开源软件构建与测试

_service:tar_scm:ima-evm-utils.spec Changed

@@ -1,18 +1,15 @@
 Name:         ima-evm-utils
-Version:      1.3.2
-Release:      9
+Version:      1.5
+Release:      1
 Summary:      IMA/EVM control utilities
 License:      GPLv2
 URL:          http://linux-ima.sourceforge.net/
-Source0:      http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz
+Source0:      https://github.com/mimizohar/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.tar.gz
 
-Patch6000:    ima-evm-utils-Support-SM2-3-algorithm-for-sign-and-v.patch
-Patch6001:    ima-evm-utils-Fix-incorrect-algorithm-name-in-hash_i.patch
-
-Patch9000:    add-save-command-to-support-digest-list-building.patch
-Patch9001:    fix-caps-parameter-cannot-be-parsed.patch
-Patch9002:    add-sm3-option.patch
-Patch9003:    skip-test-error-in-docker.patch
+Patch9000:    0001-add-save-command-to-support-digest-list-building.patch
+Patch9001:    0002-fix-caps-parameter-cannot-be-parsed.patch
+Patch9002:    0003-add-sm3-option.patch
+Patch9003:    0004-Skip-test-error-in-docker.patch
 
 BuildRequires: autoconf automake libtool asciidoc vim-common
 BuildRequires: libxslt openssl openssl-devel keyutils-libs-devel tpm2-tss-devel
@@ -54,6 +51,9 @@
 %make_install
 find %{buildroot} -type f -name "*.la" -delete -print
 
+cp -a %{_libdir}/libimaevm.so.2.0.0 %{buildroot}%{_libdir}/libimaevm.so.2.0.0
+ln -s -f %{buildroot}%{_libdir}/libimaevm.so.2.0.0 %{buildroot}%{_libdir}/libimaevm.so.2
+
 %check
 make check
 
@@ -80,6 +80,15 @@
 %endif
 
 %changelog
+* Fri Jul 28 2023 zhoushuiqing <zhoushuiqing2@huawei.com> - 1.5-1
+- Upgrade to 1.5 with compatibility
+
+* Thu Jul 27 2023 zhoushuiqing <zhoushuiqing2@huawei.com> - 1.3.2-10
+- Revert "Upgrade to 1.5"
+
+* Thu Jul 20 2023 zhoushuiqing <zhoushuiqing2@huawei.com> - 1.5-1
+- Upgrade to 1.5
+
 * Mon Feb 6 2023 gaoyusong <gaoyusong2@huawei.com> - 1.3.2-9
 - fix i686 build issue

_service:tar_scm:0001-add-save-command-to-support-digest-list-building.patch Added

@@ -0,0 +1,183 @@
+From bf460c8e2001ec1227ce5a9ecf44d24782d43871 Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Thu, 21 Jan 2021 08:16:34 +0800
+Subject: PATCH add save command to support digest list building
+
+This patch adds save command to support IMA digest list.
+
+Signed-off-by: Tianxing Zhang <benjamin93@163.com>
+Signed-off-by: zhoushuiqing <zhoushuiqing2@huawei.com>
+---
+ src/evmctl.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 59 insertions(+), 6 deletions(-)
+
+diff --git a/src/evmctl.c b/src/evmctl.c
+index 6d2bb67..70d07a5 100644
+--- a/src/evmctl.c
++++ b/src/evmctl.c
+@@ -121,6 +121,7 @@ static int sigdump;
+ static int digest;
+ static int digsig;
+ static int sigfile;
++static int datafile;
+ static char *uuid_str;
+ static char *ino_str;
+ static char *uid_str;
+@@ -173,7 +174,8 @@ static unsigned npcrfile;
+ #define log_errno_reset(level, fmt, args...) \
+ 	{do_log(level, fmt " (errno: %s)\n", ##args, strerror(errno)); errno = 0; }
+ 
+-static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)
++static int _bin2file(const char *file, const char *ext,
++		     const unsigned char *data, int len, const char *mode)
+ {
+ 	FILE *fp;
+ 	char namestrlen(file) + (ext ? strlen(ext) : 0) + 2;
+@@ -186,7 +188,7 @@ static int bin2file(const char *file, const char *ext, const unsigned char *data
+ 
+ 	log_info("Writing to %s\n", name);
+ 
+-	fp = fopen(name, "w");
++	fp = fopen(name, mode);
+ 	if (!fp) {
+ 		log_err("Failed to open: %s\n", name);
+ 		return -1;
+@@ -196,6 +198,18 @@ static int bin2file(const char *file, const char *ext, const unsigned char *data
+ 	return err;
+ }
+ 
++static int bin2file(const char *file, const char *ext,
++		    const unsigned char *data, int len)
++{
++	return _bin2file(file, ext, data, len, "w");
++}
++
++static int bin2file_append(const char *file, const char *ext,
++			   const unsigned char *data, int len)
++{
++	return _bin2file(file, ext, data, len, "a");
++}
++
+ static unsigned char *file2bin(const char *file, const char *ext, int *size)
+ {
+ 	FILE *fp;
+@@ -365,6 +379,9 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
+ 		return -1;
+ 	}
+ 
++	if (datafile)
++		bin2file(file, "data", NULL, 0);
++
+ 	if (generation_str)
+ 		generation = strtoul(generation_str, NULL, 10);
+ 	if (ino_str)
+@@ -376,7 +393,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
+ 	if (mode_str)
+ 		st.st_mode = strtoul(mode_str, NULL, 10);
+ 
+-	if (!evm_immutable) {
++	if (!evm_immutable && !evm_portable) {
+ 		if (S_ISREG(st.st_mode) && !generation_str) {
+ 			int fd = open(file, 0);
+ 
+@@ -478,7 +495,11 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
+ 		log_info("name: %s, size: %d\n",
+ 			 use_xattr_ima ? xattr_ima : *xattrname, err);
+ 		log_debug_dump(xattr_value, err);
+-		err = EVP_DigestUpdate(pctx, xattr_value, err);
++		if (datafile)
++			err = bin2file_append(file, "data",
++				(const unsigned char *)xattr_value, err);
++		else
++			err = EVP_DigestUpdate(pctx, xattr_value, err);
+ 		if (!err) {
+ 			log_err("EVP_DigestUpdate() failed\n");
+ 			goto out;
+@@ -532,7 +553,11 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
+ 	log_debug("hmac_misc (%d): ", hmac_size);
+ 	log_debug_dump(&hmac_misc, hmac_size);
+ 
+-	err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size);
++	if (datafile)
++		err = bin2file_append(file, "data",
++			(const unsigned char *)&hmac_misc, hmac_size);
++	else
++		err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size);
+ 	if (!err) {
+ 		log_err("EVP_DigestUpdate() failed\n");
+ 		goto out;
+@@ -593,6 +618,9 @@ static int sign_evm(const char *file, const char *key)
+ 	if (sigdump || imaevm_params.verbose >= LOG_INFO)
+ 		imaevm_hexdump(sig, len);
+ 
++	if (sigfile)
++		bin2file(file, "sig", sig, len);
++
+ 	if (xattr) {
+ 		err = lsetxattr(file, xattr_evm, sig, len, 0);
+ 		if (err < 0) {
+@@ -605,6 +633,21 @@ static int sign_evm(const char *file, const char *key)
+ 	return 0;
+ }
+ 
++static int save_evm(const char *file)
++{
++	unsigned char hashMAX_DIGEST_SIZE;
++	int len;
++
++	datafile = 1;
++
++	len = calc_evm_hash(file, hash);
++	if (len <= 1)
++		return len;
++	assert(len <= sizeof(hash));
++
++	return 0;
++}
++
+ static int hash_ima(const char *file)
+ {
+ 	unsigned char hashMAX_DIGEST_SIZE + 2; /* +2 byte xattr header */
+@@ -717,7 +760,7 @@ static int get_file_type(const char *path, const char *search_type)
+ 
+ static int do_cmd(struct command *cmd, find_cb_t func)
+ {
+-	char *path = g_argvoptind++;
++	char *path = g_argvoptind++, *path_ptr;
+ 	int err, dts = REG_MASK; /* only regular files by default */
+ 
+ 	if (!path) {
+@@ -726,6 +769,10 @@ static int do_cmd(struct command *cmd, find_cb_t func)
+ 		return -1;
+ 	}
+ 
++	path_ptr = path + strlen(path) - 1;
++	if (*path_ptr == '/')
++		*path_ptr = '\0';
++
+ 	if (recursive) {
+ 		if (search_type) {
+ 			dts = get_file_type(path, search_type);
+@@ -905,6 +952,11 @@ static int cmd_sign_evm(struct command *cmd)
+ 	return do_cmd(cmd, sign_evm_path);
+ }
+ 
++static int cmd_save_evm(struct command *cmd)
++{
++	return do_cmd(cmd, save_evm);
++}
++
+ static int verify_evm(const char *file)
+ {
+ 	unsigned char hashMAX_DIGEST_SIZE;
+@@ -2874,6 +2926,7 @@ struct command cmds = {
+ 	{"import", cmd_import, 0, "pubkey keyring", "Import public key into the keyring.\n"},
+ #endif
+ 	{"sign", cmd_sign_evm, 0, "-r --imahash | --imasig  --key key --pass=<password> file", "Sign file metadata.\n"},
++	{"save", cmd_save_evm, 0, "-r --imahash | --imasig  file", "Save file metadata.\n"},
+ 	{"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"},
+ 	{"ima_sign", cmd_sign_ima, 0, "--sigfile --key key --pass=<password> file", "Make file content signature.\n"},
+ 	{"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"},
+-- 
+2.33.0
+

_service:tar_scm:0002-fix-caps-parameter-cannot-be-parsed.patch Added

@@ -0,0 +1,35 @@
+From 24c9623f563646695f6d219b2414b23f36378b42 Mon Sep 17 00:00:00 2001
+From: shenxiangwei <shenxiangwei1@huawei.com>
+Date: Fri, 19 Aug 2022 12:05:11 +0800
+Subject: PATCH fix caps parameter cannot be parsed
+
+Signed-off-by: shenxiangwei <shenxiangwei1@huawei.com>
+Signed-off-by: zhoushuiqing <zhoushuiqing2@huawei.com>
+---
+ src/evmctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/evmctl.c b/src/evmctl.c
+index 70d07a5..19175b8 100644
+--- a/src/evmctl.c
++++ b/src/evmctl.c
+@@ -472,14 +472,14 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
+ 		} else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) {
+ 			if (!caps_str)
+ 				continue;
+-			err = strlen(caps_str);
++			hex2bin(xattr_value, caps_str, strlen(caps_str) >> 1);
++			err = strlen(caps_str) >> 1;
+ 			if (err >= sizeof(xattr_value)) {
+ 				log_err("caps%u value is too long to fit into xattr%zu\n",
+ 					err + 1, sizeof(xattr_value));
+ 				err = -1;
+ 				goto out;
+ 			}
+-			strcpy(xattr_value, caps_str);
+ 		} else {
+ 			err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value));
+ 			if (err < 0) {
+-- 
+2.33.0
+

_service:tar_scm:0003-add-sm3-option.patch Added

_service:tar_scm:0004-Skip-test-error-in-docker.patch Added

@@ -0,0 +1,58 @@
+From c152f534a661e9f2cb0ee125e1087df3c389dcd9 Mon Sep 17 00:00:00 2001
+From: shenxiangwei <shenxiangwei1@huawei.com>
+Date: Mon, 26 Sep 2022 19:36:25 +0800
+Subject: PATCH Skip test error in docker
+
+Signed-off-by: zhoushuiqing <zhoushuiqing2@huawei.com>
+---
+ tests/ima_hash.test    |  5 +++++
+ tests/sign_verify.test | 10 ++++++++++
+ 2 files changed, 15 insertions(+)
+
+diff --git a/tests/ima_hash.test b/tests/ima_hash.test
+index e88fd59..abf544a 100755
+--- a/tests/ima_hash.test
++++ b/tests/ima_hash.test
+@@ -24,6 +24,11 @@ trap _report_exit_and_cleanup EXIT
+ set -f # disable globbing
+ 
+ check() {
++  cat /proc/fs/ext4/sda1/options | grep xattr
++  if  `echo $?` -ne 0 ;then
++          return "$SKIP"
++  fi
++
+   local alg=$1 prefix=$2 chash=$3 hash
+   local file=$alg-hash.txt
+ 
+diff --git a/tests/sign_verify.test b/tests/sign_verify.test
+index 2bc365a..eeb75ef 100755
+--- a/tests/sign_verify.test
++++ b/tests/sign_verify.test
+@@ -136,6 +136,11 @@ check_sign() {
+   # PREFIX (signature header prefix in hex),
+   # OPTS (additional options for evmctl),
+   # FILE (working file to sign).
++  cat /proc/fs/ext4/sda1/options | grep xattr
++  if  `echo $?` -ne 0 ;then
++          return "$SKIP"
++  fi
++
+   local "$@"
+   local key verifykey
+   local FILE=${FILE:-$ALG.txt}
+@@ -246,6 +251,11 @@ check_verify() {
+   # ALG (hash algo),
+   # OPTS (additional options for evmctl),
+   # FILE (filename to verify).
++  cat /proc/fs/ext4/sda1/options | grep xattr
++  if  `echo $?` -ne 0 ;then
++	  return "$SKIP"
++  fi
++
+   local "$@"
+ 
+   # shellcheck disable=SC2086
+-- 
+2.33.0
+

_service:tar_scm:add-save-command-to-support-digest-list-building.patch Deleted

@@ -1,191 +0,0 @@
-From 6e607f4c5b3a608477bfc10405fb3c1f2ef93024 Mon Sep 17 00:00:00 2001
-From: Roberto Sassu <roberto.sassu@huawei.com>
-Date: Thu, 21 Jan 2021 08:16:34 +0800
-Subject: PATCH add save command to support digest list building
-
-This patch adds save command to support IMA digest list.
-
-Signed-off-by: Tianxing Zhang <benjamin93@163.com>
----
- src/evmctl.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++------
- 1 file changed, 60 insertions(+), 7 deletions(-)
-
-diff --git a/src/evmctl.c b/src/evmctl.c
-index 1815f55..439713d 100644
---- a/src/evmctl.c
-+++ b/src/evmctl.c
-@@ -115,6 +115,7 @@ static int sigdump;
- static int digest;
- static int digsig;
- static int sigfile;
-+static int datafile;
- static char *uuid_str;
- static char *ino_str;
- static char *uid_str;
-@@ -165,7 +166,8 @@ struct tpm_bank_info {
- static char *pcrfileMAX_PCRFILE;
- static unsigned npcrfile;
- 
--static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)
-+static int _bin2file(const char *file, const char *ext,
-+		     const unsigned char *data, int len, const char *mode)
- {
- 	FILE *fp;
- 	char namestrlen(file) + (ext ? strlen(ext) : 0) + 2;
-@@ -178,7 +180,7 @@ static int bin2file(const char *file, const char *ext, const unsigned char *data
- 
- 	log_info("Writing to %s\n", name);
- 
--	fp = fopen(name, "w");
-+	fp = fopen(name, mode);
- 	if (!fp) {
- 		log_err("Failed to open: %s\n", name);
- 		return -1;
-@@ -188,6 +190,18 @@ static int bin2file(const char *file, const char *ext, const unsigned char *data
- 	return err;
- }
- 
-+static int bin2file(const char *file, const char *ext,
-+		    const unsigned char *data, int len)
-+{
-+	return _bin2file(file, ext, data, len, "w");
-+}
-+
-+static int bin2file_append(const char *file, const char *ext,
-+			   const unsigned char *data, int len)
-+{
-+	return _bin2file(file, ext, data, len, "a");
-+}
-+
- static unsigned char *file2bin(const char *file, const char *ext, int *size)
- {
- 	FILE *fp;
-@@ -353,6 +367,9 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
- 		return -1;
- 	}
- 
-+	if (datafile)
-+		bin2file(file, "data", NULL, 0);
-+
- 	if (generation_str)
- 		generation = strtoul(generation_str, NULL, 10);
- 	if (ino_str)
-@@ -364,7 +381,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
- 	if (mode_str)
- 		st.st_mode = strtoul(mode_str, NULL, 10);
- 
--	if (!evm_immutable) {
-+	if (!evm_immutable && !evm_portable) {
- 		if ((S_ISREG(st.st_mode) || S_ISDIR(st.st_mode)) && !generation_str) {
- 			/* we cannot at the momement to get generation of
- 			   special files kernel API does not support it */
-@@ -444,7 +461,11 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
- 		/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
- 		log_info("name: %s, size: %d\n", *xattrname, err);
- 		log_debug_dump(xattr_value, err);
--		err = EVP_DigestUpdate(pctx, xattr_value, err);
-+		if (datafile)
-+			err = bin2file_append(file, "data",
-+				(const unsigned char *)xattr_value, err);
-+		else
-+			err = EVP_DigestUpdate(pctx, xattr_value, err);
- 		if (!err) {
- 			log_err("EVP_DigestUpdate() failed\n");
- 			return 1;
-@@ -498,7 +519,11 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
- 	log_debug("hmac_misc (%d): ", hmac_size);
- 	log_debug_dump(&hmac_misc, hmac_size);
- 
--	err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size);
-+	if (datafile)
-+		err = bin2file_append(file, "data",
-+			(const unsigned char *)&hmac_misc, hmac_size);
-+	else
-+		err = EVP_DigestUpdate(pctx, &hmac_misc, hmac_size);
- 	if (!err) {
- 		log_err("EVP_DigestUpdate() failed\n");
- 		return 1;
-@@ -555,6 +580,9 @@ static int sign_evm(const char *file, const char *key)
- 	if (sigdump || imaevm_params.verbose >= LOG_INFO)
- 		imaevm_hexdump(sig, len);
- 
-+	if (sigfile)
-+		bin2file(file, "sig", sig, len);
-+
- 	if (xattr) {
- 		err = lsetxattr(file, xattr_evm, sig, len, 0);
- 		if (err < 0) {
-@@ -566,6 +594,21 @@ static int sign_evm(const char *file, const char *key)
- 	return 0;
- }
- 
-+static int save_evm(const char *file)
-+{
-+	unsigned char hashMAX_DIGEST_SIZE;
-+	int len;
-+
-+	datafile = 1;
-+
-+	len = calc_evm_hash(file, hash);
-+	if (len <= 1)
-+		return len;
-+	assert(len <= sizeof(hash));
-+
-+	return 0;
-+}
-+
- static int hash_ima(const char *file)
- {
- 	unsigned char hashMAX_DIGEST_SIZE + 2; /* +2 byte xattr header */
-@@ -678,7 +721,7 @@ static int get_file_type(const char *path, const char *search_type)
- 
- static int do_cmd(struct command *cmd, find_cb_t func)
- {
--	char *path = g_argvoptind++;
-+	char *path = g_argvoptind++, *path_ptr;
- 	int err, dts = REG_MASK; /* only regular files by default */
- 
- 	if (!path) {
-@@ -687,6 +730,10 @@ static int do_cmd(struct command *cmd, find_cb_t func)
- 		return -1;
- 	}
- 
-+	path_ptr = path + strlen(path) - 1;
-+	if (*path_ptr == '/')
-+		*path_ptr = '\0';
-+
- 	if (recursive) {
- 		if (search_type) {
- 			dts = get_file_type(path, search_type);
-@@ -793,6 +840,11 @@ static int cmd_sign_evm(struct command *cmd)
- 	return do_cmd(cmd, sign_evm_path);
- }
- 
-+static int cmd_save_evm(struct command *cmd)
-+{
-+	return do_cmd(cmd, save_evm);
-+}
-+
- static int verify_evm(const char *file)
- {
- 	unsigned char hashMAX_DIGEST_SIZE;
-@@ -807,7 +859,7 @@ static int verify_evm(const char *file)
- 		return len;
- 	}
- 
--	if (sig0 != 0x03) {
-+	if (sig0 != 0x03 && sig0 != 0x05) {
- 		log_err("%s has no signature\n", xattr_evm);
- 		return -1;
- 	}
-@@ -2479,6 +2531,7 @@ struct command cmds = {
- 	{"import", cmd_import, 0, "--rsa pubkey keyring", "Import public key into the keyring.\n"},
- 	{"convert", cmd_convert, 0, "key", "convert public key into the keyring.\n"},
- 	{"sign", cmd_sign_evm, 0, "-r --imahash | --imasig  --key key --pass password file", "Sign file metadata.\n"},
-+	{"save", cmd_save_evm, 0, "-r --imahash | --imasig  file", "Save file metadata.\n"},
- 	{"verify", cmd_verify_evm, 0, "file", "Verify EVM signature (for debugging).\n"},
- 	{"ima_sign", cmd_sign_ima, 0, "--sigfile --key key --pass password file", "Make file content signature.\n"},
- 	{"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"},
--- 
-2.25.1
-

_service:tar_scm:add-sm3-option.patch Deleted

_service:tar_scm:fix-caps-parameter-cannot-be-parsed.patch Deleted

@@ -1,33 +0,0 @@
-From 40602a7926ec13819a5926d4ac451becb44b7d98 Mon Sep 17 00:00:00 2001
-From: shenxiangwei <shenxiangwei1@huawei.com>
-Date: Fri, 19 Aug 2022 12:05:11 +0800
-Subject: PATCH fix caps parameter cannot be parsed
-
-Signed-off-by: shenxiangwei <shenxiangwei1@huawei.com>
----
- src/evmctl.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/evmctl.c b/src/evmctl.c
-index 28f4b8d..6ef2f68 100644
---- a/src/evmctl.c
-+++ b/src/evmctl.c
-@@ -440,13 +440,13 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
- 		} else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) {
- 			if (!caps_str)
- 				continue;
--			err = strlen(caps_str);
-+			hex2bin(xattr_value, caps_str, strlen(caps_str) >> 1);
-+			err = strlen(caps_str) >> 1;
- 			if (err >= sizeof(xattr_value)) {
- 				log_err("caps%u value is too long to fit into xattr%zu\n",
- 					err + 1, sizeof(xattr_value));
- 				return -1;
- 			}
--			strcpy(xattr_value, caps_str);
- 		} else {
- 			err = lgetxattr(file, *xattrname, xattr_value, sizeof(xattr_value));
- 			if (err < 0) {
--- 
-2.27.0
-

_service:tar_scm:ima-evm-utils-Fix-incorrect-algorithm-name-in-hash_i.patch Deleted

@@ -1,48 +0,0 @@
-From 455a399c1f1605d3a96fa8b89b48f4c203a48951 Mon Sep 17 00:00:00 2001
-From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
-Date: Sat, 24 Jul 2021 17:56:47 +0800
-Subject: PATCH 2/2 ima-evm-utils: Fix incorrect algorithm name in
- hash_info.gen
-
-There is no such an algorithm name as sm3-256. This is an ambiguity
-caused by the definition of the macro HASH_ALGO_SM3_256. The sed
-command is only a special case of sm3, so sm3 is used to replace
-the sm3-256 algorithm name.
-
-Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
-Reviewed-by: Petr Vorel <pvorel@suse.cz>
-Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
-Signed-off-by: luhuaxin <luhuaxin1@huawei.com>
----
- src/.gitignore    | 1 +
- src/hash_info.gen | 7 ++++---
- 2 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/src/.gitignore b/src/.gitignore
-index 38e8e3c..69d2988 100644
---- a/src/.gitignore
-+++ b/src/.gitignore
-@@ -1 +1,2 @@
- hash_info.h
-+tmp_hash_info.h
-diff --git a/src/hash_info.gen b/src/hash_info.gen
-index 5f7a97f..08d4a94 100755
---- a/src/hash_info.gen
-+++ b/src/hash_info.gen
-@@ -84,9 +84,10 @@ echo "};"
- echo "const char *const hash_algo_nameHASH_ALGO__LAST = {"
- sed -n 's/HASH_ALGO_$.*$,/\1 \L\1\E/p' $HASH_INFO | \
-   while read a b; do
--    # Normalize text hash name: if it contains underscore between
--    # digits replace it with a dash, other underscores are removed.
--    b=$(echo "$b" | sed "s/$0-9$_$0-9$/\1-\2/g;s/_//g")
-+    # Normalize text hash name: sm3 algorithm name is different from
-+    # the macro definition, which is also the only special case of an
-+    # underscore between digits. Remove all other underscores.
-+    b=$(echo "$b" | sed "s/sm3_256/sm3/g;s/_//g")
-     printf '\t%-26s = "%s",\n' "HASH_ALGO_$a" "$b"
-   done
- echo "};"
--- 
-1.8.3.1
-

