10 Commits

Author SHA1 Message Date
5af8cc781e patched for openssl1.1 interface with patch file from fedora porject https://fedora.pkgs.org/rawhide/fedora-x86_64/ima-evm-utils-1.0-3.fc28.x86_64.rpm.html 2018-01-13 16:59:58 +01:00
3e2a67bdb0 script to build static evmctl version
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
2015-10-01 22:42:45 +03:00
839a674580 Supply file attributes values on command line
Can be used by Android filesystem image creation tool.

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
2015-09-20 23:28:20 +03:00
e55d286ad6 Use single flag to indicate 'no'flag
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
2015-09-20 23:15:32 +03:00
28d99354de Use byte range values
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
2015-09-20 22:22:06 +03:00
ea5ccdf38f Newer kernels requires at least 64 byte keys
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
2015-09-20 22:22:00 +03:00
b0d13ba557 calc_evm_hmac/hash: avoid fd leak when ioctl fails
When opening the file succeeds but ioctl() then fails, the file must
be closed before returning.

Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
2015-09-09 23:02:01 +03:00
199311e6a5 ima_verify: ignore -n flag
"evmutil ima_verify -n <some file>" disabled using xattrs without enabling
using a signature file, resulting in the use of uninitialized memory in
ima_verify_signature() and thus unpredictable results.

Such a mode of operation makes no sense, so interpret -n as
documented ("print result to stdout instead of setting xattr") and ignore it
during ima_verify. Instead, switch between the two verification modes only
via the global sigfile variable.

Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
2015-09-09 22:50:45 +03:00
453d3db8a5 tpm_pcr_read: close file when returning early
When return from inside the for() loop, the open file was not
closed.

Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
2015-09-09 22:50:35 +03:00
fa0b30b15e add_dir_hash: fix DIR leak in case of failure
When bailing out of the function due to EVP_DigestUpdate()
failing, the DIR resources allocated with opendir() were
not freed.

Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
2015-09-09 22:50:18 +03:00
5 changed files with 427 additions and 72 deletions

2
README
View File

@ -142,7 +142,7 @@ EVM encrypted key is used for EVM HMAC calculation:
keyctl pipe `keyctl search @u user kmk` > /etc/keys/kmk
# create the EVM encrypted key
keyctl add encrypted evm-key "new user:kmk 32" @u
keyctl add encrypted evm-key "new user:kmk 64" @u
keyctl pipe `keyctl search @u encrypted evm-key` >/etc/keys/evm-key

4
build-static.sh Executable file
View File

@ -0,0 +1,4 @@
#!/bin/sh
gcc -static -o evmctl.static -include config.h src/evmctl.c src/libimaevm.c -lcrypto -lkeyutils -ldl

