Re: [PATCH v3 2/2] ima-evm-utils: log unknown keyid's as errors

From: Vitaly Chikunov <vt@altlinux.org>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: linux-integrity@vger.kernel.org
Subject: Re: [PATCH v3 2/2] ima-evm-utils: log unknown keyid's as errors
Date: Wed, 24 Jul 2019 03:50:44 +0300	[thread overview]
Message-ID: <20190724005044.2t3mlpyh7goxah6s@altlinux.org> (raw)
In-Reply-To: <1563927586.4294.20.camel@linux.ibm.com>

Mimi,

On Tue, Jul 23, 2019 at 08:19:46PM -0400, Mimi Zohar wrote:
> On Wed, 2019-07-24 at 02:13 +0300, Vitaly Chikunov wrote:
> > > > > +	tail->next = entry;
> > > > 
> > > > In that case here is SIGSEGV when user try to ima_verify.
> > > 
> > > find_keyid() returns NULL, which is checked before being used.
> > >  There's only one caller of this function.
> > 
> > find_keyid does not return since tail is NULL, thus there is null
> > dereference in `tail->next`.
> > 
> > > Do you have a test case to reproduce this bug?
> > 
> >   ima-evm-utils/tests ((31b5f50...))$ rm sha1.txt
> >   ima-evm-utils/tests ((31b5f50...))$ touch sha1.txt
> >   ima-evm-utils/tests ((31b5f50...))$ evmctl ima_sign -k test-rsa1024.key -a sha1 --xattr-user sha1.txt
> >   ima-evm-utils/tests ((31b5f50...))$ evmctl ima_verify -k /absent --xattr-user sha1.txt
> >   Failed to open keyfile: /absent
> >   Segmentation fault
> > 
> > 31b5f50 is head of your git next branch.
> > 
> > I temporary fixed like this:
> > 
> > -       tail->next = entry;
> > +       if (tail)
> > +               tail->next = entry;
> > +       else
> > +               public_keys = entry;
> 
> I see.  If you don't object, I'll fold this into the original patch. 

Of course.

Thanks,