_service:tar_scm:ima-evm-utils-Support-SM2-3-algorithm-for-sign-and-v.patch Deleted

@@ -1,209 +0,0 @@
-From 17b9fc3fdbc3545efe9be6482bd7cc0a9fe30791 Mon Sep 17 00:00:00 2001
-From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
-Date: Wed, 21 Jul 2021 11:16:59 +0800
-Subject: PATCH 1/2 ima-evm-utils: Support SM2/3 algorithm for sign and
- verify
-
-Keep in sync with the kernel IMA, IMA signature tool supports SM2/3
-algorithm combination. Because in the current version of OpenSSL 1.1.1,
-the SM2 algorithm and the public key using the EC algorithm share the
-same ID 'EVP_PKEY_EC', and the specific algorithm can only be
-distinguished by the curve name used. This patch supports this feature.
-
-Secondly, the openssl 1.1.1 tool does not fully support the signature
-of SM2/3 algorithm combination, so the openssl3 tool is used in the
-test case, and there is no this problem with directly calling the
-openssl 1.1.1 API in evmctl.
-
-Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
-zohar@linux.ibm.com: "COMPILE_SSL: " -> "COMPILE_SSL=" in .travis.yml
-Reviewed-by: Petr Vorel <pvorel@suse.cz>
-Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
-
-Signed-off-by: luhuaxin <luhuaxin1@huawei.com>
----
- .travis.yml               |  6 +++---
- src/libimaevm.c           | 20 ++++++++++++++++++++
- tests/gen-keys.sh         | 25 +++++++++++++++++++++++++
- tests/ima_hash.test       |  3 +--
- tests/install-openssl3.sh | 23 +++++++++++++++++++++++
- tests/sign_verify.test    | 10 ++++++++++
- 6 files changed, 82 insertions(+), 5 deletions(-)
- create mode 100755 tests/install-openssl3.sh
-
-diff --git a/.travis.yml b/.travis.yml
-index 9bea5d1..9063b04 100644
---- a/.travis.yml
-+++ b/.travis.yml
-@@ -7,7 +7,7 @@ matrix:
-     include:
-         # 32 bit build
-         - os: linux
--          env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss
-+          env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss COMPILE_SSL=openssl-3.0.0-beta1
-           compiler: gcc
- 
-         # cross compilation builds
-@@ -30,7 +30,7 @@ matrix:
- 
-         # glibc (gcc/clang)
-         - os: linux
--          env: DISTRO=opensuse/tumbleweed TSS=ibmtss
-+          env: DISTRO=opensuse/tumbleweed TSS=ibmtss COMPILE_SSL=openssl-3.0.0-beta1
-           compiler: clang
- 
-         - os: linux
-@@ -75,4 +75,4 @@ before_install:
- script:
-     - INSTALL="${DISTRO%%:*}"
-     - INSTALL="${INSTALL%%/*}"
--    - docker run -t ima-evm-utils /bin/sh -c "cd travis && if  \"$VARIANT\" ; then ARCH=\"$ARCH\" ./$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./$INSTALL.sh && if  ! \"$VARIANT\" ; then which tpm_server || which swtpm || ../tests/install-swtpm.sh; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" ../build.sh"
-+    - docker run -t ima-evm-utils /bin/sh -c "cd travis && if  \"$VARIANT\" ; then ARCH=\"$ARCH\" ./$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./$INSTALL.sh && if  "$COMPILE_SSL" ; then COMPILE_SSL="$COMPILE_SSL" ./tests/install-openssl3.sh; fi  && if  ! \"$VARIANT\" ; then which tpm_server || which swtpm || ../tests/install-swtpm.sh; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" ../build.sh"
-diff --git a/src/libimaevm.c b/src/libimaevm.c
-index fa6c278..423d9dc 100644
---- a/src/libimaevm.c
-+++ b/src/libimaevm.c
-@@ -518,6 +518,16 @@ static int verify_hash_v2(const char *file, const unsigned char *hash, int size,
- 		return -1;
- 	}
- 
-+#if defined(EVP_PKEY_SM2) && OPENSSL_VERSION_NUMBER < 0x30000000
-+	/* If EC key are used, check whether it is SM2 key */
-+	if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
-+		EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
-+		int curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
-+		if (curve == NID_sm2)
-+			EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2);
-+	}
-+#endif
-+
- 	st = "EVP_PKEY_CTX_new";
- 	if (!(ctx = EVP_PKEY_CTX_new(pkey, NULL)))
- 		goto err;
-@@ -932,6 +942,16 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash,
- 		return -1;
- 	}
- 
-+#if defined(EVP_PKEY_SM2) && OPENSSL_VERSION_NUMBER < 0x30000000
-+	/* If EC key are used, check whether it is SM2 key */
-+	if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) {
-+		EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
-+		int curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
-+		if (curve == NID_sm2)
-+			EVP_PKEY_set_alias_type(pkey, EVP_PKEY_SM2);
-+	}
-+#endif
-+
- 	calc_keyid_v2(&keyid, name, pkey);
- 	hdr->keyid = keyid;
- 
-diff --git a/tests/gen-keys.sh b/tests/gen-keys.sh
-index 407876b..ae72487 100755
---- a/tests/gen-keys.sh
-+++ b/tests/gen-keys.sh
-@@ -92,6 +92,31 @@ for m in \
-     fi
- done
- 
-+# SM2, If openssl 3.0 is installed, gen SM2 keys using
-+if  -x /opt/openssl3/bin/openssl ; then
-+  (PATH=/opt/openssl3/bin:$PATH LD_LIBRARY_PATH=/opt/openssl3/lib
-+  for curve in sm2; do
-+    if  "$1" = clean  ||  "$1" = force ; then
-+      rm -f test-$curve.cer test-$curve.key test-$curve.pub
-+    fi
-+    if  "$1" = clean ; then
-+      continue
-+    fi
-+    if  ! -e test-$curve.key ; then
-+      log openssl req -verbose -new -nodes -utf8 -days 10000 -batch -x509 \
-+        -sm3 -sigopt "distid:1234567812345678" \
-+        -config test-ca.conf \
-+        -copy_extensions copyall \
-+        -newkey $curve \
-+        -out test-$curve.cer -outform DER \
-+        -keyout test-$curve.key
-+      if  -s test-$curve.key ; then
-+        log openssl pkey -in test-$curve.key -out test-$curve.pub -pubout
-+      fi
-+    fi
-+  done)
-+fi
-+
- # This script leaves test-ca.conf, *.cer, *.pub, *.key files for sing/verify tests.
- # They are never deleted except by `make distclean'.
- 
-diff --git a/tests/ima_hash.test b/tests/ima_hash.test
-index 8d66e59..6e0e463 100755
---- a/tests/ima_hash.test
-+++ b/tests/ima_hash.test
-@@ -70,8 +70,7 @@ expect_pass check  sha256     0x0404 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649
- expect_pass check  sha384     0x0405 38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b
- expect_pass check  sha512     0x0406 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
- expect_pass check  rmd160     0x0403 9c1185a5c5e9fc54612808977ee8f548b2258d31
--expect_fail check  sm3        0x01
--expect_fail check  sm3-256    0x01
-+expect_pass check  sm3        0x0411 1ab21d8355cfa17f8e61194831e81a8f22bec8c728fefb747ed035eb5082aa2b
- _enable_gost_engine
- expect_pass check  md_gost12_256 0x0412 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb
- expect_pass check  streebog256   0x0412 3f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb
-diff --git a/tests/install-openssl3.sh b/tests/install-openssl3.sh
-new file mode 100755
-index 0000000..1b63468
---- /dev/null
-+++ b/tests/install-openssl3.sh
-@@ -0,0 +1,23 @@
-+#!/bin/bash
-+
-+set -ex
-+
-+if  -z "$COMPILE_SSL" ; then
-+    echo "Missing \$COMPILE_SSL!" >&2
-+    exit 1
-+fi
-+
-+version=${COMPILE_SSL}
-+
-+wget --no-check-certificate https://github.com/openssl/openssl/archive/refs/tags/${version}.tar.gz
-+tar --no-same-owner -xzf ${version}.tar.gz
-+cd openssl-${version}
-+
-+./Configure --prefix=/opt/openssl3 --openssldir=/opt/openssl3/ssl
-+make -j$(nproc)
-+# only install apps and library
-+sudo make install_sw
-+
-+cd ..
-+rm -rf ${version}.tar.gz
-+rm -rf openssl-${version}
-diff --git a/tests/sign_verify.test b/tests/sign_verify.test
-index 288e133..f716319 100755
---- a/tests/sign_verify.test
-+++ b/tests/sign_verify.test
-@@ -198,6 +198,10 @@ check_sign() {
-   # This is all we can do for evm.
-    "$TYPE" =~ evm  && return "$OK"
- 
-+  # When using the SM2/3 algorithm, the openssl tool uses USERID for verify,
-+  # which is incompatible with calling API directly, so skip it.
-+   "$ALG" == sm3  && return "$OK"
-+
-   # Extract signature to a file
-   _extract_xattr "$FILE" "$(_xattr "$TYPE")" "$FILE.sig2" "$PREFIX"
- 
-@@ -366,6 +370,12 @@ sign_verify  rsa1024  sha384  0x030205:K:0080
- sign_verify  rsa1024  sha512  0x030206:K:0080
- sign_verify  rsa1024  rmd160  0x030203:K:0080
- 
-+# If openssl 3.0 is installed, test the SM2/3 algorithm combination
-+if  -x /opt/openssl3/bin/openssl ; then

_service:tar_scm:skip-test-error-in-docker.patch Deleted

@@ -1,57 +0,0 @@
-From d3a4e24f6a2bac023f7e7c0eda403f0d8e25996d Mon Sep 17 00:00:00 2001
-From: shenxiangwei <shenxiangwei1@huawei.com>
-Date: Mon, 26 Sep 2022 19:36:25 +0800
-Subject: PATCH Skip test error in docker
-
----
- tests/ima_hash.test    |  5 +++++
- tests/sign_verify.test | 10 ++++++++++
- 2 files changed, 15 insertions(+)
-
-diff --git a/tests/ima_hash.test b/tests/ima_hash.test
-index 8d66e59..cd97e1d 100644
---- a/tests/ima_hash.test
-+++ b/tests/ima_hash.test
-@@ -24,6 +24,11 @@ trap _report_exit EXIT
- set -f # disable globbing
- 
- check() {
-+  cat /proc/fs/ext4/sda1/options | grep xattr
-+  if  `echo $?` -ne 0 ;then
-+          return "$SKIP"
-+  fi
-+
-   local alg=$1 prefix=$2 chash=$3 hash
-   local file=$alg-hash.txt
- 
-diff --git a/tests/sign_verify.test b/tests/sign_verify.test
-index 288e133..e1899df 100644
---- a/tests/sign_verify.test
-+++ b/tests/sign_verify.test
-@@ -130,6 +130,11 @@ check_sign() {
-   # PREFIX (signature header prefix in hex),
-   # OPTS (additional options for evmctl),
-   # FILE (working file to sign).
-+  cat /proc/fs/ext4/sda1/options | grep xattr
-+  if  `echo $?` -ne 0 ;then
-+          return "$SKIP"
-+  fi
-+
-   local "$@"
-   local KEY=${KEY%.*}.key
-   local FILE=${FILE:-$ALG.txt}
-@@ -225,6 +230,11 @@ check_verify() {
-   # ALG (hash algo),
-   # OPTS (additional options for evmctl),
-   # FILE (filename to verify).
-+  cat /proc/fs/ext4/sda1/options | grep xattr
-+  if  `echo $?` -ne 0 ;then
-+	  return "$SKIP"
-+  fi
-+
-   local "$@"
- 
-   # shellcheck disable=SC2086
--- 
-2.37.3.windows.1
-

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/travis Deleted

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/travis/alpine.sh Deleted

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/travis/centos.sh Deleted

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/travis/debian.sh Deleted

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/travis/fedora.sh Deleted

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/travis/opensuse.sh Deleted

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/travis/tumbleweed.sh Deleted

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/travis/ubuntu.sh Deleted

_service:tar_scm:ima-evm-utils-1.5.tar.gz/.github Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/.github/workflows Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/.github/workflows/ci.yml Added

@@ -0,0 +1,231 @@
+# Copyright (c) 2021 Petr Vorel <pvorel@suse.cz>
+name: "distros"
+on: push, pull_request
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      LINUX_SHA: ${{ steps.last-commit.outputs.LINUX_SHA }}
+    name: build
+    timeout-minutes: 100
+    strategy:
+      fail-fast: false
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Determine last kernel commit
+        id: last-commit
+        shell: bash
+        run: |
+          mkdir linux-integrity
+          pushd linux-integrity
+          git init
+          LINUX_URL=${{ vars.LINUX_URL }}
+          if  -z "$LINUX_URL" ; then
+              LINUX_URL=https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
+          fi
+          LINUX_BRANCH=${{ vars.LINUX_BRANCH }}
+          if  -z "$LINUX_BRANCH" ; then
+              LINUX_BRANCH=next-integrity
+          fi
+          git remote add origin $LINUX_URL
+          LINUX_SHA=$(git ls-remote origin $GITHUB_REF_NAME | awk '{print $1}')
+           -z "$LINUX_SHA"  && LINUX_SHA=$(git ls-remote origin $LINUX_BRANCH | awk '{print $1}')
+          echo "LINUX_SHA=$LINUX_SHA" >> $GITHUB_OUTPUT
+          popd
+
+      - name: Cache UML kernel
+        id: cache-linux
+        uses: actions/cache@v3
+        with:
+          path: linux
+          key: linux-${{ steps.last-commit.outputs.LINUX_SHA }}-${{ hashFiles('**/kernel-configs/*') }}
+
+      - name: Cache signing key
+        id: cache-key
+        uses: actions/cache@v3
+        with:
+          path: signing_key.pem
+          key: signing_key.pem-${{ steps.last-commit.outputs.LINUX_SHA }}-${{ hashFiles('**/kernel-configs/*') }}
+
+      - name: Compile UML kernel
+        if: steps.cache-linux.outputs.cache-hit != 'true' || steps.cache-key.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          if  "$DEVTOOLSET" = "yes" ; then
+                  source /opt/rh/devtoolset-10/enable
+          fi
+          if  "$ARCH" = "i386" ; then
+                  CROSS_COMPILE_OPT="CROSS_COMPILE=i686-linux-gnu-"
+          fi
+          pushd linux-integrity
+          git pull --depth 1 origin ${{ steps.last-commit.outputs.LINUX_SHA }}
+          make ARCH=um defconfig
+          ./scripts/kconfig/merge_config.sh -m .config $(ls ../kernel-configs/*)
+          # Update manually, to specify ARCH=um
+          make ARCH=um olddefconfig
+          # Make everything built-in
+          make ARCH=um localyesconfig
+          make ARCH=um $CROSS_COMPILE_OPT -j$(nproc)
+          chmod +x linux
+          cp linux ..
+          cp certs/signing_key.pem ..
+          popd
+
+  job:
+    needs: build
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # 32bit build
+          - container: "debian:stable"
+            env:
+              CC: gcc
+              ARCH: i386
+              TSS: tpm2-tss
+              VARIANT: i386
+              COMPILE_SSL: openssl-3.0.5
+
+          # cross compilation builds
+          - container: "debian:stable"
+            env:
+              ARCH: ppc64el
+              CC: powerpc64le-linux-gnu-gcc
+              TSS: ibmtss
+              VARIANT: cross-compile
+
+          - container: "debian:stable"
+            env:
+              ARCH: arm64
+              CC: aarch64-linux-gnu-gcc
+              TSS: tpm2-tss
+              VARIANT: cross-compile
+
+          - container: "debian:stable"
+            env:
+              ARCH: s390x
+              CC: s390x-linux-gnu-gcc
+              TSS: ibmtss
+              VARIANT: cross-compile
+
+          # musl (native)
+          - container: "alpine:latest"
+            env:
+              CC: gcc
+              TSS: tpm2-tss
+
+          # glibc (gcc/clang)
+          - container: "opensuse/tumbleweed"
+            env:
+              CC: clang
+              TSS: ibmtss
+
+          - container: "opensuse/leap"
+            env:
+              CC: gcc
+              TSS: tpm2-tss
+
+          - container: "ubuntu:jammy"
+            env:
+              CC: gcc
+              TSS: ibmtss
+              COMPILE_SSL: openssl-3.0.5
+
+          - container: "ubuntu:xenial"
+            env:
+              CC: clang
+              TSS: tpm2-tss
+
+          - container: "fedora:latest"
+            env:
+              CC: clang
+              TSS: ibmtss
+
+          - container: "fedora:latest"
+            env:
+              CC: clang
+              TSS: ibmtss
+              TST_ENV: um
+              TST_KERNEL: ../linux
+
+          - container: "centos:7"
+            env:
+              CC: gcc
+              TSS: tpm2-tss
+
+          - container: "debian:testing"
+            env:
+              CC: clang
+              TSS: tpm2-tss
+
+          - container: "debian:stable"
+            env:
+              CC: clang
+              TSS: ibmtss
+
+          - container: "alt:sisyphus"
+            env:
+              CC: gcc
+              TSS: libtpm2-tss-devel
+
+    container:
+      image: ${{ matrix.container }}
+      env: ${{ matrix.env }}
+      options: --privileged --device /dev/loop-control -v /dev/shm:/dev/shm
+
+    steps:
+    - name: Show OS
+      run: cat /etc/os-release
+
+    - name: Git checkout
+      uses: actions/checkout@v1
+
+    - name: Install additional packages
+      run: |
+        INSTALL=${{ matrix.container }}
+        INSTALL="${INSTALL%%:*}"
+        INSTALL="${INSTALL%%/*}"
+        if  "$VARIANT" ; then ARCH="$ARCH" ./ci/$INSTALL.$VARIANT.sh; fi
+        ARCH="$ARCH" CC="$CC" TSS="$TSS" ./ci/$INSTALL.sh
+
+    - name: Build openSSL
+      run: |
+        if  "$COMPILE_SSL" ; then
+          COMPILE_SSL="$COMPILE_SSL" VARIANT="$VARIANT" ./tests/install-openssl3.sh; \

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/.travis.yml -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/.travis.yml Changed

@@ -1,4 +1,6 @@
-dist: bionic
+# Copyright (c) 2017-2021 Petr Vorel <pvorel@suse.cz>
+
+dist: focal
 language: C
 services:
     - docker
@@ -7,7 +9,7 @@
     include:
         # 32 bit build
         - os: linux
-          env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss
+          env: DISTRO=debian:stable VARIANT=i386 ARCH=i386 TSS=tpm2-tss COMPILE_SSL=openssl-3.0.5
           compiler: gcc
 
         # cross compilation builds
@@ -25,12 +27,12 @@
 
         # musl
         - os: linux
-          env: DISTRO=alpine:latest TSS=tpm2-tss
+          env: DISTRO=alpine:latest TSS=tpm2-tss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host"
           compiler: gcc
 
         # glibc (gcc/clang)
         - os: linux
-          env: DISTRO=opensuse/tumbleweed TSS=ibmtss
+          env: DISTRO=opensuse/tumbleweed TSS=ibmtss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host"
           compiler: clang
 
         - os: linux
@@ -38,7 +40,7 @@
           compiler: gcc
 
         - os: linux
-          env: DISTRO=ubuntu:eoan TSS=ibmtss
+          env: DISTRO=ubuntu:jammy TSS=ibmtss COMPILE_SSL=openssl-3.0.5
           compiler: gcc
 
         - os: linux
@@ -46,15 +48,15 @@
           compiler: clang
 
         - os: linux
-          env: DISTRO=fedora:latest TSS=ibmtss
+          env: DISTRO=fedora:latest TSS=ibmtss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host"
           compiler: clang
 
         - os: linux
-          env: DISTRO=centos:7 TSS=tpm2-tss
+          env: DISTRO=centos:7 TSS=tpm2-tss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host"
           compiler: gcc
 
         - os: linux
-          env: DISTRO=centos:latest TSS=tpm2-tss
+          env: REPO="quay.io/centos/" DISTRO="${REPO}centos:stream8" TSS=tpm2-tss CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host"
           compiler: clang
 
         - os: linux
@@ -65,14 +67,32 @@
           env: DISTRO=debian:stable TSS=ibmtss
           compiler: gcc
 
+        - os: linux
+          env: REPO="docker.io/library/" DISTRO=${REPO}alt:sisyphus TSS=libtpm2-tss-devel CONTAINER=podman CONTAINER_ARGS="--runtime=/usr/bin/crun --network=host"
+          compiler: gcc
+
 before_install:
-    - df -hT
+    # Tumbleweed requires podman due docker incompatible with glibc 2.33
+    # (faccessat2) and crun (for clone3).
+    - CONTAINER="${CONTAINER:-docker}"
+    - >
+        if  "$CONTAINER" = "podman" ; then
+            # podman
+            . /etc/os-release
+            sudo sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list"
+            wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/xUbuntu_${VERSION_ID}/Release.key -O- | sudo apt-key add -
+            sudo apt update
+            sudo apt -y install fuse-overlayfs podman slirp4netns crun
+        fi
+    - $CONTAINER info
+
     - DIR="/usr/src/ima-evm-utils"
     - printf "FROM $DISTRO\nRUN mkdir -p $DIR\nWORKDIR $DIR\nCOPY . $DIR\n" > Dockerfile
     - cat Dockerfile
-    - docker build -t ima-evm-utils .
+    - $CONTAINER build $CONTAINER_ARGS -t ima-evm-utils .
 
 script:
-    - INSTALL="${DISTRO%%:*}"
+    - INSTALL="${DISTRO#${REPO}}"
+    - INSTALL="${INSTALL%%:*}"
     - INSTALL="${INSTALL%%/*}"
-    - docker run -t ima-evm-utils /bin/sh -c "cd travis && if  \"$VARIANT\" ; then ARCH=\"$ARCH\" ./$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./$INSTALL.sh && if  ! \"$VARIANT\" ; then which tpm_server || which swtpm || ../tests/install-swtpm.sh; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" ../build.sh"
+    - $CONTAINER run $CONTAINER_ARGS -t ima-evm-utils /bin/sh -c "if  \"$VARIANT\" ; then ARCH=\"$ARCH\" ./ci/$INSTALL.$VARIANT.sh; fi && ARCH=\"$ARCH\" CC=\"$CC\" TSS=\"$TSS\" ./ci/$INSTALL.sh && if  \"$COMPILE_SSL\" ; then COMPILE_SSL=\"$COMPILE_SSL\" VARIANT=\"$VARIANT\" ./tests/install-openssl3.sh; fi && if  ! \"$VARIANT\" ; then which tpm_server || which swtpm || if which tssstartup; then ./tests/install-swtpm.sh; fi; fi && CC=\"$CC\" VARIANT=\"$VARIANT\" COMPILE_SSL=\"$COMPILE_SSL\" ./build.sh"

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/INSTALL -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/INSTALL Changed

@@ -9,10 +9,33 @@
 notice and this notice are preserved.  This file is offered as-is,
 without warranty of any kind.
 