View File

@ -0,0 +1,224 @@
diff -urNp ima-evm-utils-1.0-orig/src/libimaevm.c ima-evm-utils-1.0/src/libimaevm.c
--- ima-evm-utils-1.0-orig/src/libimaevm.c 2015-07-30 15:28:53.000000000 -0300
+++ ima-evm-utils-1.0/src/libimaevm.c 2017-12-01 12:01:28.008705290 -0200
@@ -269,7 +269,7 @@ int ima_calc_hash(const char *file, uint
{
const EVP_MD *md;
struct stat st;
- EVP_MD_CTX ctx;
+ EVP_MD_CTX *ctx;
unsigned int mdlen;
int err;
@@ -286,25 +286,30 @@ int ima_calc_hash(const char *file, uint
return 1;
}
- err = EVP_DigestInit(&ctx, md);
+ ctx = EVP_MD_CTX_new();
+ if (!ctx) {
+ log_err("EVP_MD_CTX_new() failed\n");
+ return 1;
+ }
+ err = EVP_DigestInit_ex(ctx, md, NULL);
if (!err) {
- log_err("EVP_DigestInit() failed\n");
+ log_err("EVP_DigestInit_ex() failed\n");
return 1;
}
switch (st.st_mode & S_IFMT) {
case S_IFREG:
- err = add_file_hash(file, &ctx);
+ err = add_file_hash(file, ctx);
break;
case S_IFDIR:
- err = add_dir_hash(file, &ctx);
+ err = add_dir_hash(file, ctx);
break;
case S_IFLNK:
- err = add_link_hash(file, &ctx);
+ err = add_link_hash(file, ctx);
break;
case S_IFIFO: case S_IFSOCK:
case S_IFCHR: case S_IFBLK:
- err = add_dev_hash(&st, &ctx);
+ err = add_dev_hash(&st, ctx);
break;
default:
log_errno("Unsupported file type");
@@ -314,11 +319,12 @@ int ima_calc_hash(const char *file, uint
if (err)
return err;
- err = EVP_DigestFinal(&ctx, hash, &mdlen);
+ err = EVP_DigestFinal_ex(ctx, hash, &mdlen);
if (!err) {
- log_err("EVP_DigestFinal() failed\n");
+ log_err("EVP_DigestFinal_ex() failed\n");
return 1;
}
+ EVP_MD_CTX_free(ctx);
return mdlen;
}
@@ -547,6 +553,7 @@ int key2bin(RSA *key, unsigned char *pub
{
int len, b, offset = 0;
struct pubkey_hdr *pkh = (struct pubkey_hdr *)pub;
+ const BIGNUM *n, *e;
/* add key header */
pkh->version = 1;
@@ -556,18 +563,19 @@ int key2bin(RSA *key, unsigned char *pub
offset += sizeof(*pkh);
- len = BN_num_bytes(key->n);
- b = BN_num_bits(key->n);
+ RSA_get0_key(key, &n, &e, NULL);
+ len = BN_num_bytes(n);
+ b = BN_num_bits(n);
pub[offset++] = b >> 8;
pub[offset++] = b & 0xff;
- BN_bn2bin(key->n, &pub[offset]);
+ BN_bn2bin(n, &pub[offset]);
offset += len;
- len = BN_num_bytes(key->e);
- b = BN_num_bits(key->e);
+ len = BN_num_bytes(e);
+ b = BN_num_bits(e);
pub[offset++] = b >> 8;
pub[offset++] = b & 0xff;
- BN_bn2bin(key->e, &pub[offset]);
+ BN_bn2bin(e, &pub[offset]);
offset += len;
return offset;
diff -urNp ima-evm-utils-1.0-orig/src/evmctl.c ima-evm-utils-1.0/src/evmctl.c
--- ima-evm-utils-1.0-orig/src/evmctl.c 2015-07-30 15:28:53.000000000 -0300
+++ ima-evm-utils-1.0/src/evmctl.c 2017-12-01 12:00:39.683306265 -0200
@@ -305,7 +305,7 @@ static int calc_evm_hash(const char *fil
struct stat st;
int err;
uint32_t generation = 0;
- EVP_MD_CTX ctx;
+ EVP_MD_CTX *ctx;
unsigned int mdlen;
char **xattrname;
char xattr_value[1024];
@@ -345,9 +345,14 @@ static int calc_evm_hash(const char *fil
return -1;
}
- err = EVP_DigestInit(&ctx, EVP_sha1());
+ ctx = EVP_MD_CTX_new();
+ if (!ctx) {
