On 6/16/23 15:23, Roberto Sassu wrote:
From: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
Commit 6ecb88352886 ("evmctl: Remove left-over check S_ISDIR() for
directory signing") removes fetching the inode generation for directories.
While directories might not be signed, EVM currently calculates the HMAC on
them, including the inode generation.
To keep user space and kernel space aligned, reenable fetching the inode
generation for directories, and add again the comment that the inode
generation cannot be obtained for special files.
The user wouldn't notice anything, right?
Fixes: Commit 6ecb88352886 ("evmctl: Remove left-over check S_ISDIR() for directory signing")
Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
---
src/evmctl.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/evmctl.c b/src/evmctl.c
index c24261cf0e6..7a3ffd7c823 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -1229,7 +1229,11 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *s
goto out;
}
- if (S_ISREG(st.st_mode)) {
+ if (S_ISREG(st.st_mode) || S_ISDIR(st.st_mode)) {
+ /*
+ * We cannot at the moment get generation of special files..
+ * kernel API does not support it.
+ */
int fd = open(file, 0);
if (fd < 0) {
Reviewed-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
