||
|
echo "Label: $dir"
|
||||||
|
|
||||||
|
find $dir \( -fstype rootfs -o -fstype ext3 -o -fstype ext4 \) -type f -exec evmctl sign --imahash $verbose '{}' \;
|
||||||
|
|
14
tests/evm_sign_modules.sh
Executable file
14
tests/evm_sign_modules.sh
Executable file
@ -0,0 +1,14 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
verbose=""
|
||||||
|
if [ "$1" = "-v" ] ; then
|
||||||
|
verbose="-v"
|
||||||
|
shift 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
dir=${1:-/lib/modules}
|
||||||
|
|
||||||
|
echo "Signing modules: $dir"
|
||||||
|
|
||||||
|
find $dir -name "*.ko" -type f -exec evmctl sign --imasig $verbose '{}' \;
|
||||||
|
|
8
tests/ima_fix_dir.sh
Executable file
8
tests/ima_fix_dir.sh
Executable file
@ -0,0 +1,8 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
dir=${1:-/}
|
||||||
|
|
||||||
|
echo "Fixing dir: $dir"
|
||||||
|
|
||||||
|
find $dir \( -fstype rootfs -o -fstype ext3 -o -fstype ext4 \) -type f -exec openclose '{}' \;
|
||||||
|
|
20
tests/openclose.c
Normal file
20
tests/openclose.c
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
#include <unistd.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <fcntl.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
|
||||||
|
int main(int argc, char *argv[])
|
||||||
|
{
|
||||||
|
int fd;
|
||||||
|
|
||||||
|
fd = open(argv[1], O_RDONLY);
|
||||||
|
if (fd < 0) {
|
||||||
|
perror("open()");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
close(fd);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
Reference in New Issue
Block a user