+ log_err("EVP_MD_CTX_new() failed\n");
+ return 1;
+ }
+ err = EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
if (!err) {
- log_err("EVP_DigestInit() failed\n");
+ log_err("EVP_DigestInit_ex() failed\n");
return 1;
}
@@ -364,7 +369,7 @@ static int calc_evm_hash(const char *fil
/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
log_info("name: %s, size: %d\n", *xattrname, err);
log_debug_dump(xattr_value, err);
- err = EVP_DigestUpdate(&ctx, xattr_value, err);
+ err = EVP_DigestUpdate(ctx, xattr_value, err);
if (!err) {
log_err("EVP_DigestUpdate() failed\n");
return 1;
@@ -412,7 +417,7 @@ static int calc_evm_hash(const char *fil
log_debug("hmac_misc (%d): ", hmac_size);
log_debug_dump(&hmac_misc, hmac_size);
- err = EVP_DigestUpdate(&ctx, &hmac_misc, hmac_size);
+ err = EVP_DigestUpdate(ctx, &hmac_misc, hmac_size);
if (!err) {
log_err("EVP_DigestUpdate() failed\n");
return 1;
@@ -423,18 +428,19 @@ static int calc_evm_hash(const char *fil
if (err)
return -1;
- err = EVP_DigestUpdate(&ctx, (const unsigned char *)uuid, sizeof(uuid));
+ err = EVP_DigestUpdate(ctx, (const unsigned char *)uuid, sizeof(uuid));
if (!err) {
log_err("EVP_DigestUpdate() failed\n");
return 1;
}
}
- err = EVP_DigestFinal(&ctx, hash, &mdlen);
+ err = EVP_DigestFinal_ex(ctx, hash, &mdlen);
if (!err) {
log_err("EVP_DigestFinal() failed\n");
return 1;
}
+ EVP_MD_CTX_free(ctx);
return mdlen;
}
@@ -844,7 +850,7 @@ static int calc_evm_hmac(const char *fil
struct stat st;
int err = -1;
uint32_t generation = 0;
- HMAC_CTX ctx;
+ HMAC_CTX *ctx;
unsigned int mdlen;
char **xattrname;
unsigned char xattr_value[1024];
@@ -900,10 +906,15 @@ static int calc_evm_hmac(const char *fil
goto out;
}
- err = !HMAC_Init(&ctx, evmkey, sizeof(evmkey), EVP_sha1());
+ ctx = HMAC_CTX_new();
+ if (!ctx) {
+ log_err("HMAC_MD_CTX_new() failed\n");
+ goto out;
+ }
+ err = !HMAC_Init_ex(ctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
if (err) {
log_err("HMAC_Init() failed\n");
- goto out;
+ goto out_ctx_cleanup;
}
for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
@@ -919,7 +930,7 @@ static int calc_evm_hmac(const char *fil
/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
log_info("name: %s, size: %d\n", *xattrname, err);
log_debug_dump(xattr_value, err);
- err = !HMAC_Update(&ctx, xattr_value, err);
+ err = !HMAC_Update(ctx, xattr_value, err);
if (err) {
log_err("HMAC_Update() failed\n");
goto out_ctx_cleanup;
@@ -960,16 +971,16 @@ static int calc_evm_hmac(const char *fil
log_debug("hmac_misc (%d): ", hmac_size);
log_debug_dump(&hmac_misc, hmac_size);
- err = !HMAC_Update(&ctx, (const unsigned char *)&hmac_misc, hmac_size);
+ err = !HMAC_Update(ctx, (const unsigned char *)&hmac_misc, hmac_size);
if (err) {
log_err("HMAC_Update() failed\n");
goto out_ctx_cleanup;
}
- err = !HMAC_Final(&ctx, hash, &mdlen);
+ err = !HMAC_Final(ctx, hash, &mdlen);
if (err)
log_err("HMAC_Final() failed\n");
out_ctx_cleanup:
- HMAC_CTX_cleanup(&ctx);
+ HMAC_CTX_free(ctx);
out:
free(key);
return err ?: mdlen;