+Prerequisites
+=============
+
+This project has the following prerequisites:
+
+(Ubuntu package names)
+	libkeyutils-dev
+	libtasn1-dev
+	libgmp-dev
+	libnspr4-dev
+	libnss3-dev
+
+These software TPMs are supported:
+      https://sourceforge.net/projects/ibmswtpm2/
+      https://github.com/stefanberger/swtpm
+
+      swtpm depends upon
+      https://github.com/stefanberger/libtpms
+
+Supported TSSes include these.  Both are included in some distros.
+	  IBM TSS https://sourceforge.net/projects/ibmtpm20tss/
+	  Intel TSS
+
 Basic Installation
 ==================
 
-   Briefly, the shell commands `./configure; make; make install' should
+   Briefly, the shell commands `autoreconf -i; ./configure; make; make install' should
 configure, build, and install this package.  The following
 more-detailed instructions are generic; see the `README' file for
 instructions specific to this package.  Some packages provide this
@@ -51,7 +74,7 @@
    The simplest way to compile this package is:
 
   1. `cd' to the directory containing the package's source code and type
-     `./configure' to configure the package for your system.
+     `autoreconf -i' and then `./configure' to configure the package for your system.
 
      Running `configure' might take a while.  While running, it prints
      some messages telling which features it is checking for.

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/Makefile.am -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/Makefile.am Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/NEWS -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/NEWS Changed

@@ -1,3 +1,52 @@
+2023-2-24  Mimi Zohar <zohar@linux.ibm.com>
+
+	version 1.5:
+
+	* CI changes:
+	  * New: UML kernel testing environment
+	  * Support for running specific test(s)
+	  * Update distros
+	  * Update software release versions
+	* New features:
+	  * Signing fs-verity signatures
+	  * Reading TPM 2.0 PCRs via sysfs interface
+	* New tests:
+	  * Missing IMA mmapped file measurements
+	  * Overlapping IMA policy rules
+	  * EVM portable signatures
+	  * fs-verity file measurements in the IMA measurement list
+	* Build and library changes:
+	  * OpenSSL 3.0 version related changes
+	  * New configuration options: --disable-engine, --enable-sigv1
+	  * Deprecate IMA signature v1 format
+	* Misc bug fixes and code cleanup:
+	  * memory leaks, bounds checking, use after free
+	  * Fix and update test output
+	  * Add missing sanity checks
+	* Documentation:
+	  * Store the sourceforge ima-evm-utils wiki for historical
+	    purposes.
+
+2021-10-22  Mimi Zohar <zohar@linux.ibm.com>
+
+	version 1.4:
+	* Elliptic curve support and tests
+	* PKCS11 support and tests
+	* Ability to manually specify the keyid included in the IMA xattr
+	* Improve IMA measurement list per TPM bank verification
+	* Linking with IBM TSS
+	* Set default hash algorithm in package configuration
+	* (Minimal) support and test EVM portable signatures
+	* CI testing:
+	  * Refresh and include new distros
+	  * Podman support
+	  * GitHub Actions
+	  * Limit "sudo" usage
+	* Misc bug fixes and code cleanup
+	  * Fix static analysis bug reports, memory leaks
+	  * Remove experimental code that was never upstreamed in the kernel
+	  * Use unsigned variable, remove unused variables, etc
+
 2020-10-28  Mimi Zohar <zohar@linux.ibm.com>
 
 	version 1.3.2:
@@ -44,7 +93,7 @@
 	    the TPM PCRs, verify the IMA template data digest against the
 	    template data.  (Based on LTP "--verify" option.)
 	  - Ignore file measurement violations while verifying the IMA
-	    measurment list. (Based on LTP "--validate" option.)
+	    measurement list. (Based on LTP "--validate" option.)
 	  - Verify the file data signature included in the measurement list
 	    based on the file hash also included in the measurement list
 	    (--verify-sig)
@@ -193,7 +242,7 @@
 2012-04-02  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>
 
 	version 0.1.0
-	* Fully functional version for lastest 3.x kernels
+	* Fully functional version for latest 3.x kernels
 
 2011-08-24  Dmitry Kasatkin  <dmitry.kasatkin@intel.com>

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/README -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/README Changed

@@ -25,33 +25,43 @@
 
  --version
  help <command>
- import --rsa pubkey keyring
- sign -r --imahash | --imasig  --portable --key key --pass password file
+ import  --rsa (deprecated) pubkey keyring
+ sign -r --imahash | --imasig  --key key --pass=<password> file
  verify file
- ima_boot_aggregate --pcrs hash-algorithm,file TPM 1.2 BIOS event log
- ima_sign --sigfile --key key --pass password file
+ ima_sign --sigfile --key key --pass=<password> file
  ima_verify file
+ ima_setxattr --sigfile file
  ima_hash file
- ima_measurement --ignore-violations --verify-sig --key "key1, key2, ..."  --pcrs hash-algorithm,file --pcrs hash-algorithm,file ... file
+ ima_measurement --ignore-violations --verify-sig --key "key1, key2, ..."
+   --pcrs hash-algorithm,file --pcrs hash-algorithm,file ...
+   --verify-bank hash-algorithm file
+ ima_boot_aggregate --pcrs hash-algorithm,file TPM 1.2 BIOS event log
+   --hwtpm
  ima_fix -t fdsxm path
- sign_hash --key key --pass password
+ ima_clear -t fdsxm path
+ sign_hash --veritysig --key key --pass=<password>
  hmac --imahash | --imasig  file
 
 
 OPTIONS
 -------
 
-  -a, --hashalgo     sha1 (default), sha224, sha256, sha384, sha512
+  -a, --hashalgo     sha1, sha224, sha256, sha384, sha512, streebog256, streebog512 (default: sha256)
   -s, --imasig       make IMA signature
+      --veritysig    sign an fs-verity file digest hash
   -d, --imahash      make IMA hash
   -f, --sigfile      store IMA signature in .sig file instead of xattr
       --xattr-user   store xattrs in user namespace (for testing purposes)
-      --rsa          use RSA key type and signing scheme v1
+      --rsa          use RSA key type and signing scheme v1 (deprecated)
   -k, --key          path to signing key (default: /etc/keys/{privkey,pubkey}_evm.pem)
+                     or a pkcs11 URI
+      --keyid n      overwrite signature keyid with a 32-bit value in hex (for signing)
+      --keyid-from-cert file
+                     read keyid value from SKID of a x509 cert file
   -o, --portable     generate portable EVM signatures
   -p, --pass         password for encrypted signing key
   -r, --recursive    recurse into directories (sign)
-  -t, --type         file types to fix 'fdsxm' (f: file, d: directory, s: block/char/symlink)
+  -t, --type         file types to fix 'fxm' (f: file)
                      x - skip fixing if both ima and evm xattrs exist (use with caution)
                      m - stay on the same filesystem (like 'find -xdev')
   -n                 print result to stdout instead of setting xattr
@@ -59,7 +69,15 @@
       --smack        use extra SMACK xattrs for EVM
       --m32          force EVM hmac/signature for 32 bit target system
       --m64          force EVM hmac/signature for 64 bit target system
-      --engine e     preload OpenSSL engine e (such as: gost)
+      --engine e     preload OpenSSL engine e (such as: gost) is deprecated
+      --ino          use custom inode for EVM
+      --uid          use custom UID for EVM
+      --gid          use custom GID for EVM
+      --mode         use custom Mode for EVM
+      --generation   use custom Generation for EVM(unspecified: from FS, empty: use 0)
+      --ima          use custom IMA signature for EVM
+      --selinux      use custom Selinux label for EVM
+      --caps         use custom Capabilities for EVM(unspecified: from FS, empty: do not use)
       --pcrs         file containing TPM pcrs, one per hash-algorithm/bank
       --ignore-violations ignore ToMToU measurement violations
       --verify-sig   verify the file signature based on the file hash, both
@@ -67,6 +85,10 @@
   -v                 increase verbosity level
   -h, --help         display this help and exit
 
+Environment variables:
+
+EVMCTL_KEY_PASSWORD  : Private key password to use; do not use --pass option
+
 
 INTRODUCTION
 ------------
@@ -125,6 +147,9 @@
 Second key format uses X509 DER encoded public key certificates and uses asymmetric key support
 in the kernel (since kernel 3.9). CONFIG_INTEGRITY_ASYMMETRIC_KEYS must be enabled (default).
 
+For v2 signatures x509 certificate (containing the public key) could be appended to the
+private key (they both are in PEM format) to automatically extract keyid from its Subject
+Key Identifier (SKID).
 
 Integrity keyrings
 ----------------
@@ -194,7 +219,7 @@
 
 Configuration file x509_evm.genkey:
 
-	# Begining of the file
+	# Beginning of the file
 	 req 
 	default_bits = 1024
 	distinguished_name = req_distinguished_name
@@ -245,7 +270,7 @@
 
 Configuration file ima-local-ca.genkey:
 
-	# Begining of the file
+	# Beginning of the file
 	 req 
 	default_bits = 2048
 	distinguished_name = req_distinguished_name
@@ -276,7 +301,7 @@
 
 Configuration file ima.genkey:
 
-	# Begining of the file
+	# Beginning of the file
 	 req 
 	default_bits = 1024
 	distinguished_name = req_distinguished_name

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/acinclude.m4 -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/acinclude.m4 Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/build.sh -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/build.sh Changed

@@ -1,6 +1,16 @@
 #!/bin/sh
 # Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
 
+if  -n "$CI" ; then
+	# If we under CI only thing we can analyze is logs so better to enable
+	# verbosity to a maximum.
+	set -x
+	# This is to make stdout and stderr synchronous in the logs.
+	exec 2>&1
+
+	mount -t securityfs -o rw securityfs /sys/kernel/security
+fi
+
 set -e
 
 CC="${CC:-gcc}"
@@ -32,6 +42,14 @@
 
 cd `dirname $0`
 
+if  "$COMPILE_SSL" ; then
+	echo "COMPILE_SSL: $COMPILE_SSL"
+	export CFLAGS="-I/opt/openssl3/include $CFLAGS"
+	export LD_LIBRARY_PATH="/opt/openssl3/lib64:/opt/openssl3/lib:$HOME/src/ima-evm-utils/src/.libs:$LD_LIBRARY_PATH"
+	export LDFLAGS="-L/opt/openssl3/lib64 -L/opt/openssl3/lib $LDFLAGS"
+	export PATH="/opt/openssl3/bin:$HOME/src/ima-evm-utils/src/.libs:$PATH"
+fi
+
 case "$VARIANT" in
 	i386)
 		echo "32-bit compilation"
@@ -79,9 +97,7 @@
 
 title "logs"
 if  $ret -eq 0 ; then
-	tail -3 tests/ima_hash.log
-	tail -3 tests/sign_verify.log
-	tail -20 tests/boot_aggregate.log
+	cd tests; make check_logs; cd ..
 	exit 0
 fi

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/alpine.sh Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/alt.sh Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/centos.sh Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/debian.cross-compile.sh Changed

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/debian.i386.sh Changed

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/debian.sh Added

@@ -0,0 +1,61 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -ex
+
+# workaround for Ubuntu impish asking to interactively configure tzdata
+export DEBIAN_FRONTEND="noninteractive"
+
+if  -z "$CC" ; then
+	echo "missing \$CC!" >&2
+	exit 1
+fi
+
+# debian.*.sh must be run first
+if  "$ARCH" ; then
+	ARCH=":$ARCH"
+	unset CC
+else
+	apt update
+fi
+
+# ibmswtpm2 requires gcc
+ "$CC" = "gcc"  || CC="gcc $CC"
+
+case "$TSS" in
+ibmtss) TSS="libtss-dev";;
+tpm2-tss) TSS="libtss2-dev";;
+'') echo "Missing TSS!" >&2; exit 1;;
+*)  "$TSS"  && echo "Unsupported TSS: '$TSS'!" >&2; exit 1;;
+esac
+
+apt="apt install -y --no-install-recommends"
+
+$apt \
+	$CC $TSS \
+	asciidoc \
+	attr \
+	autoconf \
+	automake \
+	diffutils \
+	debianutils \
+	docbook-xml \
+	docbook-xsl \
+	e2fsprogs \
+	gzip \
+	libattr1-dev$ARCH \
+	libkeyutils-dev$ARCH \
+	libssl-dev$ARCH \
+	libtool \
+	make \
+	openssl \
+	pkg-config \
+	procps \
+	sudo \
+	util-linux \
+	wget \
+	xsltproc \
+	gawk
+
+$apt xxd || $apt vim-common
+$apt libengine-gost-openssl1.1$ARCH || true
+$apt softhsm gnutls-bin libengine-pkcs11-openssl1.1$ARCH || true

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/fedora.sh Added

@@ -0,0 +1,68 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -e
+
+if  -z "$CC" ; then
+	echo "missing \$CC!" >&2
+	exit 1
+fi
+
+case "$TSS" in
+ibmtss) TSS="tss2-devel";;
+tpm2-tss) TSS="tpm2-tss-devel";;
+'') echo "Missing TSS!" >&2; exit 1;;
+*) echo "Unsupported TSS: '$TSS'!" >&2; exit 1;;
+esac
+
+# ibmswtpm2 requires gcc
+ "$CC" = "gcc"  || CC="gcc $CC"
+
+yum -y install \
+	$CC $TSS \
+	asciidoc \
+	attr \
+	autoconf \
+	automake \
+	diffutils \
+	docbook-xsl \
+	e2fsprogs \
+	git-core \
+	gnutls-utils \
+	gzip \
+	keyutils-libs-devel \
+	kmod \
+	libattr-devel \
+	libtool \
+	libxslt \
+	make \
+	openssl \
+	openssl-devel \
+	openssl-pkcs11 \
+	pkg-config \
+	procps \
+	sudo \
+	util-linux \
+	vim-common \
+	wget \
+	which \
+	zstd \
+	systemd \
+	keyutils \
+	e2fsprogs \
+	acl \
+	libcap
+
+yum -y install docbook5-style-xsl || true
+yum -y install swtpm || true
+
+# SoftHSM is available via EPEL on CentOS
+if  -f /etc/centos-release ; then
+	yum -y install epel-release
+fi
+yum -y install softhsm || true
+
+# haveged is available via EPEL on CentOS stream8.
+yum -y install haveged || true
+
+./tests/install-fsverity.sh
+./tests/install-mount-idmapped.sh

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/opensuse.sh Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/tumbleweed.sh Added

@@ -0,0 +1,53 @@
+#!/bin/sh
+# Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
+set -ex
+
+if  -z "$CC" ; then
+	echo "missing \$CC!" >&2
+	exit 1
+fi
+
+case "$TSS" in
+ibmtss) TSS="ibmtss-devel";;
+tpm2-tss) TSS="tpm2-0-tss-devel";;
+'') echo "Missing TSS!" >&2; exit 1;;
+*) echo "Unsupported TSS: '$TSS'!" >&2; exit 1;;
+esac
+
+# clang has some gcc dependency
+ "$CC" = "gcc"  || CC="gcc $CC"
+
+zypper --non-interactive install --force-resolution --no-recommends \
+	$CC $TSS \
+	asciidoc \
+	attr \
+	autoconf \
+	automake \
+	diffutils \
+	docbook_5 \
+	docbook5-xsl-stylesheets \
+	e2fsprogs \
+	gzip \
+	ibmswtpm2 \
+	keyutils-devel \
+	libattr-devel \
+	libopenssl-devel \
+	libtool \
+	make \
+	openssl \
+	pkg-config \
+	procps \
+	sudo \
+	util-linux \
+	vim \
+	wget \
+	which \
+	xsltproc \
+	gawk
+
+zypper --non-interactive install --force-resolution --no-recommends \
+	gnutls openssl-engine-libp11 softhsm || true
+
+if  -f /usr/lib/ibmtss/tpm_server -a ! -e /usr/local/bin/tpm_server ; then
+	ln -s /usr/lib/ibmtss/tpm_server /usr/local/bin
+fi

_service:tar_scm:ima-evm-utils-1.5.tar.gz/ci/ubuntu.sh Added

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/configure.ac -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/configure.ac Changed

@@ -1,7 +1,7 @@
 # autoconf script
 
 AC_PREREQ(2.65)
-AC_INIT(ima-evm-utils, 1.3.2, zohar@linux.ibm.com)
+AC_INIT(ima-evm-utils, 1.5, zohar@linux.ibm.com)
 AM_INIT_AUTOMAKE(foreign)
 AC_CONFIG_HEADERS(config.h)
 AC_CONFIG_MACRO_DIR(m4)
@@ -15,25 +15,28 @@
 #AC_PROG_CXX
 #AC_PROG_CPP
 AC_PROG_INSTALL
-AC_PROG_LIBTOOL
 #AC_PROG_LN_S
+AC_CHECK_PROG(have_pandoc, pandoc, yes, no)
+AM_CONDITIONAL(HAVE_PANDOC, test "x$have_pandoc" = "xyes")
 LT_INIT
 
 # FIXME: Replace `main' with a function in `-lpthread':
 #AC_CHECK_LIB(pthread, main)
 
-# Checks for header files.
-AC_HEADER_STDC
-
 PKG_CHECK_MODULES(LIBCRYPTO, libcrypto >= 0.9.8 )
 AC_SUBST(KERNEL_HEADERS)
 AC_CHECK_HEADER(unistd.h)
 AC_CHECK_HEADERS(openssl/conf.h)
 
+# Intel TSS
 AC_CHECK_LIB(tss2-esys, Esys_Free)
 AC_CHECK_LIB(tss2-rc, Tss2_RC_Decode)
 AM_CONDITIONAL(USE_PCRTSS, test "x$ac_cv_lib_tss2_esys_Esys_Free" = "xyes")
 
+# IBM TSS include files
+AC_CHECK_HEADER(ibmtss/tss.h, , , #define TPM_POSIX)
+AM_CONDITIONAL(USE_IBMTSS, test "x$ac_cv_header_ibmtss_tss_h" = "xyes")
+
 AC_CHECK_HEADERS(sys/xattr.h, , AC_MSG_ERROR(sys/xattr.h header not found. You need the c-library development package.))
 AC_CHECK_HEADERS(keyutils.h, , AC_MSG_ERROR(keyutils.h header not found. You need the libkeyutils development package.))
 
@@ -48,6 +51,16 @@
 		AC_DEFINE(DISABLE_OPENSSL_CONF, 1, Define to disable loading of openssl config by evmctl.)
 	      fi, enable_openssl_conf=yes)
 
+AC_ARG_ENABLE(sigv1,
+	      AS_HELP_STRING(--enable-sigv1, Build ima-evm-utils with signature v1 support))
+	AM_CONDITIONAL(CONFIG_SIGV1, test "x$enable_sigv1" = "xyes")
+	AS_IF(test "$enable_sigv1"  != "yes", enable_sigv1="no")
+
+AC_ARG_ENABLE(engine,
+	      AS_HELP_STRING(--disable-engine, build ima-evm-utils without OpenSSL engine support),,enable_engine=yes)
+	AC_CHECK_LIB(crypto, ENGINE_init,, enable_engine=no)
+	AM_CONDITIONAL(CONFIG_IMA_EVM_ENGINE, test "x$enable_engine" = "xyes")
+
 #debug support - yes for a while
 PKG_ARG_ENABLE(debug, "yes", DEBUG, Enable Debug support)
 if test $pkg_cv_enable_debug = yes; then
@@ -57,6 +70,7 @@
 fi
 
 EVMCTL_MANPAGE_DOCBOOK_XSL
+AX_DEFAULT_HASH_ALGO($KERNEL_HEADERS)
 
 # for gcov
 #CFLAGS="$CFLAGS -Wall -fprofile-arcs -ftest-coverage"
@@ -67,6 +81,8 @@
 AC_CONFIG_FILES(Makefile
 		src/Makefile
 		tests/Makefile
+		doc/Makefile
+		doc/sf/Makefile
 		packaging/ima-evm-utils.spec
 		)
 AC_OUTPUT
@@ -76,8 +92,13 @@
 echo
 echo	"Configuration:"
 echo	"          debug: $pkg_cv_enable_debug"
+echo	"   default-hash: $HASH_ALGO"
 echo	"   openssl-conf: $enable_openssl_conf"
 echo	"      tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free"
 echo	" tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode"
+echo    "         ibmtss: $ac_cv_header_ibmtss_tss_h"
+echo    "         sigv1:  $enable_sigv1"
+echo    "         engine: $enable_engine"
 echo	"            doc: $have_doc"
+echo	"         pandoc: $have_pandoc"
 echo

_service:tar_scm:ima-evm-utils-1.5.tar.gz/doc Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/doc/Makefile.am Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/doc/sf Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/doc/sf/Makefile.am Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/doc/sf/sf-diagram.html Added

@@ -0,0 +1,46 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<HTML>
+</STYLE>
+<BODY LANG="en-US" DIR="LTR">
+<p style="text-align: center; font-family:arial">
+<FONT SIZE=+3><b><a href="https://sourceforge.net/p/linux-ima/wiki/Home">
+See documentation at Linux IMA/EVM Wiki</a></b></FONT>
+<br>
+<FONT SIZE=+3><b>Linux Integrity Subsystem</b></FONT>
+<p>The goals of the kernel integrity subsystem are to detect if files have
+been accidentally or maliciously altered, both remotely and locally,
+appraise a file's measurement against a "good" value stored as an extended
+attribute, and enforce local file integrity.  These goals are complementary
+to Mandatory Access Control(MAC) protections provided by LSM modules, such as
+SElinux and Smack, which, depending on policy, can attempt to protect file
+integrity. The following modules provide several integrity functions:</p>
+<object type="text/html" style="float:right" height=450 data="tcg.html-20100504"></object>
+<UL>
+<LI><B>Collect</B> - measure a file before it is accessed. </li>
+<LI><B>Store</B> - add the measurement to a kernel resident list and, if a
+hardware Trusted Platform Module (TPM) is present, extend the IMA PCR </li>
+<LI><B>Attest</B> -if present, use the TPM to sign the IMA PCR value, to
+allow a remote validation of the measurement list.</li>
+<LI><B>Appraise</B> - enforce local validation of a measurement against a
+'good' value stored in an extended attribute of the file.</li>
+<LI><B>Protect</B> - protect a file's security extended attributes
+</UL>
+<p>The first three functions were introduced with Integrity Measurement
+Architecture (IMA) in 2.6.30.  The EVM/IMA-appraisal patches add support for
+the last two features.</p>
+<p>For additional information about the Linux integrity subsystem, refer to the
+<a href="http://sourceforge.net/apps/mediawiki/linux-ima/index.php?title=Main_Page">Wiki</a>.
+</p>
+<H3><a name="Trusted-Computing">Trusted Computing: architecture and opensource components</a></H3>
+<P> IMA measurement, one component of the kernel's integrity subsystem, is part
+of an overall Integrity Architecture based on the
+<a href="https://www.trustedcomputinggroup.org/home">Trusted Computing Group's
+</a> open standards, including Trusted Platform Module (TPM), Trusted Boot,
+Trusted Software Stack (TSS), Trusted Network Connect (TNC), and Platform
+Trust Services (PTS). The diagram shows how these standards relate, and
+provides links to the respective specifications and open source
+implementations. IMA and EVM can still run on platforms without a
+hardware TPM, although without the hardware guarantee of compromise
+detection.
+</P>
+</BODY></HTML>

