The SHA-1 algorithm is considered a weak hash algorithm and there has been some movement within certain distros to drop its support completely or at least drop it from the default behavior. ima-evm-utils uses it as the default algorithm in case the user doesn't explicitly ask for another through the --with-default-hash configuration time option or --hashalgo/-a runtime option. With that, make SHA-256 the default hash algorithm instead. Signed-off-by: Bruno Meneguele <bmeneg@xxxxxxxxxx> --- m4/default-hash-algo.m4 | 2 +- src/imaevm.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4 index a0b98e645fb1..f23bbf7ab3f8 100644 --- a/m4/default-hash-algo.m4 +++ b/m4/default-hash-algo.m4 @@ -7,7 +7,7 @@ AC_DEFUN([AX_DEFAULT_HASH_ALGO], [ AC_ARG_WITH([default_hash], AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]), [HASH_ALGO=$withval], - [HASH_ALGO=sha1]) + [HASH_ALGO=sha256]) AC_CHECK_FILE([$CRYPTO_FILE], [HAVE_CRYPTO_FILE=yes], diff --git a/src/imaevm.h b/src/imaevm.h index cc3dfd2e9163..ba7b23907669 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -75,7 +75,7 @@ #define log_errno(fmt, args...) do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno) #ifndef DEFAULT_HASH_ALGO -#define DEFAULT_HASH_ALGO "sha1" +#define DEFAULT_HASH_ALGO "sha256" #endif #define DATA_SIZE 4096 -- 2.31.1