View File

@ -104,15 +104,24 @@ static int digest;
static int digsig;
static int sigfile;
static char *uuid_str;
static char *ino_str;
static char *uid_str;
static char *gid_str;
static char *mode_str;
static char *generation_str;
static char *caps_str;
static char *ima_str;
static char *selinux_str;
static char *search_type;
static int recursive;
static int msize;
static dev_t fs_dev;
static bool evm_immutable;
#define HMAC_FLAG_UUID 0x0001
#define HMAC_FLAG_UUID_SET 0x0002
static unsigned long hmac_flags = HMAC_FLAG_UUID;
#define HMAC_FLAG_NO_UUID 0x0001
#define HMAC_FLAG_CAPS_SET 0x0002
static unsigned long hmac_flags;
typedef int (*find_cb_t)(const char *path);
static int find(const char *path, int dts, find_cb_t func);
@ -200,7 +209,7 @@ static int hex_to_bin(char ch)
return -1;
}
static int hex2bin(uint8_t *dst, const char *src, size_t count)
static int hex2bin(void *dst, const char *src, size_t count)
{
int hi, lo;
@ -214,7 +223,7 @@ static int hex2bin(uint8_t *dst, const char *src, size_t count)
if ((hi < 0) || (lo < 0))
return -1;
*dst++ = (hi << 4) | lo;
*(uint8_t *)dst++ = (hi << 4) | lo;
}
return 0;
}
@ -275,7 +284,7 @@ static int get_uuid(struct stat *st, char *uuid)
FILE *fp;
size_t len;
if (hmac_flags & HMAC_FLAG_UUID_SET)
if (uuid_str)
return pack_uuid(uuid_str, uuid);
dev = st->st_dev;
@ -305,7 +314,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
struct stat st;
int err;
uint32_t generation = 0;
EVP_MD_CTX ctx;
EVP_MD_CTX *ctx;
unsigned int mdlen;
char **xattrname;
char xattr_value[1024];
@ -320,10 +329,21 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
return -1;
}
if (generation_str)
generation = strtoul(generation_str, NULL, 10);
if (ino_str)
st.st_ino = strtoul(ino_str, NULL, 10);
if (uid_str)
st.st_uid = strtoul(uid_str, NULL, 10);
if (gid_str)
st.st_gid = strtoul(gid_str, NULL, 10);
if (mode_str)
st.st_mode = strtoul(mode_str, NULL, 10);
if (!evm_immutable) {
if (S_ISREG(st.st_mode) || S_ISDIR(st.st_mode)) {
/* we cannot at the momement to get generation of special files..
* kernel API does not support it */
if ((S_ISREG(st.st_mode) || S_ISDIR(st.st_mode)) && !generation_str) {
/* we cannot at the momement to get generation of
special files kernel API does not support it */
int fd = open(file, 0);
if (fd < 0) {
@ -332,6 +352,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
}
if (ioctl(fd, FS_IOC_GETVERSION, &generation)) {
log_err("ioctl() failed\n");
close(fd);
return -1;
}
close(fd);
@ -345,13 +366,30 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
return -1;
}
err = EVP_DigestInit(&ctx, EVP_sha1());
ctx = EVP_MD_CTX_new();
if (!ctx) {
log_err("EVP_MD_CTX_new() failed\n");
return 1;
}
err = EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
if (!err) {
log_err("EVP_DigestInit() failed\n");
log_err("EVP_DigestInit_ex() failed\n");
return 1;
}
for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
if (!strcmp(*xattrname, XATTR_NAME_SELINUX) && selinux_str) {
strcpy(xattr_value, selinux_str);
err = strlen(selinux_str) + 1;
} else if (!strcmp(*xattrname, XATTR_NAME_IMA) && ima_str) {
hex2bin(xattr_value, ima_str, strlen(ima_str) / 2);
err = strlen(ima_str) / 2;
} else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) {
if (!caps_str)
continue;
strcpy(xattr_value, caps_str);
err = strlen(caps_str);
} else {
err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value));
if (err < 0) {
log_info("no xattr: %s\n", *xattrname);
@ -361,10 +399,11 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
log_info("skipping xattr: %s\n", *xattrname);