_service:tar_scm:ima-evm-utils-1.5.tar.gz/doc/sf/sf-tcg.html Added

@@ -0,0 +1,99 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<HTML>
+<STYLE TYPE="text/css">
+.tcg TD, .tcgcell
+{
+background-color:lightblue;
+color:black;
+font-family:sans-serif;
+font-weight:700;
+padding:0;
+}
+
+.tcg2 TD, .tcg2cell
+{
+background-color:white;
+color:black;
+font-family:sans-serif;
+padding:5;
+border:0;
+}
+</STYLE>
+<table CLASS="tcg">
+<tr> <th COLSPAN=2 ><HREF="http://www.trustedcomputinggroup.org/trusted_computing"></A></th> </tr>
+<tr>
+<td><h3>Applications
+<table ALIGN=RIGHT CLASS="tcg2">
+<tr>
+<th>spec</th>
+<th>info</th>
+</tr>
+<tr>
+<td><a href="http://www.trustedcomputinggroup.org/resources/infrastructure_work_group_platform_trust_services_interface_specification_version_10" target="_top">PTS</a></td>
+<td><a href="http://openpts.sourceforge.jp" target="_top">OpenPTS</a></td>
+</tr>
+<tr><td style="background-color: lightblue"></td>
+<td><a href="http://sourceforge.net/projects/trousers/files/tpm-tools/tpm-tools-1.3.2.tar.gz/download" target="_top">tpm-tools</a></td>
+</tr>
+</table>
+<h2></td>
+</tr>
+<tr>
+<td><h3>Libraries
+<table ALIGN=RIGHT CLASS="tcg2">
+<tr>
+<th>spec</th>
+<th>info</th>
+</tr>
+<tr><td><a href="http://www.trustedcomputinggroup.org/developers/software_stack" target="_top">TSS</a></td>
+<td><a href="http://trousers.sourceforge.net/" target="_top">TrouSerS</a></td>
+</tr>
+</table>
+</td>
+</tr>
+<tr><td><h3>Linux Kernel
+<table ALIGN=RIGHT CLASS="tcg2">
+<tr>
+<th>spec</th>
+<th>info</th>
+</tr>
+<tr><td style="background-color: lightblue"></td>
+<td><a href="http://linux-ima.sourceforge.net/#Integrity Measurement Architecture" target="_top">IMA</a>,
+<a href="http://linux-ima.sourceforge.net/#Linux Extended Verification Module" target="_top">EVM</a></td>
+</td>
+</tr>
+<td><a href="http://www.trustedcomputinggroup.org/files/resource_files/87BCE22B-1D09-3519-ADEBA772FBF02CBD/TCG_PCClientTPMSpecification_1-20_1-00_FINAL.pdf" target="_top">tpm-1.2</a></td>
+<td><a href="http://tpmdd.sourceforge.net" target="_top">TPM driver</a></td>
+</tr>
+</table>
+</td>
+</tr>
+<tr><td><h3>Boot
+<table ALIGN=RIGHT CLASS="tcg2">
+<tr>
+<th>spec</th>
+<th>info</th>
+</tr>
+<tr><td><a href="http://www.trustedcomputinggroup.org/resources/pc_client_work_group_specific_implementation_specification_for_conventional_bios_specification_version_12" target="_top">BIOS</a></td>
+<td><a href="http://sourceforge.jp/projects/openpts/wiki/GRUB-IMA" target="_top">GRUB-IMA</a>,
+<a href="http://sourceforge.net/projects/tboot" target="_top"> TBOOT</a></td>
+</tr>
+</td>
+</tr>
+</table>
+<tr><td><h3>Hardware
+<table ALIGN=RIGHT CLASS="tcg2">
+<tr>
+<th>spec</th>
+<th>info</th>
+</tr>
+<tr>
+<td><a href="http://www.trustedcomputinggroup.org/developers/trusted_platform_module"  target="_top">TPM</a></td>
+<td><a href="http://ibmswtpm.sourceforge.net" target="_top">(swTPM)</a></td>
+</tr>
+</table>
+</td>
+</tr>
+</table>
+</BODY>
+</HTML>

_service:tar_scm:ima-evm-utils-1.5.tar.gz/doc/sf/sf-wiki.md Added

@@ -0,0 +1,932 @@
+The goals of the kernel integrity subsystem are to detect if files have been accidentally or maliciously altered, both remotely and locally, appraise a file's measurement against a "good" value stored as an extended attribute, and enforce local file integrity. These goals are complementary to Mandatory Access Control(MAC) protections provided by LSM modules, such as SElinux and Smack, which, depending on policy, can attempt to protect file integrity.
+
+TOC
+
+## Overview
+### Features
+
+The following modules provide several integrity functions:
+
+-   **Collect** – measure a file before it is accessed.
+-   **Store** – add the measurement to a kernel resident list and, if a
+    hardware Trusted Platform Module (TPM) is present, extend the IMA
+    PCR
+-   **Attest** – if present, use the TPM to sign the IMA PCR value, to
+    allow a remote validation of the measurement list.
+-   **Appraise** – enforce local validation of a measurement against a
+    “good” value stored in an extended attribute of the file.
+-   **Protect** – protect a file's security extended attributes
+    (including appraisal hash) against off-line attack.
+
+ -   **Audit** – audit the file hashes.
+
+The first three functions were introduced with Integrity Measurement Architecture (IMA(#integrity-measurement-architecture-ima)) in 2.6.30.   The "appraise" and "protect" features were originally posted as a single EVM(#linux-extended-verification-module-evm)/IMA-appraisal(#ima-appraisal) patch set for in the 2.6.36 timeframe, but were subsequently split.   EVM, the "protect" feature, was upstreamed in Linux 3.2, using a simplier and more secure method for loading the 'evm-key', based on the new Kernel Key Retention Trusted and Encrypted keys(#creating-trusted-and-evm-encrypted-keys).   EVM support for protecting file metadata based on digital signatures was upstreamed in the Linux 3.3.  IMA-appraisal, the fourth aspect, appraising a file's integrity, was upstreamed in Linux 3.7.
+
+The goals, design, and benefits of these features are further described in the whitepaper "An Overview of the Linux Integrity Subsystem"(http://downloads.sf.net/project/linux-ima/linux-ima/Integrity_overview.pdf "http://downloads.sf.net/project/linux-ima/linux-ima/Integrity_overview.pdf").
+
+### Components
+
+IMA-measurement, one component of the kernel's integrity subsystem, is part of an overall Integrity Architecture based on the Trusted Computing Group's open standards, including Trusted Platform Module (TPM), Trusted Boot, Trusted Software Stack (TSS), Trusted Network Connect (TNC), and Platform Trust Services (PTS). The linux-ima project page contains a diagram(http://linux-ima.sourceforge.net/) showing how these standards relate, and provides links to the respective specifications and open source implementations. IMA-measurement and EVM can still run on platforms without a hardware TPM, although without the hardware guarantee of compromise detection.
+
+IMA-appraisal, a second component of the kernel's integrity subsystem,  extends the "secure boot" concept of verifying  a file's integrity, before transferring control or allowing the file to be accessed by the OS.
+
+IMA-audit, another component of the kernel's integrity subsystem, includes file hashes in the system audit logs, which can be used to augment existing system security analytics/forensics.
+
+The IMA-measurement, IMA-appraisal, and IMA-audit aspects of the kernel's integrity subsystem complement each other, but can be configured and used independently of each other.
+
+## Integrity Measurement Architecture (IMA-measurement)
+
+
+IMA-measurement is an open source trusted computing component. IMA maintains a runtime measurement list and, if anchored in a hardware Trusted Platform Module(TPM), an aggregate integrity value over this list. The benefit of anchoring the aggregate integrity value in the TPM is that the measurement list cannot be compromised by any software attack, without being detectable. Hence, on a trusted boot system, IMA-measurement can be used to attest to the system's runtime integrity.
+
+### Enabling IMA-measurement
+
+IMA was first included in the 2.6.30 kernel. For distros that enable IMA by default in their kernels, collecting IMA measurements simply requires rebooting the kernel with a builtin  "ima_policy=" on the boot command line. (Fedora/RHEL may also require the boot command line parameter 'ima=on'.)
+
+To determine if your distro enables IMA by default, mount securityfs (mount -t securityfs security /sys/kernel/security), if it isn't already mounted, and then check if '<securityfs>/integrity/ima' exists. If it exists, IMA is indeed enabled. On systems without IMA enabled, recompile the kernel(#compiling-the-kernel-with-evmima-appraisal-enabled) with the config option 'CONFIG_IMA' enabled.
+
+### Controlling IMA-measurement
+
+IMA is controlled with several kernel command line parameters:
+
+
+ima_audit= informational audit logging
+ Format: { "0" | "1" }
+ 0 -- normal integrity auditing messages. (Default)
+ 1 -- enable additional informational integrity auditing messages.
+
+ (eg. Although file measurements are only added to the measurement list once and cached, if the inode is flushed, subsequent access to the inode will result in re-measuring the file and attempting to add the measurement again to the measurement list. Enabling ima_audit will log such attempts.)
+
+ima_policy= builtin policy
+Format:  {"tcb" | "appraise_tcb" | "secure-boot"}
+**NEW** Linux-4.13 default: no policy
+
+ima_template= template used
+ Format: { "ima" | "ima-ng" | "ima-sig" }
+ Linux 3.13 default: "ima-ng"
+
+ima_hash= hash used
+ Format: { "sha1" | "md5" | "sha256" | "sha512" | "wp512" | ... }
+  'ima' template default: "sha1"
+  Linux 3.13 default: "sha256"
+
+ ima_tcb  (deprecated)
+ If specified, enables the TCB policy, which meets the needs of the Trusted Computing Base. This means IMA will measure all programs exec'd, files mmap'd for exec, and all files opened for read by uid=0.
+
+### IMA Measurement List
+
+IMA-measurements maintains a runtime measurement list, which can be displayed as shown below.
+
+- mount securityfs as /sys/kernel/security
+
+    $ su -c 'mkdir /sys/kernel/security'
+    $ su -c 'mount -t securityfs securityfs /sys/kernel/security'
+
+Modify /etc/fstab to mount securityfs on boot.
+
+- display the runtime measurement list    (Only root is allowed access to securityfs files.)
+
+Example 1: 'ima-ng' template
+    $ su -c 'head -5 /sys/kernel/security/ima/ascii_runtime_measurements'
+
+    PCR     template-hash                           filedata-hash                           filename-hint
+    10 91f34b5c671d73504b274a919661cf80dab1e127 ima-ng sha1:1801e1be3e65ef1eaa5c16617bec8f1274eaf6b3 boot_aggregate
+    10 8b1683287f61f96e5448f40bdef6df32be86486a ima-ng sha256:efdd249edec97caf9328a4a01baa99b7d660d1afc2e118b69137081c9b689954 /init
+    10 ed893b1a0bc54ea5cd57014ca0a0f087ce71e4af ima-ng sha256:1fd312aa6e6417a4d8dcdb2693693c81892b3db1a6a449dec8e64e4736a6a524 /usr/lib64/ld-2.16.so
+    10 9051e8eb6a07a2b10298f4dc2342671854ca432b ima-ng sha256:3d3553312ab91bb95ae7a1620fedcc69793296bdae4e987abc5f8b121efd84b8 /etc/ld.so.cache
+
+PCR: default CONFIG_IMA_MEASURE_PCR_IDX is 10
+template-hash: sha1 hash(filedata-hash length, filedata-hash, pathname length, pathname)
+filedata-hash: sha256 hash(filedata)
+
+
+Example 2:  'ima-sig' template (same format as ima-ng, but with an appended signature when present)
+
+    PCR     template-hash                           filedata-hash                           filename-hint                         file-signature
+    10 f63c10947347c71ff205ebfde5971009af27b0ba ima-sig sha256:6c118980083bccd259f069c2b3c3f3a2f5302d17a685409786564f4cf05b3939 /usr/lib64/libgspell-1.so.1.0.0   0302046e6c10460100aa43a4b1136f45735669632ad ...
+    10 595eb9bf805874b459ce073af158378f274ea961 ima-sig sha256:8632769297867a80a9614caa98034d992441e723f0b383ca529faa306c640638 /usr/lib64/gedit/plugins/libmodelines.so 0302046e6c104601002394b70ab93 ...
+
+
+Example 3: *original* 'ima' template
+
+    PCR     template-hash                           filedata-hash                           filename-hint
+    10 7971593a7ad22a7cce5b234e4bc5d71b04696af4 ima b5a166c10d153b7cc3e5b4f1eab1f71672b7c524 boot_aggregate
+    10 2c7020ad8cab6b7419e4973171cb704bdbf52f77 ima e09e048c48301268ff38645f4c006137e42951d0 /init
+    10 ef7a0aff83dd46603ebd13d1d789445365adb3b3 ima 0f8b3432535d5eab912ad3ba744507e35e3617c1 /init
+    10 247dba6fc82b346803660382d1973c019243e59f ima 747acb096b906392a62734916e0bb39cef540931 ld-2.9.so
+    10 341de30a46fa55976b26e55e0e19ad22b5712dcb ima 326045fc3d74d8c8b23ac8ec0a4d03fdacd9618a ld.so.cache
+
+PCR: default CONFIG_IMA_MEASURE_PCR_IDX is 10
+template-hash: sha1 hash(filedata-hash, filename-hint)
+filedata-hash: sha1 hash(filedata)
+
+The first element in the runtime measurement list, shown above, is the boot_aggregate. The boot_aggregate is a SHA1 hash over tpm registers 0-7, assuming a TPM chip exists, and zeroes, if the TPM chip does not exist.
+
+- display the bios measurement list entries, used in calculating the boot aggregate
+
+    $ su -c 'head /sys/kernel/security/tpm0/ascii_bios_measurements'
+
+    0 f797cb88c4b07745a129f35ea01b47c6c309cda9 08 S-CRTM Version
+    0 dca68da0707a9a52b24db82def84f26fa463b44d 01 POST CODE
+    0 dd9efa31c88f467c3d21d3b28de4c53b8d55f3bc 01 POST CODE
+    0 dd261ca7511a7daf9e16cb572318e8e5fbd22963 01 POST CODE
+    0 df22cabc0e09aabf938bcb8ff76853dbcaae670d 01 POST CODE
+    0 a0d023a7f94efcdbc8bb95ab415d839bdfd73e9e 01 POST CODE
+    0 38dd128dc93ff91df1291a1c9008dcf251a0ef39 01 POST CODE
+    0 dd261ca7511a7daf9e16cb572318e8e5fbd22963 01 POST CODE
+    0 df22cabc0e09aabf938bcb8ff76853dbcaae670d 01 POST CODE
+    0 a0d023a7f94efcdbc8bb95ab415d839bdfd73e9e 01 POST CODE
+
+### Verifying IMA Measurements
+
+The IMA tests programs are part of the Linux Test Project.(https://github.com/linux-test-project/ltp/wiki)
+
+- Download, compile, and install the standalone version of the IMA LTP test programs in /usr/local/bin.
+
+    $ wget -O ltp-ima-standalone-v2.tar.gz http://downloads.sf.net/project/linux-ima/linux-ima/ltp-ima-standalone-v2.tar.gz
+    $ tar -xvzf ltp-ima-standalone-v2.tar.gz
+    ima-tests/Makefile
+    ima-tests/README
+    ima-tests/ima_boot_aggregate.c
+    ima-tests/ima_measure.c
+    ima-tests/ima_mmap.c
+    ima-tests/ima_sigv2.c
+    ima-tests/ltp-tst-replacement.c
+    ima-tests/pkeys.c
+    ima-tests/rsa_oid.c
+    ima-tests/config.h
+    ima-tests/debug.h
+    ima-tests/hash_info.h
+    ima-tests/ima_sigv2.h
+    ima-tests/list.h
+    ima-tests/pkeys.h
+    ima-tests/rsa.h
+    ima-tests/test.h
+    $ cd ima-tests
+    $ make
+    $ su -c 'make install'
+
+- ima_boot_aggregate <tpm_bios file>
+
+Using the TPM's binary bios measurement list, re-calculate the boot aggregate.
+
+    $ su -c '/usr/local/bin/ima_boot_aggregate /sys/kernel/security/tpm0/binary_bios_measurements'
+    000 f797cb88c4b07745a129f35ea01b47c6c309cda9
+    000 dca68da0707a9a52b24db82def84f26fa463b44d
+    < snip >
+    005 6895eb784cdaf843eaad522e639f75d24d4c1ff5
+    PCR-00: 07274edf7147abda49200100fd668ce2c3a374d7
+    PCR-01: 48dff4fbf3a34d56a08dfc1504a3a9d707678ff7
+    PCR-02: 53de584dcef03f6a7dac1a240a835893896f218d
+    PCR-03: 3a3f780f11a4b49969fcaa80cd6e3957c33b2275
+    PCR-04: acb44e9dd4594d3f121df2848f572e4d891f0574
+    PCR-05: df72e880e68a2b52e6b6738bb4244b932e0f1c76
+    PCR-06: 585e579e48997fee8efd20830c6a841eb353c628
+    PCR-07: 3a3f780f11a4b49969fcaa80cd6e3957c33b2275
+    boot_aggregate:b5a166c10d153b7cc3e5b4f1eab1f71672b7c524
+
+and compare the value with the ascii_runtime_measurement list value.
+
+    $ su -c 'cat /sys/kernel/security/ima/ascii_runtime_measurements | grep boot_aggregate'
+    10 7971593a7ad22a7cce5b234e4bc5d71b04696af4 ima b5a166c10d153b7cc3e5b4f1eab1f71672b7c524 boot_aggregate
+
+<br>
+
+- ima_measure <binary_runtime_measurements> \--validate\ \--verify\ \--verbose\
+
+using the IMA binary measurement list, calculate the PCR aggregate value
+
+    $ su -c '/usr/local/bin/ima_measure /sys/kernel/security/ima/binary_runtime_measurements --validate'

_service:tar_scm:ima-evm-utils-1.5.tar.gz/kernel-configs Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/kernel-configs/base Added

@@ -0,0 +1,213 @@
+CONFIG_LOCALVERSION="-dont-use"
+CONFIG_WATCH_QUEUE=y
+CONFIG_AUDIT=y
+CONFIG_AUDITSYSCALL=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_LOG_BUF_SHIFT=17
+CONFIG_USER_NS=y
+CONFIG_PID_NS=y
+CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_SYSTEM_DATA_VERIFICATION=y
+CONFIG_TRACEPOINTS=y
+CONFIG_CON_CHAN="xterm"
+CONFIG_SSL_CHAN="pty"
+CONFIG_MODULE_SIG_FORMAT=y
+CONFIG_MODULE_SIG=y
+CONFIG_MODULE_SIG_FORCE=y
+CONFIG_MODULE_SIG_ALL=y
+CONFIG_MODULE_SIG_SHA1=y
+CONFIG_MODULE_SIG_HASH="sha1"
+CONFIG_MODULES_TREE_LOOKUP=y
+CONFIG_BLK_DEBUG_FS=y
+CONFIG_ASN1=y
+CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_SLUB=y
+CONFIG_COMPACTION=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_MIGRATION=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_LEGACY_PTY_COUNT=256
+CONFIG_NULL_TTY=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+CONFIG_VALIDATE_FS_PARSER=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXT4_DEBUG=y
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FS_VERITY=y
+CONFIG_FS_VERITY_BUILTIN_SIGNATURES=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TMPFS_XATTR=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_KEYS=y
+CONFIG_ENCRYPTED_KEYS=y
+CONFIG_SECURITY=y
+CONFIG_SECURITYFS=y
+CONFIG_SECURITY_NETWORK=y
+CONFIG_SECURITY_PATH=y
+CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_SKCIPHER=y
+CONFIG_CRYPTO_SKCIPHER2=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_AKCIPHER2=y
+CONFIG_CRYPTO_AKCIPHER=y
+CONFIG_CRYPTO_KPP2=y
+CONFIG_CRYPTO_ACOMP2=y
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_NULL2=y
+CONFIG_CRYPTO_RSA=y
+CONFIG_CRYPTO_ECC=y
+CONFIG_CRYPTO_ECDSA=y
+CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_WP512=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_ASYMMETRIC_KEY_TYPE=y
+CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
+CONFIG_X509_CERTIFICATE_PARSER=y
+CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
+CONFIG_PKCS7_MESSAGE_PARSER=y
+CONFIG_PKCS7_TEST_KEY=y
+CONFIG_SIGNED_PE_FILE_VERIFICATION=y
+CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
+CONFIG_MODULE_SIG_KEY_TYPE_RSA=y
+CONFIG_SYSTEM_TRUSTED_KEYRING=y
+CONFIG_SYSTEM_TRUSTED_KEYS=""
+CONFIG_SYSTEM_EXTRA_CERTIFICATE=y
+CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE=4096
+CONFIG_SECONDARY_TRUSTED_KEYRING=y
+CONFIG_SYSTEM_BLACKLIST_KEYRING=y
+CONFIG_SYSTEM_BLACKLIST_HASH_LIST=""
+CONFIG_SYSTEM_REVOCATION_LIST=y
+CONFIG_SYSTEM_REVOCATION_KEYS=""
+CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE=y
+CONFIG_BINARY_PRINTF=y
+CONFIG_CRYPTO_LIB_AES=y
+CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRC_CCITT=y
+CONFIG_XXHASH=y
+CONFIG_AUDIT_GENERIC=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+CONFIG_SGL_ALLOC=y
+CONFIG_GLOB=y
+CONFIG_CLZ_TAB=y
+CONFIG_MPILIB=y
+CONFIG_SIGNATURE=y
+CONFIG_OID_REGISTRY=y
+CONFIG_STACKDEPOT=y
+CONFIG_STACKDEPOT_ALWAYS_INIT=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PRINTK_CALLER=y
+CONFIG_DYNAMIC_DEBUG=y
+CONFIG_DYNAMIC_DEBUG_CORE=y
+CONFIG_DEBUG_INFO_DWARF5=y
+CONFIG_GDB_SCRIPTS=y
+CONFIG_FRAME_WARN=2048
+CONFIG_READABLE_ASM=y
+CONFIG_DEBUG_SECTION_MISMATCH=y
+CONFIG_DEBUG_FS=y
+CONFIG_DEBUG_FS_ALLOW_ALL=y
+CONFIG_UBSAN=y
+CONFIG_CC_HAS_UBSAN_BOUNDS=y
+CONFIG_UBSAN_BOUNDS=y
+CONFIG_UBSAN_ONLY_BOUNDS=y
+CONFIG_UBSAN_SHIFT=y
+CONFIG_UBSAN_DIV_ZERO=y
+CONFIG_UBSAN_BOOL=y
+CONFIG_UBSAN_ENUM=y
+CONFIG_UBSAN_ALIGNMENT=y
+CONFIG_PAGE_EXTENSION=y
+CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT=y
+CONFIG_SLUB_DEBUG=y
+CONFIG_SLUB_DEBUG_ON=y
+CONFIG_PAGE_OWNER=y
+CONFIG_PAGE_POISONING=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_FREE=y
+CONFIG_DEBUG_OBJECTS_TIMERS=y
+CONFIG_DEBUG_OBJECTS_WORK=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y
+CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
+CONFIG_DEBUG_KMEMLEAK=y
+CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE=16000
+CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y
+CONFIG_DEBUG_STACK_USAGE=y
+CONFIG_SCHED_STACK_END_CHECK=y
+CONFIG_DEBUG_SHIRQ=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_ON_OOPS_VALUE=1
+CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_DEBUG_TIMEKEEPING=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RAW_LOCK_NESTING=y
+CONFIG_LOCK_STAT=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
+CONFIG_DEBUG_RWSEMS=y
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_LOCKDEP=y
+CONFIG_LOCKDEP_BITS=15
+CONFIG_LOCKDEP_CHAINS_BITS=16
+CONFIG_LOCKDEP_STACK_TRACE_BITS=19
+CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
+CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
+CONFIG_WW_MUTEX_SELFTEST=y
+CONFIG_CSD_LOCK_WAIT_DEBUG=y
+CONFIG_TRACE_IRQFLAGS=y
+CONFIG_DEBUG_IRQFLAGS=y
+CONFIG_DEBUG_LIST=y
+CONFIG_DEBUG_PLIST=y
+CONFIG_DEBUG_NOTIFIERS=y
+CONFIG_BUG_ON_DATA_CORRUPTION=y
+CONFIG_PROVE_RCU=y
+CONFIG_RCU_TRACE=y
+CONFIG_NOP_TRACER=y

_service:tar_scm:ima-evm-utils-1.5.tar.gz/kernel-configs/integrity Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/m4/default-hash-algo.m4 Added

