On Fri, Aug 20, 2021 at 07:49:16PM -0300, Bruno Meneguele wrote: > The default hash algorithm for evmctl is today hardcoded at libimaevm.c > file. To facilitate different distributions and users to set their own > default hash algorithm this patch adds the --with-default-hash=<algo> option > to the configuration script. > > The algorithm chosen by the user will then be checked if is available in the > kernel, otherwise IMA won't be able to verify files hashed by the user. For > that, the file exposed by the kernel crypto API (/proc/crypto) is filtered > by an AWK script in order to check the algorithm's name and the module > providing it. Initally, only "module: kernel" is accepted, following IMA's > CONFIG_CRYPTO_SHA1/SHA256 dependency. > > Signed-off-by: Bruno Meneguele <bmeneg@xxxxxxxxxx> > --- > README | 2 +- > configure.ac | 1 + > m4/default-hash-algo.m4 | 48 +++++++++++++++++++++++++++++++++++++++++ > src/evmctl.c | 4 ++-- > src/imaevm.h | 4 ++++ > src/libimaevm.c | 2 +- > 6 files changed, 57 insertions(+), 4 deletions(-) > create mode 100644 m4/default-hash-algo.m4 > > diff --git a/README b/README > index 87cd3b5cd7da..4e35826cd982 100644 > --- a/README > +++ b/README > @@ -41,7 +41,7 @@ COMMANDS > OPTIONS > ------- > > - -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512 > + -a, --hashalgo sha1, sha224, sha256, sha384, sha512 > -s, --imasig make IMA signature > -d, --imahash make IMA hash > -f, --sigfile store IMA signature in .sig file instead of xattr > diff --git a/configure.ac b/configure.ac > index a2d91b3db202..1c45f7f757ea 100644 > --- a/configure.ac > +++ b/configure.ac > @@ -62,6 +62,7 @@ else > fi > > EVMCTL_MANPAGE_DOCBOOK_XSL > +AX_DEFAULT_HASH_ALGO > > # for gcov > #CFLAGS="$CFLAGS -Wall -fprofile-arcs -ftest-coverage" > diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4 > new file mode 100644 > index 000000000000..14be44731ba6 > --- /dev/null > +++ b/m4/default-hash-algo.m4 > @@ -0,0 +1,48 @@ > +dnl Copyright (c) 2021 Bruno Meneguele <bmeneg@xxxxxxxxxx> > +dnl Check hash algorithm availability in the kernel > +dnl > +dnl $1 = hash algorithm passed through --with-default-hash=<algo> > + ^ this comment is useless here. At first I was keeping the AC_ARG_WITH() outside the function and passing the result to that later. I'm going to send a v4 removing this comment. -- bmeneg PGP Key: http://bmeneg.com/pubkey.txt
Attachment:
signature.asc
Description: PGP signature