continue;
}
}
/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
log_info("name: %s, size: %d\n", *xattrname, err);
log_debug_dump(xattr_value, err);
err = EVP_DigestUpdate(&ctx, xattr_value, err);
err = EVP_DigestUpdate(ctx, xattr_value, err);
if (!err) {
log_err("EVP_DigestUpdate() failed\n");
return 1;
@ -412,29 +451,30 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
log_debug("hmac_misc (%d): ", hmac_size);
log_debug_dump(&hmac_misc, hmac_size);
err = EVP_DigestUpdate(&ctx, &hmac_misc, hmac_size);
err = EVP_DigestUpdate(ctx, &hmac_misc, hmac_size);
if (!err) {
log_err("EVP_DigestUpdate() failed\n");
return 1;
}
if (!evm_immutable && (hmac_flags & HMAC_FLAG_UUID)) {
if (!evm_immutable && !(hmac_flags & HMAC_FLAG_NO_UUID)) {
err = get_uuid(&st, uuid);
if (err)
return -1;
err = EVP_DigestUpdate(&ctx, (const unsigned char *)uuid, sizeof(uuid));
err = EVP_DigestUpdate(ctx, (const unsigned char *)uuid, sizeof(uuid));
if (!err) {
log_err("EVP_DigestUpdate() failed\n");
return 1;
}
}
err = EVP_DigestFinal(&ctx, hash, &mdlen);
err = EVP_DigestFinal_ex(ctx, hash, &mdlen);
if (!err) {
log_err("EVP_DigestFinal() failed\n");
return 1;
}
EVP_MD_CTX_free(ctx);
return mdlen;
}
@ -734,19 +774,17 @@ static int verify_ima(const char *file)
unsigned char sig[1024];
int len;
if (xattr) {
len = lgetxattr(file, "security.ima", sig, sizeof(sig));
if (len < 0) {
log_err("getxattr failed: %s\n", file);
return len;
}
}
if (sigfile) {
void *tmp = file2bin(file, "sig", &len);
memcpy(sig, tmp, len);
free(tmp);
} else {
len = lgetxattr(file, "security.ima", sig, sizeof(sig));
if (len < 0) {
log_err("getxattr failed: %s\n", file);
return len;
}
}
return ima_verify_signature(file, sig, len);
@ -765,6 +803,38 @@ static int cmd_verify_ima(struct command *cmd)
return verify_ima(file);
}
static int cmd_convert(struct command *cmd)
{
char *inkey;
unsigned char _pub[1024], *pub = _pub;
int len, err = 0;
char name[20];
uint8_t keyid[8];
RSA *key;
params.x509 = 0;
inkey = g_argv[optind++];
if (!inkey) {
inkey = params.x509 ? "/etc/keys/x509_evm.der" :
"/etc/keys/pubkey_evm.pem";
}
key = read_pub_key(inkey, params.x509);
if (!key)
return 1;
len = key2bin(key, pub);
calc_keyid_v1(keyid, name, pub, len);
bin2file(inkey, "bin", pub, len);
bin2file(inkey, "keyid", (const unsigned char *)name, strlen(name));
RSA_free(key);
return err;
}
static int cmd_import(struct command *cmd)
{
char *inkey, *ring = NULL;
@ -844,7 +914,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
struct stat st;
int err = -1;
uint32_t generation = 0;
HMAC_CTX ctx;
HMAC_CTX *ctx;
unsigned int mdlen;
char **xattrname;
unsigned char xattr_value[1024];
@ -887,6 +957,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
}
if (ioctl(fd, FS_IOC_GETVERSION, &generation)) {
log_err("ioctl() failed\n");
close(fd);
goto out;
}
close(fd);
@ -900,10 +971,15 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
goto out;
}
err = !HMAC_Init(&ctx, evmkey, sizeof(evmkey), EVP_sha1());
ctx = HMAC_CTX_new();
if (!ctx) {
log_err("HMAC_MD_CTX_new() failed\n");
goto out;
}
err = !HMAC_Init_ex(ctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
if (err) {
log_err("HMAC_Init() failed\n");
goto out;
goto out_ctx_cleanup;
}
for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
@ -919,7 +995,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
log_info("name: %s, size: %d\n", *xattrname, err);
log_debug_dump(xattr_value, err);
err = !HMAC_Update(&ctx, xattr_value, err);
err = !HMAC_Update(ctx, xattr_value, err);
if (err) {
log_err("HMAC_Update() failed\n");
goto out_ctx_cleanup;