@@ -0,0 +1,36 @@
+dnl Copyright (c) 2021 Bruno Meneguele <bmeneg@redhat.com>
+dnl Check hash algorithm availability in the kernel
+dnl
+dnl $1 - $KERNEL_HEADERS
+
+AC_DEFUN(AX_DEFAULT_HASH_ALGO, 
+	HASH_INFO_HEADER="$1/include/uapi/linux/hash_info.h"
+
+	AC_ARG_WITH(default_hash,
+		AS_HELP_STRING(--with-default-hash=ALGORITHM, specifies the default hash algorithm to be used),
+		HASH_ALGO=$withval,
+		HASH_ALGO=sha256)
+
+	AC_PROG_SED()
+	HASH_ALGO="$(echo $HASH_ALGO | $SED 's/$.*$/\L\1\E/')"
+
+	AC_CHECK_HEADER($HASH_INFO_HEADER,
+		HAVE_HASH_INFO_HEADER=yes,
+		AC_MSG_WARN($HASH_INFO_HEADER not found.))
+
+	if test "x$HAVE_HASH_INFO_HEADER" = "x"; then
+		AC_MSG_RESULT(using $HASH_ALGO algorithm as default hash algorith)
+		AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", Define default hash algorithm)
+	else
+		AC_PROG_GREP()
+		$SED -n 's/HASH_ALGO_$.*$,/\L\1\E/p' $HASH_INFO_HEADER | $GREP -w $HASH_ALGO > /dev/null
+		have_hash=$?
+
+		if test $have_hash -ne 0; then
+			AC_MSG_ERROR($HASH_ALGO algorithm specified, but not provided by the kernel, 1)
+		else
+			AC_MSG_NOTICE(using $HASH_ALGO as default hash algorithm)
+			AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", Define default hash algorithm)
+		fi
+	fi
+)

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/m4/manpage-docbook-xsl.m4 -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/m4/manpage-docbook-xsl.m4 Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/packaging/ima-evm-utils.spec -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/packaging/ima-evm-utils.spec Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/.gitignore -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/.gitignore Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/Makefile.am -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/Makefile.am Changed

@@ -4,9 +4,17 @@
 libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS)
 # current:revision:age
 # result: current-age.age.revision
-libimaevm_la_LDFLAGS = -version-info 2:0:0
+libimaevm_la_LDFLAGS = -version-info 4:0:0
 libimaevm_la_LIBADD =  $(LIBCRYPTO_LIBS)
 
+if CONFIG_SIGV1
+libimaevm_la_CFLAGS = -DCONFIG_SIGV1
+endif
+
+if CONFIG_IMA_EVM_ENGINE
+libimaevm_la_CFLAGS = -DCONFIG_IMA_EVM_ENGINE
+endif
+
 include_HEADERS = imaevm.h
 
 nodist_libimaevm_la_SOURCES = hash_info.h
@@ -22,10 +30,31 @@
 evmctl_LDFLAGS = $(LDFLAGS_READLINE)
 evmctl_LDADD =  $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la
 
+# Enable IMA signature version 1
+if CONFIG_SIGV1
+evmctl_CFLAGS = -DCONFIG_SIGV1
+endif
+
+# Enable "--engine" support
+if CONFIG_IMA_EVM_ENGINE
+evmctl_CFLAGS = -DCONFIG_IMA_EVM_ENGINE
+endif
+
+# USE_PCRTSS uses the Intel TSS
 if USE_PCRTSS
-evmctl_SOURCES += pcr_tss.c
+ evmctl_SOURCES += pcr_tss.c
+
+# USE_IBMTSS uses the IBM TSS
+else
+if USE_IBMTSS
+ evmctl_SOURCES += pcr_ibmtss.c
+ evmctl_LDADD += -libmtss
+
+# uses the IBM TSS command line utilities
 else
-evmctl_SOURCES += pcr_tsspcrread.c
+ evmctl_SOURCES += pcr_tsspcrread.c
+
+endif
 endif
 
 AM_CPPFLAGS = -I$(top_srcdir) -include config.h

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/evmctl.c -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/evmctl.c Changed

@@ -42,6 +42,7 @@
 #include <sys/param.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
+#include <arpa/inet.h>
 #include <fcntl.h>
 #include <unistd.h>
 #include <stdlib.h>
@@ -57,12 +58,17 @@
 #include <termios.h>
 #include <assert.h>
 
+#include <openssl/asn1.h>
 #include <openssl/sha.h>
 #include <openssl/pem.h>
+#include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/err.h>
 #include <openssl/rsa.h>
+#if CONFIG_IMA_EVM_ENGINE
 #include <openssl/engine.h>
+#endif
+#include <openssl/x509v3.h>
 #include "hash_info.h"
 #include "pcr.h"
 #include "utils.h"
@@ -125,12 +131,15 @@
 static char *ima_str;
 static char *selinux_str;
 static char *search_type;
+static char *verify_bank;
 static int verify_list_sig;
 static int recursive;
 static int msize;
 static dev_t fs_dev;
 static bool evm_immutable;
 static bool evm_portable;
+static bool veritysig;
+static bool hwtpm;
 
 #define HMAC_FLAG_NO_UUID	0x0001
 #define HMAC_FLAG_CAPS_SET	0x0002
@@ -141,10 +150,6 @@
 static int find(const char *path, int dts, find_cb_t func);
 
 #define REG_MASK	(1 << DT_REG)
-#define DIR_MASK	(1 << DT_DIR)
-#define LNK_MASK	(1 << DT_LNK)
-#define CHR_MASK	(1 << DT_CHR)
-#define BLK_MASK	(1 << DT_BLK)
 
 struct command cmds;
 static void print_usage(struct command *cmd);
@@ -165,6 +170,9 @@
 static char *pcrfileMAX_PCRFILE;
 static unsigned npcrfile;
 
+#define log_errno_reset(level, fmt, args...) \
+	{do_log(level, fmt " (errno: %s)\n", ##args, strerror(errno)); errno = 0; }
+
 static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)
 {
 	FILE *fp;
@@ -326,11 +334,17 @@
 	return -1;
 }
 
+/*
+ * calc_evm_hash - calculate the file metadata hash
+ *
+ * Returns 0 for EVP_ function failures. Return -1 for other failures.
+ * Return hash algorithm size on success.
+ */
 static int calc_evm_hash(const char *file, unsigned char *hash)
 {
         const EVP_MD *md;
 	struct stat st;
-	int err;
+	int err = -1;
 	uint32_t generation = 0;
 	EVP_MD_CTX *pctx;
 	unsigned int mdlen;
@@ -344,12 +358,10 @@
 #if OPENSSL_VERSION_NUMBER < 0x10100000
 	EVP_MD_CTX ctx;
 	pctx = &ctx;
-#else
-	pctx = EVP_MD_CTX_new();
 #endif
 
 	if (lstat(file, &st)) {
-		log_err("Failed to stat: %s\n", file);
+		log_errno_reset(LOG_ERR, "Failed to stat: %s", file);
 		return -1;
 	}
 
@@ -365,9 +377,7 @@
 		st.st_mode = strtoul(mode_str, NULL, 10);
 
 	if (!evm_immutable) {
-		if ((S_ISREG(st.st_mode) || S_ISDIR(st.st_mode)) && !generation_str) {
-			/* we cannot at the momement to get generation of
-			   special files kernel API does not support it */
+		if (S_ISREG(st.st_mode) && !generation_str) {
 			int fd = open(file, 0);
 
 			if (fd < 0) {
@@ -386,30 +396,42 @@
 
 	list_size = llistxattr(file, list, sizeof(list));
 	if (list_size < 0) {
-		log_err("llistxattr() failed\n");
+		log_errno_reset(LOG_ERR, "llistxattr() failed");
 		return -1;
 	}
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+	pctx = EVP_MD_CTX_new();
+	if (!pctx) {
+		log_err("EVP_MD_CTX_new() failed\n");
+		return 0;
+	}
+#endif
+
 	md = EVP_get_digestbyname(imaevm_params.hash_algo);
 	if (!md) {
 		log_err("EVP_get_digestbyname(%s) failed\n",
 			imaevm_params.hash_algo);
-		return 1;
+		err = 0;
+		goto out;
 	}
 
 	err = EVP_DigestInit(pctx, md);
 	if (!err) {
 		log_err("EVP_DigestInit() failed\n");
-		return 1;
+		goto out;
 	}
 
 	for (xattrname = evm_config_xattrnames; *xattrname != NULL; xattrname++) {
+		int use_xattr_ima = 0;
+
 		if (!strcmp(*xattrname, XATTR_NAME_SELINUX) && selinux_str) {
 			err = strlen(selinux_str) + 1;
 			if (err > sizeof(xattr_value)) {
 				log_err("selinux%u value is too long to fit into xattr%zu\n",
 					err, sizeof(xattr_value));
-				return -1;
+				err = -1;
+				goto out;
 			}
 			strcpy(xattr_value, selinux_str);
 		} else if (!strcmp(*xattrname, XATTR_NAME_IMA) && ima_str) {
@@ -417,9 +439,19 @@
 			if (err > sizeof(xattr_value)) {
 				log_err("ima%u value is too long to fit into xattr%zu\n",
 					err, sizeof(xattr_value));
-				return -1;
+				err = -1;
+				goto out;
 			}
 			hex2bin(xattr_value, ima_str, err);
+		} else if (!strcmp(*xattrname, XATTR_NAME_IMA) && evm_portable){
+			err = lgetxattr(file, xattr_ima, xattr_value,
+					sizeof(xattr_value));
+			if (err < 0) {
+				log_err("EVM portable sig: %s required\n",
+					xattr_ima);
+				goto out;
+			}
+			use_xattr_ima = 1;
 		} else if (!strcmp(*xattrname, XATTR_NAME_CAPS) && (hmac_flags & HMAC_FLAG_CAPS_SET)) {
 			if (!caps_str)
 				continue;
@@ -427,7 +459,8 @@
 			if (err >= sizeof(xattr_value)) {
 				log_err("caps%u value is too long to fit into xattr%zu\n",
 					err + 1, sizeof(xattr_value));
-				return -1;
+				err = -1;
+				goto out;
 			}
 			strcpy(xattr_value, caps_str);
 		} else {
@@ -442,12 +475,13 @@
 			}
 		}
 		/*log_debug("name: %s, value: %s, size: %d\n", *xattrname, xattr_value, err);*/
-		log_info("name: %s, size: %d\n", *xattrname, err);
+		log_info("name: %s, size: %d\n",
+			 use_xattr_ima ? xattr_ima : *xattrname, err);
 		log_debug_dump(xattr_value, err);
 		err = EVP_DigestUpdate(pctx, xattr_value, err);
 		if (!err) {
 			log_err("EVP_DigestUpdate() failed\n");
-			return 1;
+			goto out;
 		}
 	}

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/hash_info.gen -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/hash_info.gen Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/imaevm.h -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/imaevm.h Changed

@@ -48,6 +48,13 @@
 #include <errno.h>
 #include <sys/types.h>
 #include <openssl/rsa.h>
+#ifdef CONFIG_IMA_EVM_ENGINE
+#include <openssl/engine.h>
+#endif
+
+#if defined(OPENSSL_NO_ENGINE) || defined(OPENSSL_NO_DYNAMIC_ENGINE)
+#undef CONFIG_IMA_EVM_ENGINE
+#endif
 
 #ifdef USE_FPRINTF
 #define do_log(level, fmt, args...)	\
@@ -74,12 +81,26 @@
 #define log_err(fmt, args...)		do_log(LOG_ERR, fmt, ##args)
 #define log_errno(fmt, args...)		do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno)
 
+#ifndef DEFAULT_HASH_ALGO
+#define DEFAULT_HASH_ALGO "sha256"
+#endif
+
 #define	DATA_SIZE	4096
 #define SHA1_HASH_LEN   20
 
 #define MAX_DIGEST_SIZE		64
 #define MAX_SIGNATURE_SIZE	1024
 
+/*
+ * The maximum template data size is dependent on the template format. For
+ * example the 'ima-modsig' template includes two signatures - one for the
+ * entire file, the other without the appended signature - and other fields
+ * (e.g. file digest, file name, file digest without the appended signature).
+ *
+ * Other template formats are much smaller.
+ */
+#define MAX_TEMPLATE_SIZE	(MAX_SIGNATURE_SIZE * 4)
+
 #define __packed __attribute__((packed))
 
 enum evm_ima_xattr_type {
@@ -88,6 +109,7 @@
 	EVM_IMA_XATTR_DIGSIG,
 	IMA_XATTR_DIGEST_NG,
 	EVM_XATTR_PORTABLE_DIGSIG,
+	IMA_VERITY_DIGSIG,
 };
 
 struct h_misc {
@@ -133,7 +155,8 @@
 
 enum digsig_version {
 	DIGSIG_VERSION_1 = 1,
-	DIGSIG_VERSION_2
+	DIGSIG_VERSION_2,
+	DIGSIG_VERSION_3	/* hash of ima_file_id struct (portion used) */
 };
 
 struct pubkey_hdr {
@@ -196,6 +219,8 @@
 	const char *hash_algo;
 	const char *keyfile;
 	const char *keypass;
+	uint32_t keyid;		/* keyid overriding value, unless 0. (Host order.) */
+	ENGINE *eng;
 };
 
 struct RSA_ASN1_template {
@@ -218,6 +243,7 @@
 void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len);
 void calc_keyid_v2(uint32_t *keyid, char *str, EVP_PKEY *pkey);
 int key2bin(RSA *key, unsigned char *pub);
+uint32_t imaevm_read_keyid(const char *certfile);
 
 int sign_hash(const char *algo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, unsigned char *sig);
 int verify_hash(const char *file, const unsigned char *hash, int size, unsigned char *sig, int siglen);
@@ -225,5 +251,6 @@
 void init_public_keys(const char *keyfiles);
 int imaevm_hash_algo_from_sig(unsigned char *sig);
 const char *imaevm_hash_algo_by_id(int algo);
+int calc_hash_sigv3(enum evm_ima_xattr_type type, const char *algo, const unsigned char *in_hash, unsigned char *out_hash);
 
 #endif

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/libimaevm.c -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/libimaevm.c Changed

@@ -45,6 +45,7 @@
 #include <sys/param.h>
 #include <sys/stat.h>
 #include <asm/byteorder.h>
+#include <arpa/inet.h>
 #include <unistd.h>
 #include <dirent.h>
 #include <string.h>
@@ -52,11 +53,14 @@
 #include <assert.h>
 #include <ctype.h>
 
+#include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/pem.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 #include <openssl/err.h>
+#include <openssl/engine.h>
 
 #include "imaevm.h"
 #include "hash_info.h"
@@ -85,19 +89,19 @@
 struct libimaevm_params imaevm_params = {
 	.verbose = LOG_INFO,
 	.x509 = 1,
-	.hash_algo = "sha1",
+	.hash_algo = DEFAULT_HASH_ALGO,
 };
 
 static void __attribute__ ((constructor)) libinit(void);
 
-void imaevm_do_hexdump(FILE *fp, const void *ptr, int len, bool cr)
+void imaevm_do_hexdump(FILE *fp, const void *ptr, int len, bool newline)
 {
 	int i;
 	uint8_t *data = (uint8_t *) ptr;
 
 	for (i = 0; i < len; i++)
 		fprintf(fp, "%02x", datai);
-	if (cr)
+	if (newline)
 		fprintf(fp, "\n");
 }
 
@@ -156,7 +160,7 @@
 
 	for (size = stats.st_size; size; size -= len) {
 		len = MIN(size, bs);
-		if (!fread(data, len, 1, fp)) {
+		if (fread(data, len, 1, fp) != 1) {
 			if (ferror(fp)) {
 				log_err("fread() failed\n\n");
 				goto out;
@@ -177,67 +181,6 @@
 	return err;
 }
 
-static int add_dir_hash(const char *file, EVP_MD_CTX *ctx)
-{
-	int err;
-	struct dirent *de;
-	DIR *dir;
-	unsigned long long ino, off;
-	unsigned int type;
-	int result = 0;
-
-	dir = opendir(file);
-	if (!dir) {
-		log_err("Failed to open: %s\n", file);
-		return -1;
-	}
-
-	while ((de = readdir(dir))) {
-		ino = de->d_ino;
-		off = de->d_off;
-		type = de->d_type;
-		log_debug("entry: %s, ino: %llu, type: %u, off: %llu, reclen: %hu\n",
-			  de->d_name, ino, type, off, de->d_reclen);
-		err = EVP_DigestUpdate(ctx, de->d_name, strlen(de->d_name));
-		/*err |= EVP_DigestUpdate(ctx, &off, sizeof(off));*/
-		err |= EVP_DigestUpdate(ctx, &ino, sizeof(ino));
-		err |= EVP_DigestUpdate(ctx, &type, sizeof(type));
-		if (!err) {
-			log_err("EVP_DigestUpdate() failed\n");
-			output_openssl_errors();
-			result = 1;
-			break;
-		}
-	}
-
-	closedir(dir);
-
-	return result;
-}
-
-static int add_link_hash(const char *path, EVP_MD_CTX *ctx)
-{
-	int err;
-	char buf1024;
-
-	err = readlink(path, buf, sizeof(buf));
-	if (err <= 0)
-		return -1;
-
-	log_info("link: %s -> %.*s\n", path, err, buf);
-	return !EVP_DigestUpdate(ctx, buf, err);
-}
-
-static int add_dev_hash(struct stat *st, EVP_MD_CTX *ctx)
-{
-	uint32_t dev = st->st_rdev;
-	unsigned major = (dev & 0xfff00) >> 8;
-	unsigned minor = (dev & 0xff) | ((dev >> 12) & 0xfff00);
-
-	log_info("device: %u:%u\n", major, minor);
-	return !EVP_DigestUpdate(ctx, &dev, sizeof(dev));
-}
-
 int ima_calc_hash(const char *file, uint8_t *hash)
 {
 	const EVP_MD *md;
@@ -278,18 +221,8 @@
 	case S_IFREG:
 		err = add_file_hash(file, pctx);
 		break;
-	case S_IFDIR:
-		err = add_dir_hash(file, pctx);
-		break;
-	case S_IFLNK:
-		err = add_link_hash(file, pctx);
-		break;
-	case S_IFIFO: case S_IFSOCK:
-	case S_IFCHR: case S_IFBLK:
-		err = add_dev_hash(&st, pctx);
-		break;
 	default:
-		log_errno("Unsupported file type");
+		log_err("Unsupported file type (0x%x)", st.st_mode & S_IFMT);
 		err = -1;
 		goto err;
 	}
@@ -317,6 +250,7 @@
 {
 	FILE *fp;
 	EVP_PKEY *pkey = NULL;
+	struct stat st;
 
 	if (!keyfile)
 		return NULL;
@@ -328,6 +262,17 @@
 		return NULL;
 	}
 
+	if (fstat(fileno(fp), &st) == -1) {
+		log_err("Failed to fstat key file: %s\n", keyfile);
+		goto out;
+	}
+
+	if ((st.st_mode & S_IFMT) != S_IFREG) {
+		if (imaevm_params.verbose > LOG_INFO)
+			log_err("Key file is not regular file: %s\n", keyfile);
+		goto out;
+	}
+
 	if (x509) {
 		X509 *crt = d2i_X509_fp(fp, NULL);
 
@@ -357,6 +302,7 @@
 	return pkey;
 }
 
+#if CONFIG_SIGV1
 RSA *read_pub_key(const char *keyfile, int x509)
 {
 	EVP_PKEY *pkey;
@@ -416,6 +362,7 @@
 
 	return 0;
 }
+#endif  /* CONFIG_SIGV1 */
 
 struct public_key_entry {
 	struct public_key_entry *next;
@@ -463,8 +410,6 @@
 	keyfiles_free = tmp_keyfiles;
 
 	while ((keyfile = strsep(&tmp_keyfiles, ", \t")) != NULL) {
-		if (!keyfile)
-			break;
 		if ((*keyfile == '\0') || (*keyfile == ' ') ||
 		    (*keyfile == '\t'))
 			continue;
@@ -491,10 +436,21 @@
 }
 
 /*
+ * Verify a signature, prefixed with the signature_v2_hdr, either based
+ * directly or indirectly on the file data hash.

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/pcr.h -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/pcr.h Changed

_service:tar_scm:ima-evm-utils-1.5.tar.gz/src/pcr_ibmtss.c Added

@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Support PCR reading implementation based on IBM TSS2
+ *
+ * Copyright (C) 2021 IBM Ken Goldman <kgoldman@us.ibm.com>
+ */
+#include <errno.h>
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+
+#include <openssl/sha.h>
+
+#define USE_FPRINTF
+#include "utils.h"
+#include "imaevm.h"
+
+#define TPM_POSIX	/* use Posix, not Windows constructs in TSS */
+#undef MAX_DIGEST_SIZE	/* imaevm uses a different value than the TSS */
+#include <ibmtss/tss.h>
+
+int tpm2_pcr_supported(void)
+{
+	if (imaevm_params.verbose > LOG_INFO)
+		log_info("Using ibmtss to read PCRs\n");
+
+	return 1;
+}
+
+/* Table mapping C strings to TCG algorithm identifiers */
+typedef struct tdAlgorithm_Map {
+	const char *algorithm_string;
+	TPMI_ALG_HASH algid;
+} Algorithm_Map;
+
+Algorithm_Map algorithm_map = {
+				 { "sha1", TPM_ALG_SHA1},
+				 { "sha256", TPM_ALG_SHA256},
+#if 0	/* uncomment as these digest algorithms are supported */
+				 { "", TPM_ALG_SHA384},
+				 { "", TPM_ALG_SHA512},
+				 { "", TPM_ALG_SM3_256},
+				 { "", TPM_ALG_SHA3_256},
+				 { "", TPM_ALG_SHA3_384},
+				 { "", TPM_ALG_SHA3_512},
+#endif
+};
+
+/*
+ * algorithm_string_to_algid() converts a digest algorithm from a C string to a
+ * TCG algorithm identifier as defined in the TCG Algorithm Regisrty..
+ *
+ *  Returns TPM_ALG_ERROR if the string has an unsupported value.
+ */
+static TPMI_ALG_HASH algorithm_string_to_algid(const char *algorithm_string)
+{
+	size_t 	i;
+
+	for (i=0 ; i < sizeof(algorithm_map)/sizeof(Algorithm_Map) ; i++) {
+		if (strcmp(algorithm_string, algorithm_mapi.algorithm_string)
+		    == 0) {
+			return algorithm_mapi.algid; 		/* if match */
+		}
+	}
+	return TPM_ALG_ERROR;
+}
+
+/*
+ * tpm2_pcr_read - read the PCR
+ *
+ * algo_name: PCR digest algorithm (the PCR bank) as a C string
+ * pcr_handle: PCR number to read
+ * hwpcr: buffer for the PCR output in binary
+ * len: allocated size of hwpcr and should match the digest algorithm
+ */
+int tpm2_pcr_read(const char *algo_name, uint32_t pcr_handle, uint8_t *hwpcr,
+		  int len, char **errmsg)
+{
+        int 			ret = 0;	/* function return code */
+	TPM_RC			rc = 0;		/* TCG return code */
+	TPM_RC 			rc1 = 0;	/* secondary return code */
+	PCR_Read_In 		pcr_read_in;	/* command input */
+	PCR_Read_Out 		pcr_read_out;	/* response output */
+	TSS_CONTEXT		*tss_context = NULL;
+	TPMI_ALG_HASH 		alg_id;		/* PCR algorithm */
+
+	alg_id = algorithm_string_to_algid(algo_name);
+	if (alg_id == TPM_ALG_ERROR) {
+		ret = asprintf(errmsg, "tpm2_pcr_read: unknown algorithm %s",
+			       algo_name);
+		if (ret == -1) 	/* the contents of errmsg is undefined */
+			*errmsg = NULL;
+		rc = 1;
+		goto end;
+	}
+
+	rc = TSS_Create(&tss_context);
+	if (rc != 0)
+		goto end;
+
+	/* call TSS to execute the command */
+	pcr_read_in.pcrSelectionIn.count = 1;
+	pcr_read_in.pcrSelectionIn.pcrSelections0.hash = alg_id;
+	pcr_read_in.pcrSelectionIn.pcrSelections0.sizeofSelect = 3;
+	pcr_read_in.pcrSelectionIn.pcrSelections0.pcrSelect0 = 0;
+	pcr_read_in.pcrSelectionIn.pcrSelections0.pcrSelect1 = 0;
+	pcr_read_in.pcrSelectionIn.pcrSelections0.pcrSelect2 = 0;
+	pcr_read_in.pcrSelectionIn.pcrSelections0.pcrSelectpcr_handle / 8 =
+		1 << (pcr_handle % 8);
+	rc = TSS_Execute(tss_context,
+			 (RESPONSE_PARAMETERS *)&pcr_read_out,
+			 (COMMAND_PARAMETERS *)&pcr_read_in,
+			 NULL,
+			 TPM_CC_PCR_Read,
+			 TPM_RH_NULL, NULL, 0);
+	if (rc != 0)
+		goto end;
+
+	/* nothing read, bank missing */
+	if (pcr_read_out.pcrValues.count == 0) {
+		ret = asprintf(errmsg, "tpm2_pcr_read: returned count 0 for %s",
+			       algo_name);
+		if (ret == -1) /* the contents of errmsg is undefined */
+			*errmsg = NULL;
+		rc = 1;
+		goto end;
+	}
+	/* len parameter did not match the digest algorithm */
+	else if (pcr_read_out.pcrValues.digests0.t.size != len) {
+		ret = asprintf(errmsg,
+			       "tpm2_pcr_read: "
+			       "expected length %d actual %u for %s",
+			       len, pcr_read_out.pcrValues.digests0.t.size,
+			       algo_name);
+		if (ret == -1)	/* the contents of errmsg is undefined */
+			*errmsg = NULL;
+		rc = 1;
+		goto end;
+	} else {
+		memcpy(hwpcr,
+		       pcr_read_out.pcrValues.digests0.t.buffer,
+		       pcr_read_out.pcrValues.digests0.t.size);
+	}
+end:
+	/* Call delete even on errors to free context resources */
+	rc1 = TSS_Delete(tss_context);
+
+	/* map TCG return code to function return code */
+	if ((rc == 0) && (rc1 == 0))
+		return 0;
+	else
+		return -1;
+}

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/pcr_tss.c -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/pcr_tss.c Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/pcr_tsspcrread.c -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/pcr_tsspcrread.c Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/src/utils.c -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/src/utils.c Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/tests/Makefile.am -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/Makefile.am Changed

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/tests/boot_aggregate.test -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/boot_aggregate.test Changed

@@ -12,7 +12,7 @@
 # for verifying the calculated boot_aggregate is included in this
 # directory as well.
 
