[PATCH] ima-evm-utils: Fix compatibility with LibreSSL

* [PATCH] ima-evm-utils: Fix compatibility with LibreSSL
@ 2019-12-03 22:41 Mikhail Novosyolov
  2020-03-24 21:05 ` Mimi Zohar
  2020-05-20 16:30 ` Mimi Zohar
  0 siblings, 2 replies; 13+ messages in thread
From: Mikhail Novosyolov @ 2019-12-03 22:41 UTC (permalink / raw)
  To: linux-integrity; +Cc: Mimi Zohar, Vitaly Chikunov, Mikhail Novosyolov

From 4ae52f3cfb459c59e2e48f0d30c20c3763c8a0e7 Mon Sep 17 00:00:00 2001
From: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Date: Wed, 4 Dec 2019 01:07:50 +0300
Subject: [PATCH] ima-evm-utils: Fix compatibility with LibreSSL

LibreSSL in most cases can be used as a drop-in replacement of OpenSSL.
Commit 07d799cb6c37 "ima-evm-utils: Preload OpenSSL engine via '--engine' option"
added OpenSSL-specific functions: "engines" were removed from LibreSSL long ago.
Instead of requiring to attach GOST support via an external library ("engine"),
LibreSSL has build-in implementation of GOST.

Commit ebbfc41ad6ba "ima-evm-utils: try to load digest by its alias" is also not OK
for LibreSSL because LibreSSL uses different digest names:
md_gost12_256 -> streebog256
md_gost12_512 -> streebog512

Example how it works when linked with LibreSSL:
$ libressl dgst -streebog256 testfile
streebog256(a)= 04123f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb
$ evmctl -v ima_hash -a streebog256 testfile
hash(streebog256): 04123f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb
$ evmctl -v ima_hash -a md_gost12_256 testfile
EVP_get_digestbyname(md_gost12_256) failed

TODO: it would be nice to map
md_gost12_256 <-> streebog256
md_gost12_512 <-> streebog512
in evmctl CLI arguements to make the same commands work on systems both
where evmctl is linked with LibreSSL and with OpenSSL.

Fixes: 07d799cb6c37 ("ima-evm-utils: Preload OpenSSL engine via '--engine' option")
Fixes: ebbfc41ad6ba ("ima-evm-utils: try to load digest by its alias")
Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
---
 README          |  2 +-
 src/evmctl.c    | 15 ++++++++++++++-
 src/libimaevm.c |  2 ++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/README b/README
index 3603ae8..f843bbe 100644
--- a/README
+++ b/README
@@ -58,7 +58,7 @@ OPTIONS
       --smack        use extra SMACK xattrs for EVM
       --m32          force EVM hmac/signature for 32 bit target system
       --m64          force EVM hmac/signature for 64 bit target system
-      --engine e     preload OpenSSL engine e (such as: gost)
+      --engine e     preload OpenSSL engine e (such as: gost) (not valid for LibreSSL)
   -v                 increase verbosity level
   -h, --help         display this help and exit
 
diff --git a/src/evmctl.c b/src/evmctl.c
index 3d2a10b..f6507c1 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -62,7 +62,10 @@
 #include <openssl/hmac.h>
 #include <openssl/err.h>
 #include <openssl/rsa.h>
+/* LibreSSL removed engines */
+#ifndef LIBRESSL_VERSION_NUMBER
 #include <openssl/engine.h>
+#endif
 
 #ifndef XATTR_APPAARMOR_SUFFIX
 #define XATTR_APPARMOR_SUFFIX "apparmor"
@@ -1849,7 +1852,9 @@ static void usage(void)
         "      --selinux      use custom Selinux label for EVM\n"
         "      --caps         use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n"
         "      --list         measurement list verification\n"
+#ifndef LIBRESSL_VERSION_NUMBER /* LibreSSL removed engines */
         "      --engine e     preload OpenSSL engine e (such as: gost)\n"
+#endif
         "  -v                 increase verbosity level\n"
         "  -h, --help         display this help and exit\n"
         "\n");
@@ -1902,7 +1907,9 @@ static struct option opts[] = {
     {"selinux", 1, 0, 136},
     {"caps", 2, 0, 137},
     {"list", 0, 0, 138},
+#ifndef LIBRESSL_VERSION_NUMBER
     {"engine", 1, 0, 139},
+#endif
     {"xattr-user", 0, 0, 140},
     {}
 
@@ -1947,7 +1954,9 @@ static char *get_password(void)
 int main(int argc, char *argv[])
 {
     int err = 0, c, lind;
+#ifndef LIBRESSL_VERSION_NUMBER
     ENGINE *eng = NULL;
+#endif
 
 #if !(OPENSSL_VERSION_NUMBER < 0x10100000)
     OPENSSL_init_crypto(
@@ -2065,7 +2074,8 @@ int main(int argc, char *argv[])
         case 138:
             measurement_list = 1;
             break;
-        case 139: /* --engine e */
+#ifndef LIBRESSL_VERSION_NUMBER
+        case 139: /* --engine e, only in OpenSSL, not in LibreSSL */
             eng = ENGINE_by_id(optarg);
             if (!eng) {
                 log_err("engine %s isn't available\n", optarg);
@@ -2078,6 +2088,7 @@ int main(int argc, char *argv[])
             }
             ENGINE_set_default(eng, ENGINE_METHOD_ALL);
             break;
+#endif
         case 140: /* --xattr-user */
             xattr_ima = "user.ima";
             xattr_evm = "user.evm";
@@ -2108,6 +2119,7 @@ int main(int argc, char *argv[])
         }
     }
 
+#ifndef LIBRESSL_VERSION_NUMBER
     if (eng) {
         ENGINE_finish(eng);
         ENGINE_free(eng);
@@ -2115,6 +2127,7 @@ int main(int argc, char *argv[])
         ENGINE_cleanup();
 #endif
     }
+#endif
     ERR_free_strings();
     EVP_cleanup();
     BIO_free(NULL);
diff --git a/src/libimaevm.c b/src/libimaevm.c
index 7c17bf4..050ea78 100644
--- a/src/libimaevm.c
+++ b/src/libimaevm.c
@@ -71,8 +71,10 @@ static const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
     [PKEY_HASH_SHA384]    = "sha384",
     [PKEY_HASH_SHA512]    = "sha512",
     [PKEY_HASH_SHA224]    = "sha224",
+#ifndef LIBRESSL_VERSION_NUMBER
     [PKEY_HASH_STREEBOG_256] = "md_gost12_256",
     [PKEY_HASH_STREEBOG_512] = "md_gost12_512",
+#endif
 };
 
 /* Names that are primary for the kernel. */
-- 
2.20.1

P.S. Patch is against commit 3eab1f93 "ima-evm-utils: Release version 1.2.1", I did not find newer git.


^ permalink raw reply related	[flat|nested] 13+ messages in thread