@ -960,16 +1036,16 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
log_debug("hmac_misc (%d): ", hmac_size);
log_debug_dump(&hmac_misc, hmac_size);
err = !HMAC_Update(&ctx, (const unsigned char *)&hmac_misc, hmac_size);
err = !HMAC_Update(ctx, (const unsigned char *)&hmac_misc, hmac_size);
if (err) {
log_err("HMAC_Update() failed\n");
goto out_ctx_cleanup;
}
err = !HMAC_Final(&ctx, hash, &mdlen);
err = !HMAC_Final(ctx, hash, &mdlen);
if (err)
log_err("HMAC_Final() failed\n");
out_ctx_cleanup:
HMAC_CTX_cleanup(&ctx);
HMAC_CTX_free(ctx);
out:
free(key);
return err ?: mdlen;
@ -1143,6 +1219,7 @@ static int tpm_pcr_read(int idx, uint8_t *pcr, int len)
{
FILE *fp;
char *p, pcr_str[7], buf[70]; /* length of the TPM string */
int result = -1;
sprintf(pcr_str, "PCR-%d", idx);
@ -1158,11 +1235,12 @@ static int tpm_pcr_read(int idx, uint8_t *pcr, int len)
break;
if (!strncmp(p, pcr_str, 6)) {
hex2bin(pcr, p + 7, len);
return 0;
result = 0;
break;
}
}
fclose(fp);
return -1;
return result;
}
#define TCG_EVENT_NAME_LEN_MAX 255
@ -1460,6 +1538,14 @@ static void usage(void)
" --smack use extra SMACK xattrs for EVM\n"
" --m32 force EVM hmac/signature for 32 bit target system\n"
" --m64 force EVM hmac/signature for 64 bit target system\n"
" --ino use custom inode for EVM\n"
" --uid use custom UID for EVM\n"
" --gid use custom GID for EVM\n"
" --mode use custom Mode for EVM\n"
" --generation use custom Generation for EVM(unspecified: from FS, empty: use 0)\n"
" --ima use custom IMA signature for EVM\n"
" --selinux use custom Selinux label for EVM\n"
" --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n"
" -v increase verbosity level\n"
" -h, --help display this help and exit\n"
"\n");
@ -1469,6 +1555,7 @@ struct command cmds[] = {
{"--version", NULL, 0, ""},
{"help", cmd_help, 0, "<command>"},
{"import", cmd_import, 0, "[--rsa] pubkey keyring", "Import public key into the keyring.\n"},
{"convert", cmd_convert, 0, "key", "convert public key into the keyring.\n"},
{"sign", cmd_sign_evm, 0, "[-r] [--imahash | --imasig ] [--key key] [--pass [password] file", "Sign file metadata.\n"},
{"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"},
{"ima_sign", cmd_sign_ima, 0, "[--sigfile] [--key key] [--pass [password] file", "Make file content signature.\n"},
@ -1498,8 +1585,16 @@ static struct option opts[] = {
{"recursive", 0, 0, 'r'},
{"m32", 0, 0, '3'},
{"m64", 0, 0, '6'},
{"smack", 0, 0, 256},
{"version", 0, 0, 257},
{"smack", 0, 0, 128},
{"version", 0, 0, 129},
{"inode", 1, 0, 130},
{"uid", 1, 0, 131},
{"gid", 1, 0, 132},
{"mode", 1, 0, 133},
{"generation", 1, 0, 134},
{"ima", 1, 0, 135},
{"selinux", 1, 0, 136},
{"caps", 2, 0, 137},
{}
};
@ -1580,14 +1675,11 @@ int main(int argc, char *argv[])
break;
case 'f':
sigfile = 1;
xattr = 0;
break;
case 'u':
uuid_str = optarg;
if (uuid_str)
hmac_flags |= HMAC_FLAG_UUID_SET;
else
hmac_flags &= ~HMAC_FLAG_UUID;
if (!uuid_str)
hmac_flags |= HMAC_FLAG_NO_UUID;
break;
case '1':
params.x509 = 0;
@ -1610,13 +1702,38 @@ int main(int argc, char *argv[])
case '6':
msize = 64;
break;
case 256:
case 128:
evm_config_xattrnames = evm_extra_smack_xattrs;
break;
case 257:
case 129:
printf("evmctl %s\n", VERSION);
exit(0);
break;
case 130:
ino_str = optarg;
break;
case 131:
uid_str = optarg;
break;
case 132:
gid_str = optarg;
break;
case 133:
mode_str = optarg;
break;
case 134:
generation_str = optarg;
break;
case 135:
ima_str = optarg;
break;
case 136:
selinux_str = optarg;
break;
case 137:
caps_str = optarg;
hmac_flags |= HMAC_FLAG_CAPS_SET;
break;
case '?':
exit(1);
break;