-trap cleanup SIGINT SIGTERM EXIT
+trap '_report_exit_and_cleanup cleanup' SIGINT SIGTERM EXIT
 
 # Base VERBOSE on the environment variable, if set.
 VERBOSE="${VERBOSE:-0}"
@@ -126,8 +126,10 @@
 # Verify that the last "boot_aggregate" record in the IMA measurement
 # list matches.
 check() {
+	local options=$1
+
 	echo "INFO: Calculating the boot_aggregate (PCRs 0 - 9) for multiple banks"
-	bootaggr=$(evmctl ima_boot_aggregate)
+	bootaggr=$(evmctl ima_boot_aggregate ${options})
 	if  $? -ne 0 ; then
 		echo "${CYAN}SKIP: evmctl ima_boot_aggregate: $bootaggr${NORM}"
 		exit "$SKIP"
@@ -151,6 +153,7 @@
 }
 
 if  "$(id -u)" = 0  &&  -c "/dev/tpm0" ; then
+	BOOTAGGR_OPTIONS="--hwtpm"
 	ASCII_RUNTIME_MEASUREMENTS="/sys/kernel/security/ima/ascii_runtime_measurements"
 	if  ! -d "/sys/kernel/security/ima" ; then
 		echo "${CYAN}SKIP: CONFIG_IMA not enabled${NORM}"
@@ -194,4 +197,4 @@
 	fi
 fi
 
-expect_pass check
+expect_pass check $BOOTAGGR_OPTIONS

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/fsverity.test Added

@@ -0,0 +1,385 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Test IMA support for including fs-verity enabled files measurements
+# in the IMA measurement list.
+#
+# Define policy rules showing the different types of IMA and fs-verity
+# records in the IMA measurement list.  Include examples of files that
+# are suppose to be fs-verity enabled, but aren't.
+#
+# test 1: IMA policy rule using the new ima-ngv2 template
+# - Hash prefixed with "ima:"
+#
+# test 2: fs-verity IMA policy rule using the new ima-ngv2 template
+# - fs-verity hash prefixed with "verity:"
+# - Non fs-verity enabled file, zeros prefixed with "verity:"
+#
+# test 3: IMA policy rule using the new ima-sigv2 template
+# - Hash prefixed with "ima:"
+# - Appended signature, when available.
+#
+# test 4: fs-verity IMA policy rule using the new ima-sigv2 template
+# - fs-verity hash prefixed with "verity:"
+# - Non fs-verity enabled file, zeros prefixed with "verity:"
+# - Appended IMA signature of fs-verity file hash, when available.
+
+# To avoid affecting the system's IMA custom policy or requiring a
+# reboot between tests, define policy rules based on UUID.  However,
+# since the policy rules are walked sequentially, the system's IMA
+# custom policy rules might take precedence.
+
+cd "$(dirname "$0")" || exit 1
+PATH=../src:../fsverity-utils:$PATH
+source ./functions.sh
+
+# Base VERBOSE on the environment variable, if set.
+VERBOSE="${VERBOSE:-0}"
+
+IMA_POLICY_FILE="/sys/kernel/security/integrity/ima/policy"
+IMA_MEASUREMENT_LIST="/sys/kernel/security/integrity/ima/ascii_runtime_measurements"
+TST_MNT="/tmp/fsverity-test"
+TST_IMG="/tmp/test.img"
+
+LOOPBACK_MOUNTED=0
+FSVERITY="$(which fsverity)"
+
+_require dd mkfs blkid e2fsck tune2fs evmctl setfattr
+./gen-keys.sh >/dev/null 2>&1
+
+trap '_report_exit_and_cleanup _cleanup_env cleanup' SIGINT SIGTERM EXIT
+
+cleanup() {
+        if  -e $TST_MNT ; then
+		if  $LOOPBACK_MOUNTED -eq 1 ; then
+			umount $TST_MNT
+		fi
+		if  -f "$TST_IMG" ; then
+			rm "$TST_IMG"
+		fi
+	fi
+}
+
+# Loopback mount a file
+mount_loopback_file() {
+	local ret
+
+	if  ! -d $TST_MNT ; then
+		mkdir $TST_MNT
+	fi
+
+#	if modprobe loop; then
+#		echo "${CYAN}INFO: modprobe loop failed${NORM}"
+#	fi
+
+	if ! losetup -f &> /dev/null; then
+		echo "${RED}FAILURE: losetup${NORM}"
+		exit "$FAIL"
+	fi
+
+	mount -v -o loop ${TST_IMG} $TST_MNT
+	ret=$?
+
+	if  "${ret}" -eq 0 ; then
+		LOOPBACK_MOUNTED=1
+	fi
+
+	return "$ret"
+}
+
+# Change the loopback mounted filesystem's UUID in between tests
+change_loopback_file_uuid() {
+	echo " "
+	 "$VERBOSE" -ge 1  && echo "INFO: Changing loopback file uuid"
+
+	umount $TST_MNT
+	if ! e2fsck -y -f ${TST_IMG} &> /dev/null; then
+		echo "${RED}FAILURE: e2fsck${NORM}"
+		exit "$FAIL"
+	fi
+
+	if ! tune2fs -f ${TST_IMG} -U random &> /dev/null; then
+		echo "${RED}FAILURE: change UUID${NORM}"
+		exit "$FAIL"
+	fi
+
+	 "$VERBOSE" -ge 1  && echo "INFO: Remounting loopback filesystem"
+	if ! mount_loopback_file; then
+		echo "${RED}FAILURE: re-mounting loopback filesystem${NORM}"
+		exit "$FAIL"
+	fi
+	return 0
+}
+
+# Create a file to be loopback mounted
+create_loopback_file() {
+	local fs_type=$1
+	local options=""
+
+	echo "INFO: Creating loopback filesystem"
+	case $fs_type in
+	ext4|f2fs)
+		options="-O verity"
+		;;
+	btrfs)
+		;;
+	*)
+		echo "${RED}FAILURE: unsupported fs-verity filesystem${NORM}"
+		exit "${FAIL}"
+		;;
+	esac
+
+	 "$VERBOSE" -ge 2  && echo "INFO: Creating a file to be loopback mounted with options: $options"
+	if ! dd if=/dev/zero of="${TST_IMG}" bs=100M count=6 &> /dev/null; then
+		echo "${RED}FAILURE: creating ${TST_IMG}${NORM}"
+		exit "$FAIL"
+	fi
+
+	echo "INFO: Building an $fs_type filesystem"
+	if ! mkfs -t "$fs_type" -q "${TST_IMG}" "$options"; then
+		echo "${RED}FAILURE: Creating $fs_type filesystem${NORM}"
+		exit "$FAIL"
+	fi
+
+	echo "INFO: Mounting loopback filesystem"
+	if ! mount_loopback_file; then
+		echo "${RED}FAILURE: mounting loopback filesystem${NORM}"
+		exit "$FAIL"
+	fi
+	return 0
+}
+
+get_current_uuid() {
+	 "$VERBOSE" -ge 2  && echo "INFO: Getting loopback file uuid"
+	if ! UUID=$(blkid -s UUID -o value ${TST_IMG}); then
+		echo "${RED}FAILURE: to get UUID${NORM}"
+		return "$FAIL"
+	fi
+	return 0
+}
+
+unqualified_bprm_rule() {
+	local test=$1
+	local rule=$2
+	local rule_match="measure func=BPRM_CHECK"
+	local rule_dontmatch="fsuuid"
+
+	if  -z "${rule##*$digest_type=verity*}" ; then
+		if grep "$rule_match" $IMA_POLICY_FILE | grep -v "$rule_dontmatch"  &> /dev/null; then
+			return "$SKIP"
+		fi
+	fi
+	return 0
+}
+
+load_policy_rule() {
+	local test=$1
+	local rule=$2
+
+	if ! get_current_uuid; then
+		echo "${RED}FAILURE:FAILED getting uuid${NORM}"
+		exit "$FAIL"
+	fi
+
+	unqualified_bprm_rule "${test}" "${rule}"
+	if  $? -eq "${SKIP}" ; then
+		echo "${CYAN}SKIP: fsuuid unqualified \"BPRM_CHECK\" rule exists${NORM}"
+		return "$SKIP"
+	fi
+
+	echo "$test: rule: $rule fsuuid=$UUID"
+	if ! echo "$rule fsuuid=$UUID" > $IMA_POLICY_FILE; then
+		echo "${CYAN}SKIP: Loading policy rule failed, skipping test${NORM}"
+		return "$SKIP"
+	fi
+	return 0
+}
+
+create_file() {
+	local test=$1

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/tests/functions.sh -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/functions.sh Changed

@@ -72,6 +72,12 @@
 expect_pass() {
   local -i ret
 
+  if  -n "$TST_LIST"  &&  "${TST_LIST/$1/}" = "$TST_LIST" ; then
+     "$VERBOSE" -gt 1  && echo "____ SKIP test: $*"
+    testsskip+=1
+    return "$SKIP"
+  fi
+
   if  $TNESTED -gt 0 ; then
     echo $RED"expect_pass should not be run nested"$NORM
     testsfail+=1
@@ -94,10 +100,35 @@
   return $ret
 }
 
+expect_pass_if() {
+  local indexes="$1"
+  local ret idx
+
+  shift
+
+  expect_pass "$@"
+  ret=$?
+
+  if  $ret -ne 0  &&  $ret -ne 77  &&  -n "$PATCHES" ; then
+    echo $YELLOW"Possibly missing patches:"$NORM
+    for idx in $indexes; do
+      echo $YELLOW" - ${PATCHES$((idx))}"$NORM
+    done
+  fi
+
+  return $ret
+}
+
 # Eval negative test (one that should fail) and account its result
 expect_fail() {
   local ret
 
+  if  -n "$TST_LIST"  &&  "${TST_LIST/$1/}" = "$TST_LIST" ; then
+     "$VERBOSE" -gt 1  && echo "____ SKIP test: $*"
+    testsskip+=1
+    return "$SKIP"
+  fi
+
   if  $TNESTED -gt 0 ; then
     echo $RED"expect_fail should not be run nested"$NORM
     testsfail+=1
@@ -125,6 +156,25 @@
   return $ret
 }
 
+expect_fail_if() {
+  local indexes="$1"
+  local ret idx
+
+  shift
+
+  expect_fail "$@"
+  ret=$?
+
+  if {  $ret -eq 0  ||  $ret -eq 99 ; } &&  -n "$PATCHES" ; then
+    echo $YELLOW"Possibly missing patches:"$NORM
+    for idx in $indexes; do
+      echo $YELLOW" - ${PATCHES$((idx))}"$NORM
+    done
+  fi
+
+  return $ret
+}
+
 # return true if current test is positive
 _test_expected_to_pass() {
    ! $TFAIL 
@@ -248,8 +298,16 @@
 }
 
 # Show test stats and exit into automake test system
-# with proper exit code (same as ours).
-_report_exit() {
+# with proper exit code (same as ours). Do cleanups.
+_report_exit_and_cleanup() {
+  local exit_code=$?
+
+  if  -n "${WORKDIR}" ; then
+    rm -rf "${WORKDIR}"
+  fi
+
+  "$@"
+
   if  $testsfail -gt 0 ; then
     echo "================================="
     echo " Run with FAILEARLY=1 $0 $*"
@@ -263,12 +321,142 @@
    $testsfail -gt 0  && echo -n "$RED" || echo -n "$NORM"
   echo " FAIL: $testsfail"
   echo "$NORM"
+  # Signal failure to the testing environment creator with an unclean shutdown.
+  if  -n "$TST_ENV"  &&  $$ -eq 1 ; then
+    if  -z "$(command -v poweroff)" ; then
+      echo "Warning: cannot properly shutdown system"
+    fi
+
+    # If no test was executed and the script was successful,
+    # do a clean shutdown.
+    if  $testsfail -eq 0  &&  $testspass -eq 0  &&  $testsskip -eq 0  &&
+        $exit_code -ne "$FAIL"  &&  $exit_code -ne "$HARDFAIL" ; then
+      poweroff -f
+    fi
+
+    # If tests were executed and no test failed, do a clean shutdown.
+    if {  $testspass -gt 0  ||  $testsskip -gt 0 ; } &&
+        $testsfail -eq 0 ; then
+      poweroff -f
+    fi
+  fi
   if  $testsfail -gt 0 ; then
     exit "$FAIL"
   elif  $testspass -gt 0 ; then
     exit "$OK"
-  else
+  elif  $testsskip -gt 0 ; then
     exit "$SKIP"
+  else
+    exit "$exit_code"
+  fi
+}
+
+# Setup SoftHSM for local testing by calling the softhsm_setup script.
+# Use the provided workdir as the directory where SoftHSM will store its state
+# into.
+# Upon successfully setting up SoftHSM, this function sets the global variables
+# OPENSSL_ENGINE and OPENSSL_KEYFORM so that the openssl command line tool can
+# use SoftHSM. Also the PKCS11_KEYURI global variable is set to the test key's
+# pkcs11 URI.
+_softhsm_setup() {
+  local workdir="$1"
+
+  local msg
+
+  export SOFTHSM_SETUP_CONFIGDIR="${workdir}/softhsm"
+  export SOFTHSM2_CONF="${workdir}/softhsm/softhsm2.conf"
+
+  mkdir -p "${SOFTHSM_SETUP_CONFIGDIR}"
+
+  msg=$(./softhsm_setup setup 2>&1)
+  if  $? -eq 0 ; then
+    echo "softhsm_setup setup succeeded: $msg"
+    PKCS11_KEYURI=$(echo $msg | sed -n 's|^keyuri: $.*$|\1|p')
+
+    export EVMCTL_ENGINE="--engine pkcs11"
+    export OPENSSL_ENGINE="-engine pkcs11"
+    export OPENSSL_KEYFORM="-keyform engine"
+  else
+    echo "softhsm_setup setup failed: ${msg}"
+  fi
+}
+
+# Tear down the SoftHSM setup and clean up the environment
+_softhsm_teardown() {
+  ./softhsm_setup teardown &>/dev/null
+  rm -rf "${SOFTHSM_SETUP_CONFIGDIR}"
+  unset SOFTHSM_SETUP_CONFIGDIR SOFTHSM2_CONF PKCS11_KEYURI \
+    EVMCTL_ENGINE OPENSSL_ENGINE OPENSSL_KEYFORM
+}
+
+# Syntax: _run_env <kernel> <init> <additional kernel parameters>
+_run_env() {
+  if  -z "$TST_ENV" ; then
+    return
+  fi
+
+  if  $$ -eq 1 ; then
+    return
+  fi
+
+  if  "$TST_ENV" = "um" ; then
+    expect_pass "$1" rootfstype=hostfs rw init="$2" quiet mem=2048M "$3"
+  else
+    echo $RED"Testing environment $TST_ENV not supported"$NORM
+    exit "$FAIL"
+  fi
+}
+
+# Syntax: _exit_env <kernel>
+_exit_env() {
+  if  -z "$TST_ENV" ; then
+    return
+  fi
+
+  if  $$ -eq 1 ; then
+    return
   fi
+
+  exit "$OK"
 }
 
+# Syntax: _init_env
+_init_env() {

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/tests/gen-keys.sh -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/gen-keys.sh Changed

@@ -20,13 +20,14 @@
 type openssl
 
 log() {
-  echo - "$*"
+  echo >&2 - "$*"
   eval "$@"
 }
 
 if  "$1" = clean ; then
   rm -f test-ca.conf
-elif  "$1" = force  ||  ! -e test-ca.conf ; then
+elif  "$1" = force  ||  ! -e test-ca.conf  \
+	||  gen-keys.sh -nt test-ca.conf ; then
 cat > test-ca.conf <<- EOF
 	 req 
 	distinguished_name = req_distinguished_name
@@ -43,26 +44,64 @@
 	basicConstraints=CA:TRUE
 	subjectKeyIdentifier=hash
 	authorityKeyIdentifier=keyid:always,issuer
+
+	 skid 
+	basicConstraints=CA:TRUE
+	subjectKeyIdentifier=12345678
+	authorityKeyIdentifier=keyid:always,issuer
 EOF
 fi
 
 # RSA
 # Second key will be used for wrong key tests.
-for m in 1024 2048; do
-  if  "$1" = clean  ||  "$1" = force ; then
+for m in 1024 1024_skid 2048; do
+  if  "$1" = clean  ||  "$1" = force  \
+	  ||  gen-keys.sh -nt test-rsa$m.key ; then
     rm -f test-rsa$m.cer test-rsa$m.key test-rsa$m.pub
   fi
   if  "$1" = clean ; then
     continue
   fi
+  if  -z "${m%%*_*}" ; then
+    # Add named extension.
+    bits=${m%_*}
+    ext="-extensions ${m#*_}"
+  else
+    bits=$m
+    ext=
+  fi
   if  ! -e test-rsa$m.key ; then
-    log openssl req -verbose -new -nodes -utf8 -sha1 -days 10000 -batch -x509 \
+    log openssl req -verbose -new -nodes -utf8 -sha256 -days 10000 -batch -x509 $ext \
       -config test-ca.conf \
-      -newkey rsa:$m \
+      -newkey rsa:$bits \
       -out test-rsa$m.cer -outform DER \
       -keyout test-rsa$m.key
     # for v1 signatures
     log openssl pkey -in test-rsa$m.key -out test-rsa$m.pub -pubout
+    if  $m = 1024_skid ; then
+      # Create combined key+cert.
+      log openssl x509 -inform DER -in test-rsa$m.cer >> test-rsa$m.key
+    fi
+  fi
+done
+
+for curve in prime192v1 prime256v1; do
+  if  "$1" = clean  ||  "$1" = force ; then
+    rm -f test-$curve.cer test-$curve.key test-$curve.pub
+  fi
+  if  "$1" = clean ; then
+    continue
+  fi
+  if  ! -e test-$curve.key ; then
+    log openssl req -verbose -new -nodes -utf8 -sha256 -days 10000 -batch -x509 \
+      -config test-ca.conf \
+      -newkey ec \
+      -pkeyopt ec_paramgen_curve:$curve \
+      -out test-$curve.cer -outform DER \
+      -keyout test-$curve.key
+    if  -s test-$curve.key ; then
+      log openssl pkey -in test-$curve.key -out test-$curve.pub -pubout
+    fi
   fi
 done
 
@@ -92,6 +131,31 @@
     fi
 done
 
+# SM2, If openssl 3.0 is installed, gen SM2 keys using
+if  -x /opt/openssl3/bin/openssl ; then
+  (PATH=/opt/openssl3/bin:$PATH LD_LIBRARY_PATH=/opt/openssl3/lib
+  for curve in sm2; do
+    if  "$1" = clean  ||  "$1" = force ; then
+      rm -f test-$curve.cer test-$curve.key test-$curve.pub
+    fi
+    if  "$1" = clean ; then
+      continue
+    fi
+    if  ! -e test-$curve.key ; then
+      log openssl req -verbose -new -nodes -utf8 -days 10000 -batch -x509 \
+        -sm3 -sigopt "distid:1234567812345678" \
+        -config test-ca.conf \
+        -copy_extensions copyall \
+        -newkey $curve \
+        -out test-$curve.cer -outform DER \
+        -keyout test-$curve.key
+      if  -s test-$curve.key ; then
+        log openssl pkey -in test-$curve.key -out test-$curve.pub -pubout
+      fi
+    fi
+  done)
+fi
+
 # This script leaves test-ca.conf, *.cer, *.pub, *.key files for sing/verify tests.
 # They are never deleted except by `make distclean'.

