From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: linux-security-module@vger.kernel.org
Cc: Dmitry Kasatkin <d.kasatkin@samsung.com>,
linux-kernel@vger.kernel.org, James Morris <jmorris@namei.org>,
David Howells <dhowells@redhat.com>,
Mimi Zohar <zohar@linux.vnet.ibm.com>
Subject: [PATCH v2 05/23] ima: pass full xattr with the signature
Date: Mon, 21 Oct 2013 18:42:50 -0400 [thread overview]
Message-ID: <1382395388-8108-6-git-send-email-zohar@linux.vnet.ibm.com> (raw)
In-Reply-To: <1382395388-8108-1-git-send-email-zohar@linux.vnet.ibm.com>
From: Dmitry Kasatkin <d.kasatkin@samsung.com>
For possibility to use xattr type for new signature formats,
pass full xattr to the signature verification function.
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
---
security/integrity/digsig.c | 5 +++--
security/integrity/evm/evm_main.c | 4 ++--
security/integrity/ima/ima_appraise.c | 2 +-
security/integrity/integrity.h | 1 +
4 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 198e609..b4af4eb 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -44,9 +44,10 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
}
}
- switch (sig[0]) {
+ switch (sig[1]) {
case 1:
- return digsig_verify(keyring[id], sig, siglen,
+ /* v1 API expect signature without xattr type */
+ return digsig_verify(keyring[id], sig + 1, siglen - 1,
digest, digestlen);
case 2:
return asymmetric_verify(keyring[id], sig, siglen,
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index af9b685..336b3dd 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -123,7 +123,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
goto out;
}
- xattr_len = rc - 1;
+ xattr_len = rc;
/* check value type */
switch (xattr_data->type) {
@@ -143,7 +143,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
if (rc)
break;
rc = integrity_digsig_verify(INTEGRITY_KEYRING_EVM,
- xattr_data->digest, xattr_len,
+ (const char *)xattr_data, xattr_len,
calc.digest, sizeof(calc.digest));
if (!rc) {
/* we probably want to replace rsa with hmac here */
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 00708a3..e1865a6 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -205,7 +205,7 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
case EVM_IMA_XATTR_DIGSIG:
iint->flags |= IMA_DIGSIG;
rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA,
- xattr_value->digest, rc - 1,
+ (const char *)xattr_value, rc,
iint->ima_hash.digest,
iint->ima_hash.length);
if (rc == -EOPNOTSUPP) {
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index ea23189..aead6b2 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -74,6 +74,7 @@ struct ima_digest_data {
* signature format v2 - for using with asymmetric keys
*/
struct signature_v2_hdr {
+ uint8_t type; /* xattr type */
uint8_t version; /* signature format version */
uint8_t hash_algo; /* Digest algorithm [enum pkey_hash_algo] */
uint32_t keyid; /* IMA key identifier - not X509/PGP specific */
--
1.8.1.4
next prev parent reply other threads:[~2013-10-21 22:51 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-21 22:42 [PATCH v2 00/23] ima: larger digests and extensible template support Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 01/23] crypto: provide single place for hash algo information Mimi Zohar
2013-10-22 5:24 ` Herbert Xu
2013-10-22 11:29 ` Dmitry Kasatkin
2013-10-22 11:32 ` Herbert Xu
2013-10-22 11:57 ` Dmitry Kasatkin
2013-10-22 12:07 ` Herbert Xu
2013-10-22 12:50 ` Mimi Zohar
2013-10-22 12:53 ` Herbert Xu
2013-10-21 22:42 ` [PATCH v2 02/23] keys: change asymmetric keys to use common hash definitions Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 03/23] ima: provide support for arbitrary hash algorithms Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 04/23] ima: read and use signature hash algorithm Mimi Zohar
2013-10-21 22:42 ` Mimi Zohar [this message]
2013-10-21 22:42 ` [PATCH v2 06/23] ima: use dynamically allocated hash storage Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 07/23] ima: differentiate between template hash and file data hash sizes Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 08/23] ima: provide dedicated hash algo allocation function Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 09/23] ima: support arbitrary hash algorithms in ima_calc_buffer_hash Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 10/23] ima: ima_calc_boot_agregate must use SHA1 Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 11/23] ima: pass the file descriptor to ima_add_violation() Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 12/23] ima: pass the filename argument up to ima_add_template_entry() Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 13/23] ima: define new function ima_alloc_init_template() to API Mimi Zohar
2013-10-21 22:42 ` [PATCH v2 14/23] ima: new templates management mechanism Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 15/23] ima: define template fields library and new helpers Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 16/23] ima: define new template ima-ng and template fields d-ng and n-ng Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 17/23] ima: switch to new template management mechanism Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 18/23] ima: add audit log support for larger hashes Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 19/23] ima: defer determining the appraisal hash algorithm for 'ima' template Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 20/23] ima: add Kconfig default measurement list template Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 21/23] ima: define kernel parameter 'ima_template=' to change configured default Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 22/23] ima: enable support for larger default filedata hash algorithms Mimi Zohar
2013-10-21 22:43 ` [PATCH v2 23/23] ima: provide hash algo info in the xattr Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1382395388-8108-6-git-send-email-zohar@linux.vnet.ibm.com \
--to=zohar@linux.vnet.ibm.com \
--cc=d.kasatkin@samsung.com \
--cc=dhowells@redhat.com \
--cc=jmorris@namei.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®