On Tue, 2018-04-17 at 15:56 -0700, Matthew Garrett wrote:
> EVM signatures are always being generated with SHA1 even if the -a
> argument has been provided to evmctl. Fix this so the provided hash
> algorithm is used instead.
The kernel assumes both the HMAC and signature are sha1 as well.
static char * const evm_hmac = "hmac(sha1)";
static char * const evm_hash = "sha1";
Mimi
> Signed-off-by: Matthew Garrett <mjg59@xxxxxxxxxx>
> ---
> src/evmctl.c | 20 +++++++++++++++++---
> 1 file changed, 17 insertions(+), 3 deletions(-)
>
> diff --git a/src/evmctl.c b/src/evmctl.c
> index 2ffee78..43d261f 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -313,6 +313,7 @@ err:
>
> static int calc_evm_hash(const char *file, unsigned char *hash)
> {
> + const EVP_MD *md;
> struct stat st;
> int err;
> uint32_t generation = 0;
> @@ -374,7 +375,13 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
> return -1;
> }
>
> - err = EVP_DigestInit(pctx, EVP_sha1());
> + md = EVP_get_digestbyname(params.hash_algo);
> + if (!md) {
> + log_err("EVP_get_digestbyname() failed\n");
> + return 1;
> + }
> +
> + err = EVP_DigestInit(pctx, md);
> if (!err) {
> log_err("EVP_DigestInit() failed\n");
> return 1;
> @@ -498,7 +505,7 @@ static int sign_evm(const char *file, const char *key)
> if (len <= 1)
> return len;
>
> - len = sign_hash("sha1", hash, len, key, NULL, sig + 1);
> + len = sign_hash(params.hash_algo, hash, len, key, NULL, sig + 1);
> if (len <= 1)
> return len;
>
> @@ -967,6 +974,7 @@ static int cmd_setxattr_ima(struct command *cmd)
>
> static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *hash)
> {
> + const EVP_MD *md;
> struct stat st;
> int err = -1;
> uint32_t generation = 0;
> @@ -1033,7 +1041,13 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
> goto out;
> }
>
> - err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), EVP_sha1(), NULL);
> + md = EVP_get_digestbyname(params.hash_algo);
> + if (!md) {
> + log_err("EVP_get_digestbyname() failed\n");
> + goto out;
> + }
> +
> + err = !HMAC_Init_ex(pctx, evmkey, sizeof(evmkey), md, NULL);
> if (err) {
> log_err("HMAC_Init() failed\n");
> goto out;