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/tests/ima_hash.test -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/ima_hash.test Changed

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/ima_policy_check.awk Added

@@ -0,0 +1,211 @@
+#! /usr/bin/gawk -f
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright (C) 2023 Roberto Sassu <roberto.sassu@huawei.com>
+#
+# Check a new rule against the loaded IMA policy.
+#
+# Documentation/ABI/testing/ima_policy (Linux kernel)
+# base:	func= mask= fsmagic= fsuuid= fsname=
+#	uid= euid= gid= egid=
+#	fowner= fgroup=
+# lsm:	subj_user= subj_role= subj_type=
+#	obj_user= obj_role= obj_type=
+# option:	digest_type= template= permit_directio
+#		appraise_type= appraise_flag=
+#		appraise_algos= keyrings=
+#
+# Rules don't overlap if their actions are unrelated (cannot be matched without
+# dont_) and there is no combination of appraise with another do action (e.g.
+# measure, audit, hash). The second condition is due to the fact that appraise
+# might still forbid other actions expected to be performed by a test that did
+# not setup appraisal. Checking appraise for new rules is not sufficient,
+# because that rule could be added anyway. By checking existing rules as well,
+# a warning will be displayed when tests inserting rules with other do actions
+# are reexecuted.
+#
+# Also, rules don't overlap if both include the same policy keyword(s) (in base
+# or lsm, except func), at least one, with a different value. Different func
+# values don't imply non-overlap, due to the fact that a test command might
+# cause the execution of multiple hooks (e.g. FILE_CHECK in addition to
+# MMAP_CHECK). Despite one test is willing to test a particular hook, this could
+# have side effects on other tests (e.g. one test sets: appraise func=MMAP_CHECK
+# and another: measure func=FILE_CHECK; the second test might see an unexpected
+# measurement due to the first test being executed; or the second test cannot
+# unexpectedly do mmap).
+#
+# Currently, the < > operators are not supported and overlapping is asserted
+# even if intervals are disjoint. If supported, non-overlapping conditions could
+# be found. With the ^ modifier, no disjoint intervals can be found. Overlapping
+# is always reported.
+#
+# Rule equivalence is determined by checking each key/value pair, regardless of
+# their order. However, the action must always be at the beginning of the rules.
+# Rules with aliases are considered equivalent to those with their source (e.g.
+# rules with PATH_CHECK and FILE_MMAP are considered as equivalent to rules with
+# FILE_CHECK and MMAP_CHECK).
+#
+# Return a bit mask with the following values:
+# - 1: invalid new rule;
+# - 2: overlap of the new rule with an existing rule in the IMA policy;
+# - 4: new rule exists in the IMA policy.
+
+BEGIN {
+	# Policy definitions.
+	actions_str="measure dont_measure appraise dont_appraise audit hash dont_hash"
+	split(actions_str, actions_array);
+	keywords_str="func mask fsmagic fsuuid fsname uid euid gid egid fowner fgroup subj_user subj_role subj_type obj_user obj_role obj_type";
+	split(keywords_str, keywords_array);
+	options_str="digest_type template permit_directio appraise_type appraise_flag appraise_algos keyrings";
+	split(options_str, options_array);
+
+	# Key types.
+	key_type_unknown=0;
+	key_type_action=1;
+	key_type_keyword=2;
+	key_type_option=3;
+
+	# Result values.
+	ret_invalid_rule=1;
+	ret_rule_overlap=2;
+	ret_same_rule_exists=4;
+
+	for (action_idx in actions_array)
+		key_typesactions_arrayaction_idx=key_type_action;
+	for (keyword_idx in keywords_array)
+		key_typeskeywords_arraykeyword_idx=key_type_keyword;
+	for (option_idx in options_array)
+		key_typesoptions_arrayoption_idx=key_type_option;
+
+	new_rule=1;
+	result=0;
+}
+{
+	# Delete arrays from previous rule.
+	if (!new_rule) {
+		delete current_rule_array;
+		delete current_rule_operator_array;
+	}
+
+	# Check empty rules.
+	if (!length($0)) {
+		if (new_rule) {
+			result=or(result, ret_invalid_rule);
+			exit;
+		}
+		next;
+	}
+
+	for (i=1; i<=NF; i++) {
+		# Parse key/value pair.
+		split($i, key_value_array, /=,>,</, separator_array);
+		key=key_value_array1;
+		value=key_value_array2;
+
+		if (key == "func") {
+			# Normalize values of IMA hooks to what IMA will print.
+			if (value == "FILE_MMAP")
+				value="MMAP_CHECK";
+			else if (value == "PATH_CHECK")
+				value="FILE_CHECK";
+		}
+
+		# Basic validity check (not necessary in general for the IMA policy, but useful to find typos in the tests).
+		if (key_typeskey == key_type_unknown ||
+		    (i == 1 && key_typeskey != key_type_action)) {
+			result=or(result, ret_invalid_rule);
+			exit;
+		}
+
+		# Store key/value pair and operator into an array.
+		if (new_rule) {
+			new_rule_arraykey=value;
+			new_rule_operator_arraykey=separator_array1;
+		} else {
+			current_rule_arraykey=value;
+			current_rule_operator_arraykey=separator_array1;
+		}
+
+		# Store original action and action without dont_.
+		if (i == 1) {
+			if (new_rule) {
+				new_rule_action=key;
+				new_rule_action_sub=key;
+				gsub(/dont_/, "", new_rule_action_sub);
+			} else {
+				current_rule_action=key;
+				current_rule_action_sub=key;
+				gsub(/dont_/, "", current_rule_action_sub);
+			}
+		}
+	}
+
+	# Go to the next line, to compare the new rule with rules in the IMA policy.
+	if (new_rule) {
+		new_rule=0;
+		next;
+	}
+
+	# No overlap by action (unrelated rules and no combination appraise - <do action>), new rule safe to add to the IMA policy.
+	if (current_rule_action_sub != new_rule_action_sub &&
+	    (current_rule_action != "appraise" || new_rule_action ~ /^dont_/) &&
+	    (new_rule_action != "appraise" || current_rule_action ~ /^dont_/))
+		next;
+
+	same_rule=1;
+	overlap_rule=1;
+
+	for (key in key_types) {
+		if (!(key in new_rule_array)) {
+			# Key in current rule but not in new rule.
+			if (key in current_rule_array)
+				same_rule=0;
+			# Key not in new rule and not in current rule.
+			continue;
+		}
+
+		if (!(key in current_rule_array)) {
+			# Key in new rule but not in current rule.
+			if (key in new_rule_array)
+				same_rule=0;
+			# Key not in current rule and not in new rule.
+			continue;
+		}
+
+		# Same value and operator.
+		if (new_rule_arraykey == current_rule_arraykey &&
+		    new_rule_operator_arraykey == current_rule_operator_arraykey)
+			continue;
+
+		# Different value and/or operator.
+		same_rule=0;
+
+		# Not a policy keyword, not useful to determine overlap.
+		if (key_typeskey != key_type_keyword)
+			continue;
+
+		# > < operators are not supported, cannot determine overlap.
+		if (new_rule_operator_arraykey != "=" || current_rule_operator_arraykey != "=")
+			continue;
+
+		# ^ modifier does not make disjoint sets, cannot determine overlap.
+		if (new_rule_arraykey ~ /^\^/ || current_rule_arraykey ~ /^\^/)
+			continue;
+
+		# One test command can invoke multiple hooks, cannot determine overlap from func.
+		if (key == "func")
+			continue;
+
+		# No overlap by policy keyword, new rule safe to add to the IMA policy.

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/ima_policy_check.test Added

@@ -0,0 +1,245 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright (C) 2023 Roberto Sassu <roberto.sassu@huawei.com>
+#
+# Test for ima_policy_check.awk
+
+trap '_report_exit_and_cleanup' SIGINT SIGTERM EXIT
+
+cd "$(dirname "$0")" || exit 1
+. ./functions.sh
+
+export PATH=$PWD:$PATH
+
+check_result() {
+	local result
+
+	echo -e "\nTest: $1"
+	echo "New rule: $2"
+	echo "IMA policy: $3"
+
+	echo -n "Result (expect $4): "
+
+	echo -e "$2\n$3" | ima_policy_check.awk
+	result=$?
+
+	if  "$result" -ne "$4" ; then
+		echo "${RED}$result${NORM}"
+		return "$FAIL"
+	fi
+
+	echo "${GREEN}$result${NORM}"
+	return "$OK"
+}
+
+# ima_policy_check.awk returns a bit mask with the following values:
+# - 1: invalid new rule;
+# - 2: overlap of the new rule with an existing rule in the IMA policy;
+# - 4: new rule exists in the IMA policy.
+
+# Basic checks.
+desc="empty IMA policy"
+rule="measure func=FILE_CHECK"
+ima_policy=""
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+desc="Empty new rule"
+rule=""
+ima_policy=""
+expect_pass check_result "$desc" "$rule" "$ima_policy" 1
+
+desc="Unknown policy keyword fun"
+rule="measure fun=FILE_CHECK"
+ima_policy=""
+expect_pass check_result "$desc" "$rule" "$ima_policy" 1
+
+desc="Missing action"
+rule="func=FILE_CHECK"
+ima_policy=""
+expect_pass check_result "$desc" "$rule" "$ima_policy" 1
+
+# Non-overlapping rules.
+desc="Non-overlapping by action measure/dont_appraise, same func"
+rule="measure func=FILE_CHECK"
+ima_policy="dont_appraise func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+desc="Non-overlapping by action audit/dont_appraise, same func"
+rule="audit func=FILE_CHECK"
+ima_policy="dont_appraise func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+desc="Non-overlapping by action appraise/dont_measure, same func"
+rule="appraise func=FILE_CHECK"
+ima_policy="dont_measure func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+desc="Non-overlapping by action dont_measure/hash, same func"
+rule="dont_measure func=FILE_CHECK"
+ima_policy="hash func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+desc="Non-overlapping by uid, func is equal"
+rule="measure func=FILE_CHECK uid=0"
+ima_policy="measure uid=1 func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+desc="Non-overlapping by uid, func is equal, same policy options"
+rule="measure func=FILE_CHECK uid=0 permit_directio"
+ima_policy="measure uid=1 func=FILE_CHECK permit_directio"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+desc="Non-overlapping by mask, func and uid are equal, same policy options"
+rule="measure func=FILE_CHECK uid=0 permit_directio mask=MAY_READ"
+ima_policy="measure uid=0 mask=MAY_EXEC func=FILE_CHECK permit_directio"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+desc="Non-overlapping by mask, func and uid are equal, different policy options"
+rule="measure func=FILE_CHECK uid=0 permit_directio mask=MAY_READ"
+ima_policy="measure uid=0 mask=MAY_EXEC func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 0
+
+# Overlapping and different rules.
+desc="same actions, different keywords"
+rule="appraise func=FILE_CHECK"
+ima_policy="appraise uid=0"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="unrelated actions with appraise and a do action, same func"
+rule="appraise func=FILE_CHECK"
+ima_policy="measure func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="unrelated actions with appraise and a do action, different func"
+rule="appraise func=FILE_CHECK"
+ima_policy="measure func=MMAP_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="related actions, same func"
+rule="measure func=FILE_CHECK"
+ima_policy="dont_measure func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="related actions, same func, different policy options"
+rule="measure func=FILE_CHECK"
+ima_policy="dont_measure func=FILE_CHECK permit_directio"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="related actions, same func, different policy options"
+rule="measure func=FILE_CHECK permit_directio"
+ima_policy="dont_measure func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="same actions, same func, same mask with different modifier (no disjoint sets with the ^ modifier)"
+rule="measure func=FILE_CHECK mask=MAY_EXEC"
+ima_policy="measure func=FILE_CHECK mask=^MAY_EXEC"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="same actions, same func, different mask with same modifier (no disjoint sets with the ^ modifier)"
+rule="measure func=FILE_CHECK mask=^MAY_READ"
+ima_policy="measure func=FILE_CHECK mask=^MAY_EXEC"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="same actions, same func, different policy options"
+rule="measure func=FILE_CHECK"
+ima_policy="measure func=FILE_CHECK permit_directio"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="same actions, same func, different policy options"
+rule="measure func=FILE_CHECK permit_directio"
+ima_policy="measure func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="same actions, MMAP_CHECK and MMAP_CHECK_REQPROT hooks"
+rule="measure func=MMAP_CHECK"
+ima_policy="measure func=MMAP_CHECK_REQPROT"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="related actions, same func, same mask with same modifier"
+rule="measure func=FILE_CHECK mask=^MAY_EXEC"
+ima_policy="dont_measure func=FILE_CHECK mask=^MAY_EXEC"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="same actions, same func, different uid with same operator (overlap because operators are not supported)"
+rule="measure func=FILE_CHECK uid>0"
+ima_policy="measure func=FILE_CHECK uid>1"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+desc="same actions, same func, same uid with different operator (overlap because operators are not supported)"
+rule="measure func=FILE_CHECK uid>1"
+ima_policy="measure func=FILE_CHECK uid<1"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 2
+
+# Overlapping and same rules.
+desc="same actions, same func"
+rule="appraise func=FILE_CHECK"
+ima_policy="appraise func=FILE_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 4
+
+desc="same actions, same func, same mask"
+rule="appraise mask=MAY_READ func=FILE_CHECK"
+ima_policy="appraise func=FILE_CHECK mask=MAY_READ"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 4
+
+desc="same actions, same func, same mask, same policy options"
+rule="appraise mask=MAY_READ func=FILE_CHECK permit_directio appraise_type=imasig"
+ima_policy="appraise func=FILE_CHECK mask=MAY_READ permit_directio appraise_type=imasig"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 4
+
+desc="same actions, same func"
+rule="measure func=MMAP_CHECK_REQPROT"
+ima_policy="measure func=MMAP_CHECK_REQPROT"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 4
+
+desc="same actions, same func with alias (PATH_CHECK = FILE_CHECK)"
+rule="measure func=FILE_CHECK"
+ima_policy="measure func=PATH_CHECK"
+expect_pass check_result "$desc" "$rule" "$ima_policy" 4
+

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/install-fsverity.sh Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/install-mount-idmapped.sh Added

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/install-openssl3.sh Added

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/tests/install-swtpm.sh -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/install-swtpm.sh Changed

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/mmap_check.test Added

@@ -0,0 +1,407 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright (C) 2022-2023 Roberto Sassu <roberto.sassu@huawei.com>
+#
+# Check the behavior of MMAP_CHECK and MMAP_CHECK_REQPROT
+
+trap '_report_exit_and_cleanup _cleanup_env cleanup' SIGINT SIGTERM SIGSEGV EXIT
+
+PATCHES=(
+'ima: Align ima_file_mmap() parameters with mmap_file LSM hook'
+'ima: Introduce MMAP_CHECK_REQPROT hook'
+)
+
+RET_INVALID_RULE=$((0x0001))
+RET_RULE_OVERLAP=$((0x0002))
+RET_SAME_RULE_EXISTS=$((0x0004))
+
+EVM_INIT_HMAC=$((0x0001))
+EVM_INIT_X509=$((0x0002))
+
+# Base VERBOSE on the environment variable, if set.
+VERBOSE="${VERBOSE:-0}"
+
+# Errors defined in test_mmap
+ERR_SETUP=1
+ERR_TEST=2
+
+cd "$(dirname "$0")" || exit 1
+export PATH=$PWD/../src:$PWD:$PATH
+export LD_LIBRARY_PATH=$LD_LIBRARY_PATH
+. ./functions.sh
+_require evmctl
+
+cleanup() {
+	if  "$g_loop_mounted" = "1" ; then
+		popd > /dev/null || exit "$FAIL"
+		umount "$g_mountpoint"
+	fi
+
+	if  -n "$g_dev" ; then
+		losetup -d "$g_dev"
+	fi
+
+	if  -n "$g_image" ; then
+		rm -f "$g_image"
+	fi
+
+	if  -n "$g_mountpoint" ; then
+		rm -Rf "$g_mountpoint"
+	fi
+
+	if  -n "$g_key_path_der" ; then
+		rm -f "$g_key_path_der"
+	fi
+}
+
+# Use the fsuuid= IMA policy keyword to select only files created/used by the
+# tests below. Also use fowner= to differentiate between files created/used by
+# individual tests.
+IMA_UUID="28b23254-9467-44c0-b6ba-34b12e85a26e"
+MEASURE_MMAP_CHECK_FOWNER=2000
+MEASURE_MMAP_CHECK_REQPROT_FOWNER=2001
+MEASURE_MMAP_CHECK_RULE="measure func=MMAP_CHECK fsmagic=0xef53 fsuuid=$IMA_UUID fowner=$MEASURE_MMAP_CHECK_FOWNER"
+MEASURE_MMAP_CHECK_REQPROT_RULE="measure func=MMAP_CHECK_REQPROT fsmagic=0xef53 fsuuid=$IMA_UUID fowner=$MEASURE_MMAP_CHECK_REQPROT_FOWNER"
+APPRAISE_MMAP_CHECK_FOWNER=2002
+APPRAISE_MMAP_CHECK_REQPROT_FOWNER=2003
+APPRAISE_MMAP_CHECK_RULE="appraise func=MMAP_CHECK fsmagic=0xef53 fsuuid=$IMA_UUID fowner=$APPRAISE_MMAP_CHECK_FOWNER"
+APPRAISE_MMAP_CHECK_REQPROT_RULE="appraise func=MMAP_CHECK_REQPROT fsmagic=0xef53 fsuuid=$IMA_UUID fowner=$APPRAISE_MMAP_CHECK_REQPROT_FOWNER"
+
+check_load_ima_rule() {
+	local result new_policy color
+
+	echo -e "$1\n$(cat /sys/kernel/security/ima/policy)" | ima_policy_check.awk
+	result=$?
+
+	if  $((result & RET_INVALID_RULE)) -eq $RET_INVALID_RULE ; then
+		echo "${RED}Invalid rule${NORM}"
+		return "$HARDFAIL"
+	fi
+
+	if  $((result & RET_RULE_OVERLAP)) -eq $RET_RULE_OVERLAP ; then
+		color=${YELLOW}
+		if  -n "$TST_ENV" ; then
+			color=${RED}
+		fi
+
+		echo "${color}Possible interference with existing IMA policy rule${NORM}"
+		if  -n "$TST_ENV" ; then
+			return "$HARDFAIL"
+		fi
+	fi
+
+	if  $((result & RET_SAME_RULE_EXISTS)) -eq $RET_SAME_RULE_EXISTS ; then
+		return "$OK"
+	fi
+
+	new_policy=$(mktemp -p "$g_mountpoint")
+	echo "$1" > "$new_policy"
+	echo "$new_policy" > /sys/kernel/security/ima/policy
+	result=$?
+	rm -f "$new_policy"
+
+	if  "$result" -ne 0 ; then
+		echo "${RED}Failed to set IMA policy${NORM}"
+		return "$HARDFAIL"
+	fi
+
+	return "$OK"
+}
+
+check_mmap() {
+	local hook="$1"
+	local arg="$2"
+	local test_file fowner rule result test_file_entry
+
+	echo -e "\nTest: ${FUNCNAME0} (hook=\"$hook\", test_mmap arg: \"$arg\")"
+
+	if ! test_file=$(mktemp -p "$PWD"); then
+		echo "${RED}Cannot create $test_file${NORM}"
+		return "$HARDFAIL"
+	fi
+
+	if ! echo "test" > "$test_file"; then
+		echo "${RED}Cannot write $test_file${NORM}"
+		return "$FAIL"
+	fi
+
+	fowner="$MEASURE_MMAP_CHECK_FOWNER"
+	rule="$MEASURE_MMAP_CHECK_RULE"
+
+	if  "$hook" = "MMAP_CHECK_REQPROT" ; then
+		fowner="$MEASURE_MMAP_CHECK_REQPROT_FOWNER"
+		rule="$MEASURE_MMAP_CHECK_REQPROT_RULE"
+	fi
+
+	if ! chown "$fowner" "$test_file"; then
+		echo "${RED}Cannot change owner of $test_file${NORM}"
+		return "$HARDFAIL"
+	fi
+
+	check_load_ima_rule "$rule"
+	result=$?
+	if  $result -ne "$OK" ; then
+		return $result
+	fi
+
+	test_mmap "$test_file" "$arg"
+	result=$?
+
+	if  $result -ne 0  &&  $result -ne "$ERR_TEST" ; then
+		echo "${RED}Unexpected exit status $result from test_mmap${NORM}"
+		return "$HARDFAIL"
+	fi
+
+	if  "$TFAIL" != "yes" ; then
+		echo -n "Result (expect found): "
+	else
+		echo -n "Result (expect not found): "
+	fi
+
+	test_file_entry=$(awk '$5 == "'"$test_file"'"' < /sys/kernel/security/ima/ascii_runtime_measurements)
+	if  -z "$test_file_entry" ; then
+		if  "$TFAIL" != "yes" ; then
+			echo "${RED}not found${NORM}"
+		else
+			echo "${GREEN}not found${NORM}"
+		fi
+		return "$FAIL"
+	fi
+
+	if  "$TFAIL" != "yes" ; then
+		echo "${GREEN}found${NORM}"
+	else
+		echo "${RED}found${NORM}"
+	fi
+
+	if  "$VERBOSE" -gt 0 ; then
+		echo "$test_file_entry"
+	fi
+
+	return "$OK"
+}
+
+check_deny() {
+	local hook="$1"
+	local arg="$2"
+	local test_file fowner rule result
+
+	echo -e "\nTest: ${FUNCNAME0} (hook=\"$hook\", test_mmap arg: \"$arg\")"
+
+	if ! test_file=$(mktemp -p "$PWD"); then
+		echo "${RED}Cannot create $test_file${NORM}"
+		return "$HARDFAIL"
+	fi
+
+	if ! echo "test" > "$test_file"; then
+		echo "${RED}Cannot write $test_file${NORM}"
+		return "$FAIL"

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/portable_signatures.test Added

@@ -0,0 +1,1122 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright (C) 2022-2023 Roberto Sassu <roberto.sassu@huawei.com>
+#
+# Check if operations on files with EVM portable signatures succeed.
+
+trap '_report_exit_and_cleanup _cleanup_env cleanup' SIGINT SIGTERM SIGSEGV EXIT
+
+# Base VERBOSE on the environment variable, if set.
+VERBOSE="${VERBOSE:-0}"
+TST_EVM_CHANGE_MODE="${TST_EVM_CHANGE_MODE:-0}"
+
+# From security/integrity/evm/evm.h in kernel source directory.
+(( EVM_INIT_HMAC=0x0001 ))
+(( EVM_INIT_X509=0x0002 ))
+(( EVM_ALLOW_METADATA_WRITES=0x0004 ))
+(( EVM_SETUP_COMPLETE=0x80000000 ))
+
+cd "$(dirname "$0")" || exit "$FAIL"
+export PATH=$PWD/../src:$PWD/../mount-idmapped:$PATH
+export LD_LIBRARY_PATH=$LD_LIBRARY_PATH
+. ./functions.sh
+_require evmctl
+
+cleanup() {
+	if  "$g_loop_mounted" = "1" ; then
+		popd > /dev/null || exit "$FAIL"
+
+		if  -n "$g_mountpoint_idmapped" ; then
+			umount "$g_mountpoint_idmapped"
+		fi
+
+		umount "$g_mountpoint"
+	fi
+
+	if  -n "$g_dev" ; then
+		losetup -d "$g_dev"
+	fi
+
+	if  -n "$g_image" ; then
+		rm -f "$g_image"
+	fi
+
+	if  -n "$key_path_der" ; then
+		rm -f "$key_path_der"
+	fi
+
+	if  -n "$g_mountpoint" ; then
+		rm -Rf "$g_mountpoint"
+	fi
+
+	if  -n "$g_mountpoint_idmapped" ; then
+		rm -Rf "$g_mountpoint_idmapped"
+	fi
+}
+
+get_xattr() {
+	local format="hex"
+
+	if  "$1" = "security.selinux" ; then
+		format="text"
+	fi
+
+	getfattr -n "$1" -e $format -d "$2" 2> /dev/null | awk -F "=" '$1 == "'"$1"'" {if ("'$format'" == "hex") v=substr($2, 3); else { split($2, temp, "\""); v=temp2 }; print v}'
+}
+
+# Use the fsuuid= IMA policy keyword to select only files created/used by the
+# tests below. Also use fowner= to differentiate between files created/used by
+# individual tests.
+IMA_UUID="28b23254-9467-44c0-b6ba-34b12e85a26d"
+APPRAISE_DIGSIG_FOWNER=2000
+APPRAISE_DIGSIG_RULE="appraise fsuuid=$IMA_UUID fowner=$APPRAISE_DIGSIG_FOWNER appraise_type=imasig"
+MEASURE_FOWNER=2001
+MEASURE_RULE="measure fsuuid=$IMA_UUID fowner=$MEASURE_FOWNER template=ima-sig"
+APPRAISE_FOWNER=2002
+APPRAISE_RULE="appraise fsuuid=$IMA_UUID fowner=$APPRAISE_FOWNER"
+METADATA_CHANGE_FOWNER=3001
+METADATA_CHANGE_FOWNER_2=3002
+
+check_load_ima_rule() {
+	local rule_loaded
+	local result
+	local new_policy
+
+	rule_loaded=$(grep "$1" /sys/kernel/security/ima/policy)
+	if  -z "$rule_loaded" ; then
+		new_policy=$(mktemp -p "$g_mountpoint")
+		echo "$1" > "$new_policy"
+		evmctl sign -o -a sha256 --imasig --key "$key_path" "$new_policy" &> /dev/null
+		echo "$new_policy" > /sys/kernel/security/ima/policy
+		result=$?
+		rm -f "$new_policy"
+
+		if  "$result" -ne 0 ; then
+			echo "${RED}Failed to set IMA policy${NORM}"
+			return "$FAIL"
+		fi
+	fi
+
+	return "$OK"
+}
+
+# The purpose of this test is to verify that the patch 'ima: Allow imasig
+# requirement to be satisfied by EVM portable signatures' didn't break the
+# current behavior (IMA signatures still satisfy the imasig requirement).
+check_ima_sig_appraisal() {
+	local result
+
+	echo "Test: ${FUNCNAME0} (evm_value: $evm_value)"
+
+	if  $((evm_value & (EVM_INIT_X509 | EVM_INIT_HMAC))) -ne 0 ; then
+		echo "${CYAN}EVM mode 0 required${NORM}"
+		return "$SKIP"
+	fi
+
+	if ! echo "test" > test-file; then
+		echo "${RED}Cannot write test-file${NORM}"
+		return "$FAIL"
+	fi
+
+	if ! evmctl ima_sign -a sha256 --key "$key_path" test-file &> /dev/null; then
+		echo "${RED}Cannot sign test-file${NORM}"
+		return "$FAIL"
+	fi
+
+	if ! chown "$APPRAISE_DIGSIG_FOWNER" test-file; then
+		echo "${RED}Cannot change owner of test-file${NORM}"
+		return "$FAIL"
+	fi
+
+	check_load_ima_rule "$APPRAISE_DIGSIG_RULE"
+	result=$?
+	if  $result -ne "$OK" ; then
+		return $result
+	fi
+
+	# Check if appraisal works.
+	if ! cat test-file > /dev/null; then
+		echo "${RED}Cannot read test-file${NORM}"
+		return "$FAIL"
+	fi
+
+	# Ensure that files with IMA signature cannot be updated (immutable).
+	if echo "test" 2> /dev/null >> test-file; then
+		echo "${RED}Write to test-file should not succeed (immutable file)${NORM}"
+		return "$FAIL"
+	fi
+
+	return "$OK"
+}
+
+cleanup_ima_sig_appraisal() {
+	rm -f test-file
+}
+
+# Requires:
+# - ima: Don't remove security.ima if file must not be appraised
+#
+# The purpose of this test is to verify that the patch 'ima: Introduce template
+# field evmsig and write to field sig as fallback' still allows IMA signatures
+# to be displayed in the measurement list.
+check_ima_sig_ima_measurement_list() {
+	local result
+	local ima_sig_fs
+	local ima_sig_list
+
+	echo "Test: ${FUNCNAME0} (evm_value: $evm_value)"
+
+	if ! echo "test" > test-file; then
+		echo "${RED}Cannot write test-file${NORM}"
+		return "$FAIL"
+	fi
+
+	if ! evmctl ima_sign -a sha256 --imasig --key "$key_path" test-file &> /dev/null; then
+		echo "${RED}Cannot sign test-file${NORM}"
+		return "$FAIL"
+	fi
+
+	if ! chown "$MEASURE_FOWNER" test-file; then
+		echo "${RED}Cannot change owner of test-file${NORM}"
+		return "$FAIL"
+	fi
+
+	check_load_ima_rule "$MEASURE_RULE"
+	result=$?
+	if  $result -ne "$OK" ; then
+		return $result
+	fi
+
+	# Read the file to add it to the measurement list.
+	if ! cat test-file > /dev/null; then
+		echo "${RED}Cannot read test-file${NORM}"
+		return "$FAIL"
+	fi
+
+	ima_sig_fs=$(get_xattr security.ima test-file)
+	if  -z "$ima_sig_fs" ; then
+		echo "${RED}security.ima not found${NORM}"