View File

@ -214,6 +214,7 @@ static int add_dir_hash(const char *file, EVP_MD_CTX *ctx)
DIR *dir;
unsigned long long ino, off;
unsigned int type;
int result = 0;
dir = opendir(file);
if (!dir) {
@ -233,13 +234,14 @@ static int add_dir_hash(const char *file, EVP_MD_CTX *ctx)
err |= EVP_DigestUpdate(ctx, &type, sizeof(type));
if (!err) {
log_err("EVP_DigestUpdate() failed\n");
return 1;
result = 1;
break;
}
}
closedir(dir);
return 0;
return result;
}
static int add_link_hash(const char *path, EVP_MD_CTX *ctx)
@ -269,7 +271,7 @@ int ima_calc_hash(const char *file, uint8_t *hash)
{
const EVP_MD *md;
struct stat st;
EVP_MD_CTX ctx;
EVP_MD_CTX *ctx;
unsigned int mdlen;
int err;
@ -286,25 +288,30 @@ int ima_calc_hash(const char *file, uint8_t *hash)
return 1;
}
err = EVP_DigestInit(&ctx, md);
ctx = EVP_MD_CTX_new();
if (!ctx) {
log_err("EVP_MD_CTX_new() failed\n");
return 1;
}
err = EVP_DigestInit_ex(ctx, md, NULL);
if (!err) {
log_err("EVP_DigestInit() failed\n");
log_err("EVP_DigestInit_ex() failed\n");
return 1;
}
switch (st.st_mode & S_IFMT) {
case S_IFREG:
err = add_file_hash(file, &ctx);
err = add_file_hash(file, ctx);
break;
case S_IFDIR:
err = add_dir_hash(file, &ctx);
err = add_dir_hash(file, ctx);
break;
case S_IFLNK:
err = add_link_hash(file, &ctx);
err = add_link_hash(file, ctx);
break;
case S_IFIFO: case S_IFSOCK:
case S_IFCHR: case S_IFBLK:
err = add_dev_hash(&st, &ctx);
err = add_dev_hash(&st, ctx);
break;
default:
log_errno("Unsupported file type");
@ -314,11 +321,12 @@ int ima_calc_hash(const char *file, uint8_t *hash)
if (err)
return err;
err = EVP_DigestFinal(&ctx, hash, &mdlen);
err = EVP_DigestFinal_ex(ctx, hash, &mdlen);
if (!err) {
log_err("EVP_DigestFinal() failed\n");
log_err("EVP_DigestFinal_ex() failed\n");
return 1;
}
EVP_MD_CTX_free(ctx);
return mdlen;
}
@ -373,7 +381,7 @@ int verify_hash_v1(const unsigned char *hash, int size, unsigned char *sig, int
unsigned char sighash[20];
struct signature_hdr *hdr = (struct signature_hdr *)sig;
log_info("hash: ");
log_info("hash-v1: ");
log_dump(hash, size);
key = read_pub_key(keyfile, 0);
@ -547,6 +555,7 @@ int key2bin(RSA *key, unsigned char *pub)
{
int len, b, offset = 0;
struct pubkey_hdr *pkh = (struct pubkey_hdr *)pub;
const BIGNUM *n, *e;
/* add key header */
pkh->version = 1;
@ -556,18 +565,19 @@ int key2bin(RSA *key, unsigned char *pub)
offset += sizeof(*pkh);
len = BN_num_bytes(key->n);
b = BN_num_bits(key->n);
RSA_get0_key(key, &n, &e, NULL);
len = BN_num_bytes(n);
b = BN_num_bits(n);
pub[offset++] = b >> 8;
pub[offset++] = b & 0xff;
BN_bn2bin(key->n, &pub[offset]);
BN_bn2bin(n, &pub[offset]);
offset += len;
len = BN_num_bytes(key->e);
b = BN_num_bits(key->e);
len = BN_num_bytes(e);
b = BN_num_bits(e);
pub[offset++] = b >> 8;
pub[offset++] = b & 0xff;
BN_bn2bin(key->e, &pub[offset]);
BN_bn2bin(e, &pub[offset]);
offset += len;
return offset;
@ -587,7 +597,7 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len
id = __be64_to_cpup((__be64 *) keyid);
sprintf(str, "%llX", (unsigned long long)id);
log_info("keyid: %s\n", str);
log_info("keyid-v1: %s\n", str);
}
void calc_keyid_v2(uint32_t *keyid, char *str, RSA *key)
@ -719,7 +729,7 @@ int sign_hash_v1(const char *hashalgo, const unsigned char *hash, int size, cons
blen = (uint16_t *) (sig + sizeof(*hdr));
*blen = __cpu_to_be16(len << 3);
len += sizeof(*hdr) + 2;
log_info("evm/ima signature: %d bytes\n", len);
log_info("evm/ima signature-v1: %d bytes\n", len);
out:
RSA_free(key);
return len;