From: Stefan Berger <stefanb@linux.ibm.com>
To: Mimi Zohar <zohar@linux.ibm.com>, linux-integrity@vger.kernel.org
Subject: Re: [ima-evm-utils PATCH v2 13/13] Define and use a file specific "keypass" variable
Date: Tue, 2 Jan 2024 08:46:58 -0500 [thread overview]
Message-ID: <26f9c974-9ed5-44e8-a121-546a4d29758e@linux.ibm.com> (raw)
In-Reply-To: <20231206192734.339999-14-zohar@linux.ibm.com>
On 12/6/23 14:27, Mimi Zohar wrote:
> Instead of relying on the "imaevm_parrams.keypass" global variable,
> which is not concurrency-safe, define and use a file specific variable.
>
> To avoid library incompatibility, don't remove imaevm_params.keypass
> variable.
>
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
> ---
> src/evmctl.c | 17 +++++++++--------
> 1 file changed, 9 insertions(+), 8 deletions(-)
>
> diff --git a/src/evmctl.c b/src/evmctl.c
> index 8eb2c46fbff0..72b800f6884c 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -141,6 +141,7 @@ static bool evm_portable;
> static bool veritysig;
> static bool hwtpm;
> static char *g_hash_algo = DEFAULT_HASH_ALGO;
> +static char *g_keypass;
>
> #define HMAC_FLAG_NO_UUID 0x0001
> #define HMAC_FLAG_CAPS_SET 0x0002
> @@ -576,7 +577,7 @@ static int sign_evm(const char *file, char *hash_algo, const char *key)
> return len;
> assert(len <= sizeof(hash));
>
> - len = sign_hash(hash_algo, hash, len, key, NULL, sig + 1);
> + len = sign_hash(hash_algo, hash, len, key, g_keypass, sig + 1);
> if (len <= 1)
> return len;
> assert(len < sizeof(sig));
> @@ -662,7 +663,7 @@ static int sign_ima(const char *file, char *hash_algo, const char *key)
> return len;
> assert(len <= sizeof(hash));
>
> - len = sign_hash(hash_algo, hash, len, key, NULL, sig + 1);
> + len = sign_hash(hash_algo, hash, len, key, g_keypass, sig + 1);
> if (len <= 1)
> return len;
> assert(len < sizeof(sig));
> @@ -844,7 +845,7 @@ static int cmd_sign_hash(struct command *cmd)
> }
>
> siglen = sign_hash(algo, sigv3_hash, hashlen / 2,
> - key, NULL, sig + 1);
> + key, g_keypass, sig + 1);
>
> sig[0] = IMA_VERITY_DIGSIG;
> sig[1] = DIGSIG_VERSION_3; /* sigv3 */
> @@ -856,7 +857,7 @@ static int cmd_sign_hash(struct command *cmd)
> hex2bin(hash, line, hashlen / 2);
>
> siglen = sign_hash(g_hash_algo, hash,
> - hashlen / 2, key, NULL, sig + 1);
> + hashlen / 2, key, g_keypass, sig + 1);
> sig[0] = EVM_IMA_XATTR_DIGSIG;
> }
>
> @@ -3091,9 +3092,9 @@ int main(int argc, char *argv[])
> break;
> case 'p':
> if (optarg)
> - imaevm_params.keypass = optarg;
> + g_keypass = optarg;
> else
> - imaevm_params.keypass = get_password();
> + g_keypass = get_password();
> break;
> case 'f':
> sigfile = 1;
> @@ -3235,8 +3236,8 @@ int main(int argc, char *argv[])
> }
> }
>
> - if (!imaevm_params.keypass)
> - imaevm_params.keypass = getenv("EVMCTL_KEY_PASSWORD");
> + if (!g_keypass)
> + g_keypass = getenv("EVMCTL_KEY_PASSWORD");
>
> if (imaevm_params.keyfile != NULL &&
> imaevm_params.eng == NULL &&
prev parent reply other threads:[~2024-01-02 13:47 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-06 19:27 [ima-evm-utils PATCH v2 00/13] Address non concurrency-safe libimaevm global variables Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 01/13] Rename "public_keys" to "g_public_keys" Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 02/13] Free public keys list Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 03/13] Update library function definitions to include a "public_keys" parameter Mimi Zohar
2024-01-02 13:11 ` Stefan Berger
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 04/13] Update imaevm_verify_hash() definition to include "hash_algo" parameter Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 05/13] Update cmd_verify_ima() to define and use a local list of public keys Mimi Zohar
2024-01-02 13:18 ` Stefan Berger
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 06/13] Update cmd_verify_evm " Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 07/13] Update ima_measurements " Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 08/13] Define library ima_calc_hash2() function with a hash algorithm parameter Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 09/13] Use a local hash algorithm variable when verifying file signatures Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 10/13] Update EVM signature verification to use a local hash algorithm variable Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 11/13] Use a file specific hash algorithm variable for signing files Mimi Zohar
2024-01-02 13:42 ` Stefan Berger
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 12/13] Update sign_hash_v*() definition to include the key password Mimi Zohar
2024-01-02 13:44 ` Stefan Berger
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 13/13] Define and use a file specific "keypass" variable Mimi Zohar
2024-01-02 13:46 ` Stefan Berger [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=26f9c974-9ed5-44e8-a121-546a4d29758e@linux.ibm.com \
--to=stefanb@linux.ibm.com \
--cc=linux-integrity@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).