_service:tar_scm:ima-evm-utils-1.3.2.tar.gz/tests/sign_verify.test -> _service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/sign_verify.test Changed

@@ -17,6 +17,10 @@
 
 cd "$(dirname "$0")" || exit 1
 PATH=../src:$PATH
+
+# set the env SIGV1=1 to execute the signature v1 tests
+SIGV1=${SIGV1:-0}
+
 source ./functions.sh
 
 _require cmp evmctl getfattr openssl xxd
@@ -28,7 +32,8 @@
 
 ./gen-keys.sh >/dev/null 2>&1
 
-trap _report_exit EXIT
+trap _report_exit_and_cleanup EXIT
+WORKDIR=$(mktemp -d)
 set -f # disable globbing
 
 # Determine keyid from a cert
@@ -43,6 +48,7 @@
   id=$($cmd 2>/dev/null \
     | openssl asn1parse \
     | grep BIT.STRING \
+    | tail -n1 \
     | cut -d: -f1)
   if  -z "$id" ; then
     echo - "$cmd" >&2
@@ -131,11 +137,16 @@
   # OPTS (additional options for evmctl),
   # FILE (working file to sign).
   local "$@"
-  local KEY=${KEY%.*}.key
+  local key verifykey
   local FILE=${FILE:-$ALG.txt}
 
-  # Normalize key filename
-  KEY=test-${KEY#test-}
+  # Normalize key filename if it's not a pkcs11 URI
+  if  ${KEY:0:7} != pkcs11: ; then
+    key=${KEY%.*}.key
+    key=test-${key#test-}
+  else
+    key=${KEY}
+  fi
 
   # Append suffix to files for negative tests, because we may
   # leave only good files for verify tests.
@@ -151,33 +162,33 @@
 
   if _test_expected_to_pass; then
     # Can openssl work with this digest?
-    cmd="openssl dgst $OPENSSL_ENGINE -$ALG $FILE"
+    cmd="openssl dgst $OPENSSL_ENGINE $OPENSSL_KEYFORM -$ALG $FILE"
     echo - "$cmd"
     if ! $cmd >/dev/null; then
-      echo "${CYAN}$ALG ($KEY) test is skipped (openssl is unable to digest)$NORM"
+      echo "${CYAN}$ALG ($key) test is skipped (openssl is unable to digest)$NORM"
       return "$SKIP"
     fi
 
-    if  ! -e "$KEY" ; then
-      echo "${CYAN}$ALG ($KEY) test is skipped (key file not found)$NORM"
+    if  "${key:0:7}" != pkcs11:  &&  ! -e "$key" ; then
+      echo "${CYAN}$ALG ($key) test is skipped (key file not found)$NORM"
       return "$SKIP"
     fi
 
     # Can openssl sign with this digest and key?
-    cmd="openssl dgst $OPENSSL_ENGINE -$ALG -sign $KEY -hex $FILE"
+    cmd="openssl dgst $OPENSSL_ENGINE $OPENSSL_KEYFORM -$ALG -sign $key -hex $FILE"
     echo - "$cmd"
     if ! $cmd >/dev/null; then
-      echo "${CYAN}$ALG ($KEY) test is skipped (openssl is unable to sign)$NORM"
+      echo "${CYAN}$ALG ($key) test is skipped (openssl is unable to sign)$NORM"
       return "$SKIP"
     fi
   fi
 
   # Insert keyid from cert into PREFIX in-place of marker `:K:'
   if  $PREFIX =~ :K: ; then
-    keyid=$(_keyid_from_cert "$KEY")
+    keyid=$(_keyid_from_cert "$key")
     if  $? -ne 0 ; then
       color_red
-      echo "Unable to determine keyid for $KEY"
+      echo "Unable to determine keyid for $key"
       color_restore
       return "$HARDFAIL"
     fi
@@ -186,7 +197,7 @@
   fi
 
   # Perform signing by evmctl
-  _evmctl_sign "$TYPE" "$KEY" "$ALG" "$FILE" "$OPTS" || return
+  _evmctl_sign "$TYPE" "$key" "$ALG" "$FILE" "$OPTS" || return
 
   # First simple pattern match the signature.
   ADD_TEXT_FOR=$ALG \
@@ -198,11 +209,21 @@
   # This is all we can do for evm.
    "$TYPE" =~ evm  && return "$OK"
 
+  # When using the SM2/3 algorithm, the openssl tool uses USERID for verify,
+  # which is incompatible with calling API directly, so skip it.
+   "$ALG" == sm3  && return "$OK"
+
   # Extract signature to a file
   _extract_xattr "$FILE" "$(_xattr "$TYPE")" "$FILE.sig2" "$PREFIX"
 
   # Verify extracted signature with openssl
-  cmd="openssl dgst $OPENSSL_ENGINE -$ALG -verify ${KEY%.*}.pub \
+  if  "${key:0:7}" != pkcs11: ; then
+      verifykey=${key%.*}.pub
+  else
+      verifykey=${key}
+  fi
+
+  cmd="openssl dgst $OPENSSL_ENGINE $OPENSSL_KEYFORM -$ALG -verify ${verifykey} \
 	-signature $FILE.sig2 $FILE"
   echo - "$cmd"
   if ! $cmd; then
@@ -328,9 +349,14 @@
     expect_fail check_verify TYPE=ima
   fi
 
-  # Test --portable
-  expect_pass check_sign OPTS="$OPTS --portable" PREFIX=0x05
-  # Cannot be verified for now, until that support is added to evmctl
+  # Test --portable (only supported for V2 signatures)
+  if expect_pass check_sign OPTS="$OPTS --portable --imahash" PREFIX=0x05; then
+     if  "$OPTS" =~ --rsa ; then
+        expect_fail check_verify
+     else
+        expect_pass check_verify
+     fi
+  fi
 
   # Test -i (immutable)
   expect_pass check_sign OPTS="$OPTS -i" PREFIX=0x0303
@@ -346,19 +372,27 @@
 
 ## Test v1 signatures
 # Signature v1 only supports sha1 and sha256 so any other should fail
-expect_fail \
-  check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa
-
-sign_verify  rsa1024  sha1    0x0301 --rsa
-sign_verify  rsa1024  sha256  0x0301 --rsa
-  try_different_keys
-  try_different_sigs
+if  $SIGV1 -eq 0 ; then
+  __skip() { echo "IMA signature v1 tests are skipped: not supported"; return $SKIP; }
+  expect_pass __skip
+else
+   expect_fail \
+      check_sign TYPE=ima KEY=rsa1024 ALG=md5 PREFIX=0x0301 OPTS=--rsa
+
+   sign_verify  rsa1024  sha1    0x0301 --rsa
+   sign_verify  rsa1024  sha256  0x0301 --rsa
+      try_different_keys
+      try_different_sigs
+fi
 
 ## Test v2 signatures with RSA PKCS#1
 # List of allowed hashes much greater but not all are supported.
 sign_verify  rsa1024  md5     0x030201:K:0080
 sign_verify  rsa1024  sha1    0x030202:K:0080
 sign_verify  rsa1024  sha224  0x030207:K:0080
+expect_pass check_sign TYPE=ima KEY=rsa1024 ALG=sha256 PREFIX=0x030204aabbccdd0080 OPTS=--keyid=aabbccdd
+expect_pass check_sign TYPE=ima KEY=rsa1024 ALG=sha256 PREFIX=0x030204:K:0080 OPTS=--keyid-from-cert=test-rsa1024.cer
+expect_pass check_sign TYPE=ima KEY=rsa1024_skid ALG=sha256 PREFIX=0x030204123456780080
 sign_verify  rsa1024  sha256  0x030204:K:0080
   try_different_keys
   try_different_sigs
@@ -366,6 +400,30 @@
 sign_verify  rsa1024  sha512  0x030206:K:0080
 sign_verify  rsa1024  rmd160  0x030203:K:0080
 
+# Test v2 signatures with ECDSA
+# Signature length is typically 0x34-0x38 bytes long, very rarely 0x33
+sign_verify  prime192v1 sha1   0x030202:K:003345678
+sign_verify  prime192v1 sha224 0x030207:K:003345678
+sign_verify  prime192v1 sha256 0x030204:K:003345678
+sign_verify  prime192v1 sha384 0x030205:K:003345678
+sign_verify  prime192v1 sha512 0x030206:K:003345678
+
+# Signature length is typically 0x44-0x48 bytes long, very rarely 0x43
+sign_verify  prime256v1 sha1   0x030202:K:004345678
+sign_verify  prime256v1 sha224 0x030207:K:004345678
+sign_verify  prime256v1 sha256 0x030204:K:004345678
+sign_verify  prime256v1 sha384 0x030205:K:004345678
+sign_verify  prime256v1 sha512 0x030206:K:004345678
+
+# If openssl 3.0 is installed, test the SM2/3 algorithm combination
+ssl_major_version=$(openssl version | sed -n 's/^OpenSSL $^\.$.*/\1/p')
+if  "${ssl_major_version}" = 3 ; then
+   sign_verify  sm2    sm3    0x030211:K:004345678
+else

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/softhsm_setup Added

@@ -0,0 +1,293 @@
+#!/usr/bin/env bash
+
+# SPDX-License-Identifier: GPL-2.0 and BSD-3-clause
+# This program originates from 'swtpm' project (https://github.com/stefanberger/swtpm/)
+
+if  -z "$(type -P p11tool)" ; then
+	echo "Need p11tool from gnutls"
+	exit 77
+fi
+
+if  -z "$(type -P softhsm2-util)" ; then
+	echo "Need softhsm2-util from softhsm2 package"
+	exit 77
+fi
+
+MAJOR=$(softhsm2-util -v | cut -d '.' -f1)
+MINOR=$(softhsm2-util -v | cut -d '.' -f2)
+if  ${MAJOR} -lt 2  ||  ${MAJOR} -eq 2 -a ${MINOR} -lt 2 ; then
+	echo "Need softhsm v2.2.0 or later"
+	exit 77
+fi
+
+NAME=swtpm-test
+PIN=${PIN:-1234}
+SO_PIN=${SO_PIN:-1234}
+SOFTHSM_SETUP_CONFIGDIR=${SOFTHSM_SETUP_CONFIGDIR:-~/.config/softhsm2}
+export SOFTHSM2_CONF=${SOFTHSM_SETUP_CONFIGDIR}/softhsm2.conf
+
+UNAME_S="$(uname -s)"
+
+case "${UNAME_S}" in
+Darwin)
+	msg=$(sudo -v -n)
+	if  $? -ne 0 ; then
+		echo "Need password-less sudo rights on OS X to change /etc/gnutls/pkcs11.conf"
+		exit 1
+	fi
+	;;
+esac
+
+teardown_softhsm() {
+	local configdir=${SOFTHSM_SETUP_CONFIGDIR}
+	local configfile=${SOFTHSM2_CONF}
+	local bakconfigfile=${configfile}.bak
+	local tokendir=${configdir}/tokens
+
+	softhsm2-util --token "${NAME}" --delete-token &>/dev/null
+
+	case "${UNAME_S}" in
+	Darwin*)
+		if  -f /etc/gnutls/pkcs11.conf.bak ; then
+			sudo rm -f /etc/gnutls/pkcs11.conf
+			sudo mv /etc/gnutls/pkcs11.conf.bak \
+			   /etc/gnutls/pkcs11.conf &>/dev/null
+		fi
+		;;
+	esac
+
+	if  -f "$bakconfigfile" ; then
+		mv "$bakconfigfile" "$configfile"
+	else
+		rm -f "$configfile"
+	fi
+	if  -d "$tokendir" ; then
+		rm -rf "${tokendir}"
+	fi
+	return 0
+}
+
+setup_softhsm() {
+	local msg tokenuri keyuri
+	local configdir=${SOFTHSM_SETUP_CONFIGDIR}
+	local configfile=${SOFTHSM2_CONF}
+	local bakconfigfile=${configfile}.bak
+	local tokendir=${configdir}/tokens
+	local rc
+
+	case "${UNAME_S}" in
+	Darwin*)
+		if  -f /etc/gnutls/pkcs11.conf.bak ; then
+			echo "/etc/gnutls/pkcs11.conf.bak already exists; need to 'teardown' first"
+			return 1
+		fi
+		sudo mv /etc/gnutls/pkcs11.conf \
+			/etc/gnutls/pkcs11.conf.bak &>/dev/null
+		if  $(id -u) -eq 0 ; then
+			SONAME="$(sudo -u nobody brew ls --verbose softhsm | \
+				  grep -E "\.so$")"
+		else
+			SONAME="$(brew ls --verbose softhsm | \
+				  grep -E "\.so$")"
+		fi
+		sudo mkdir -p /etc/gnutls &>/dev/null
+		sudo bash -c "echo "load=${SONAME}" > /etc/gnutls/pkcs11.conf"
+		;;
+	esac
+
+	if !  -d $configdir ; then
+		mkdir -p $configdir
+	fi
+	mkdir -p ${tokendir}
+
+	if  -f $configfile ; then
+		mv "$configfile" "$bakconfigfile"
+	fi
+
+	if !  -f $configfile ; then
+		cat <<_EOF_ > $configfile
+directories.tokendir = ${tokendir}
+objectstore.backend = file
+log.level = DEBUG
+slots.removable = false
+_EOF_
+	fi
+
+	msg=$(p11tool --list-tokens 2>&1 | grep "token=${NAME}" | tail -n1)
+	if  $? -ne 0 ; then
+		echo "Could not list existing tokens"
+		echo "$msg"
+	fi
+	tokenuri=$(echo "$msg" | sed -n 's/.*URL: $:print:*$/\1/p')
+
+	if  -z "$tokenuri" ; then
+		msg=$(softhsm2-util \
+			--init-token --pin ${PIN} --so-pin ${SO_PIN} \
+			--free --label ${NAME} 2>&1)
+		if  $? -ne 0 ; then
+			echo "Could not initialize token"
+			echo "$msg"
+			return 2
+		fi
+
+		slot=$(echo "$msg" | \
+		       sed -n 's/.* reassigned to slot $0-9*$$/\1/p')
+		if  -z "$slot" ; then
+			slot=$(softhsm2-util --show-slots | \
+			       grep -E "^Slot " | head -n1 |
+			       sed -n 's/Slot $0-9*$/\1/p')
+			if  -z "$slot" ; then
+				echo "Could not parse slot number from output."
+				echo "$msg"
+				return 3
+			fi
+		fi
+
+		msg=$(p11tool --list-tokens 2>&1 | \
+			grep "token=${NAME}" | tail -n1)
+		if  $? -ne 0 ; then
+			echo "Could not list existing tokens"
+			echo "$msg"
+		fi
+		tokenuri=$(echo "$msg" | sed -n 's/.*URL: $:print:*$/\1/p')
+		if  -z "${tokenuri}" ; then
+			echo "Could not get tokenuri!"
+			return 4
+		fi
+
+		# more recent versions of p11tool have --generate-privkey ...
+		msg=$(GNUTLS_PIN=$PIN p11tool \
+			--generate-privkey=rsa --bits 2048 --label mykey --login \
+			"${tokenuri}" 2>&1)
+		if  $? -ne 0 ; then
+			# ... older versions have --generate-rsa
+			msg=$(GNUTLS_PIN=$PIN p11tool \
+				--generate-rsa --bits 2048 --label mykey --login \
+				"${tokenuri}" 2>&1)
+			if  $? -ne 0 ; then
+				echo "Could not create RSA key!"
+				echo "$msg"
+				return 5
+			fi
+		fi
+	fi
+
+	getkeyuri_softhsm $slot
+	rc=$?
+	if  $rc -ne 0 ; then
+		teardown_softhsm
+	fi
+
+	return $rc
+}
+
+_getkeyuri_softhsm() {
+	local msg tokenuri keyuri
+
+	msg=$(p11tool --list-tokens 2>&1 | grep "token=${NAME}")
+	if  $? -ne 0 ; then
+		echo "Could not list existing tokens"
+		echo "$msg"
+		return 5
+	fi
+	tokenuri=$(echo "$msg" | sed -n 's/.*URL: $:print:*$/\1/p')
+	if  -z "$tokenuri" ; then
+		echo "Could not get token URL"
+		echo "$msg"
+		return 6
+	fi
+	msg=$(p11tool --list-all ${tokenuri} 2>&1)

_service:tar_scm:ima-evm-utils-1.5.tar.gz/tests/test_mmap.c Added

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2023 Huawei Technologies Duesseldorf GmbH
+ *
+ * Tool to test IMA MMAP_CHECK and MMAP_CHECK_REQPROT hooks.
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <sys/personality.h>
+
+/*
+ * Convention: return 1 for errors that should not occur, as they are
+ * setup-related, return 2 for errors that might occur due to testing
+ * conditions.
+ */
+#define ERR_SETUP 1
+#define ERR_TEST 2
+
+int main(int argc, char *argv)
+{
+	struct stat st;
+	void *ptr, *ptr_write = NULL;
+	int ret, fd, fd_write, prot = PROT_READ;
+
+	if (!argv1) {
+		printf("Missing file parameter\n");
+		return ERR_SETUP;
+	}
+
+	if (argv2 && !strcmp(argv2, "read_implies_exec")) {
+		ret = personality(READ_IMPLIES_EXEC);
+		if (ret == -1) {
+			printf("Failed to set personality, err: %d (%s)\n",
+			       -errno, strerror(errno));
+			return ERR_SETUP;
+		}
+	}
+
+	if (stat(argv1, &st) == -1) {
+		printf("Failed to access %s, err: %d (%s)\n", argv1, -errno,
+		       strerror(errno));
+		return ERR_SETUP;
+	}
+
+	if (argv2 && !strcmp(argv2, "exec_on_writable")) {
+		fd_write = open(argv1, O_RDWR);
+		if (fd_write == -1) {
+			printf("Failed to open %s in r/w, err: %d (%s)\n",
+			       argv1, -errno, strerror(errno));
+			return ERR_SETUP;
+		}
+
+		ptr_write = mmap(0, st.st_size, PROT_WRITE, MAP_SHARED,
+				 fd_write, 0);
+		close(fd_write);
+
+		if (ptr_write == MAP_FAILED) {
+			printf("Failed mmap() with PROT_WRITE on %s, err: %d (%s)\n",
+			       argv1, -errno, strerror(errno));
+			return ERR_SETUP;
+		}
+	}
+
+	fd = open(argv1, O_RDONLY);
+	if (fd == -1) {
+		printf("Failed to open %s in ro, err: %d (%s)\n", argv1,
+		       -errno, strerror(errno));
+
+		if (ptr_write && munmap(ptr_write, st.st_size) == -1)
+			printf("Failed munmap() of writable mapping on %s, err: %d (%s)\n",
+			       argv1, -errno, strerror(errno));
+
+		return ERR_SETUP;
+	}
+
+	if (argv2 && !strncmp(argv2, "exec", 4))
+		prot |= PROT_EXEC;
+
+	ptr = mmap(0, st.st_size, prot, MAP_PRIVATE, fd, 0);
+
+	close(fd);
+
+	if (ptr_write && munmap(ptr_write, st.st_size) == -1) {
+		printf("Failed munmap() of writable mapping on %s, err: %d (%s)\n",
+		       argv1, -errno, strerror(errno));
+		return ERR_SETUP;
+	}
+
+	if (ptr == MAP_FAILED) {
+		ret = ERR_SETUP;
+		if (argv2 && !strcmp(argv2, "exec_on_writable") &&
+		    errno == EACCES)
+			ret = ERR_TEST;
+		else
+			printf("Failed mmap() with PROT_READ%s on %s, err: %d (%s)\n",
+			       (prot & PROT_EXEC) ? " | PROT_EXEC" : "",
+			       argv1, -errno, strerror(errno));
+
+		return ret;
+	}
+
+	ret = 0;
+
+	if (argv2 && !strcmp(argv2, "mprotect")) {
+		ret = mprotect(ptr, st.st_size, PROT_EXEC);
+		if (ret == -1) {
+			ret = ERR_SETUP;
+			if (errno == EPERM)
+				ret = ERR_TEST;
+			else
+				printf("Unexpected mprotect() error on %s, err: %d (%s)\n",
+				       argv1, -errno, strerror(errno));
+		}
+	}
+
+	if (munmap(ptr, st.st_size) == -1) {
+		printf("Failed munmap() of mapping on %s, err: %d (%s)\n",
+		       argv1, -errno, strerror(errno));
+		return ERR_SETUP;
+	}
+
+	return ret;
+}

_service:tar_scm:ima-evm-utils.yaml Changed

Changes of Revision 9