From: Mimi Zohar <zohar@linux.ibm.com>
To: linux-integrity@vger.kernel.org
Cc: Mimi Zohar <zohar@linux.ibm.com>, Petr Vorel <pvorel@suse.cz>,
Bruno Meneguele <bmeneg@redhat.com>
Subject: [PATCH v2 7/8] ima-evm-utils: optionally verify the template data file signature
Date: Fri, 10 Jul 2020 12:00:58 -0400 [thread overview]
Message-ID: <1594396859-9232-8-git-send-email-zohar@linux.ibm.com> (raw)
In-Reply-To: <1594396859-9232-1-git-send-email-zohar@linux.ibm.com>
Rename "--list" to "verify-sig" to optionally verify the file signature
contained in the template data based on the supplied set of keys.
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
README | 3 ++-
src/evmctl.c | 12 ++++++------
2 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/README b/README
index 3603ae8a6084..374b748c59bf 100644
--- a/README
+++ b/README
@@ -31,7 +31,7 @@ COMMANDS
ima_sign [--sigfile] [--key key] [--pass password] file
ima_verify file
ima_hash file
- ima_measurement [--key "key1, key2, ..."] [--list] file
+ ima_measurement [--verify-sig [--key "key1, key2, ..."]] file
ima_fix [-t fdsxm] path
sign_hash [--key key] [--pass password]
hmac [--imahash | --imasig ] file
@@ -59,6 +59,7 @@ OPTIONS
--m32 force EVM hmac/signature for 32 bit target system
--m64 force EVM hmac/signature for 64 bit target system
--engine e preload OpenSSL engine e (such as: gost)
+ --verify-sig verify the template data file signature
-v increase verbosity level
-h, --help display this help and exit
diff --git a/src/evmctl.c b/src/evmctl.c
index 88fd8e4c31f0..90a3eebc4431 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -125,7 +125,7 @@ static char *caps_str;
static char *ima_str;
static char *selinux_str;
static char *search_type;
-static int measurement_list;
+static int verify_list_sig;
static int recursive;
static int msize;
static dev_t fs_dev;
@@ -1566,7 +1566,7 @@ void ima_ng_show(struct template_entry *entry)
log_info(" ");
log_dump(sig, sig_len);
}
- if (measurement_list)
+ if (verify_list_sig)
err = ima_verify_signature(path, sig, sig_len,
digest, digest_len);
else
@@ -2367,7 +2367,7 @@ static void usage(void)
" --ima use custom IMA signature for EVM\n"
" --selinux use custom Selinux label for EVM\n"
" --caps use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n"
- " --list measurement list verification\n"
+ " --verify-sig verify measurement list signatures\n"
" --engine e preload OpenSSL engine e (such as: gost)\n"
" -v increase verbosity level\n"
" -h, --help display this help and exit\n"
@@ -2385,7 +2385,7 @@ struct command cmds[] = {
{"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"},
{"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"},
{"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"},
- {"ima_measurement", cmd_ima_measurement, 0, "[--validate] [--verify] [--pcrs file] file", "Verify measurement list (experimental).\n"},
+ {"ima_measurement", cmd_ima_measurement, 0, "[--validate] [--verify] [--verify-sig [--key key1, key2, ...]] [--pcrs file] file", "Verify measurement list (experimental).\n"},
{"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[file]", "Calculate per TPM bank boot_aggregate digests\n"},
{"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"},
{"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"},
@@ -2421,7 +2421,7 @@ static struct option opts[] = {
{"ima", 1, 0, 135},
{"selinux", 1, 0, 136},
{"caps", 2, 0, 137},
- {"list", 0, 0, 138},
+ {"verify-sig", 0, 0, 138},
{"engine", 1, 0, 139},
{"xattr-user", 0, 0, 140},
{"validate", 0, 0, 141},
@@ -2586,7 +2586,7 @@ int main(int argc, char *argv[])
hmac_flags |= HMAC_FLAG_CAPS_SET;
break;
case 138:
- measurement_list = 1;
+ verify_list_sig = 1;
break;
case 139: /* --engine e */
eng = ENGINE_by_id(optarg);
--
2.7.5
next prev parent reply other threads:[~2020-07-10 16:08 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-10 16:00 [PATCH v2 0/8] additional "ima-measurement" support Mimi Zohar
2020-07-10 16:00 ` [PATCH v2 1/8] ima-evm-utils: improve reading TPM 1.2 PCRs Mimi Zohar
2020-07-10 16:00 ` [PATCH v2 2/8] ima_evm_utils: support extending TPM 2.0 banks w/original SHA1 padded digest Mimi Zohar
2020-07-15 18:43 ` Bruno Meneguele
2020-07-15 19:47 ` Mimi Zohar
2020-07-15 20:11 ` Mimi Zohar
2020-07-15 20:17 ` Bruno Meneguele
2020-07-10 16:00 ` [PATCH v2 3/8] ima-evm-utils: support providing the TPM 1.2 PCRs as a file Mimi Zohar
2020-07-10 16:00 ` [PATCH v2 4/8] ima-evm-utils: emit "ima_measurement" messages based on log level Mimi Zohar
2020-07-10 16:00 ` [PATCH v2 5/8] ima-evm-utils: guarantee the measurement list contains all the records Mimi Zohar
2020-07-10 16:00 ` [PATCH v2 6/8] ima-evm-utils: the IMA measurement list may have too many measurements Mimi Zohar
2020-07-10 16:00 ` Mimi Zohar [this message]
2020-07-10 16:00 ` [PATCH v2 8/8] ima-evm-utils: update README to reflect "--pcrs", "--verify" and "--validate" Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1594396859-9232-8-git-send-email-zohar@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=bmeneg@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=pvorel@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.