* [PATCH v2] ima-evm-utils: rework openssl init @ 2019-02-03 17:47 Vitaly Chikunov 2019-02-12 22:11 ` Mimi Zohar 2019-03-10 22:32 ` Mimi Zohar 0 siblings, 2 replies; 5+ messages in thread From: Vitaly Chikunov @ 2019-02-03 17:47 UTC (permalink / raw) To: Mimi Zohar, Dmitry Kasatkin, linux-integrity Remove deprecated call to OpenSSL_add_all_algorithms(). Allow to disable openssl config loading via configure `--disable-openssl-conf' option. Finish engine initialization properly by calling ENGINE_set_default(), as suggested by James Bottomley. Signed-off-by: Vitaly Chikunov <vt@altlinux.org> --- - v1 is "ima-evm-utils: remove redundant call to OpenSSL_add_all_algorithms" - everything is changed as suggested in mailing list, not just redundant OpenSSL_add_all_algorithms() call is removed. configure.ac | 6 ++++++ src/evmctl.c | 1 + src/libimaevm.c | 8 ++++++-- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 60f3684..ff8ac29 100644 --- a/configure.ac +++ b/configure.ac @@ -39,6 +39,12 @@ AC_ARG_WITH(kernel_headers, [AS_HELP_STRING([--with-kernel-headers=PATH], [KERNEL_HEADERS="$withval"], [KERNEL_HEADERS=/lib/modules/$(uname -r)/source]) +AC_ARG_ENABLE([openssl_conf], + [AS_HELP_STRING([--disable-openssl-conf], [disable loading of openssl config by libimaevm])], + if test "$enable_openssl_conf" = "no"; then + AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by libimaevm.]) + fi) + #debug support - yes for a while PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) if test $pkg_cv_enable_debug = yes; then diff --git a/src/evmctl.c b/src/evmctl.c index 2e4d551..fa074c4 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1904,6 +1904,7 @@ int main(int argc, char *argv[]) ENGINE_free(eng); eng = NULL; } + ENGINE_set_default(eng, ENGINE_METHOD_ALL); break; case 140: /* --xattr-user */ xattr_ima = "user.ima"; diff --git a/src/libimaevm.c b/src/libimaevm.c index 799eeec..db27c6f 100644 --- a/src/libimaevm.c +++ b/src/libimaevm.c @@ -976,7 +976,11 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c static void libinit() { - OpenSSL_add_all_algorithms(); - OPENSSL_add_all_algorithms_conf(); + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS | + OPENSSL_INIT_ADD_ALL_DIGESTS | +#ifndef DISABLE_OPENSSL_CONF + OPENSSL_INIT_LOAD_CONFIG | +#endif + OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); ERR_load_crypto_strings(); } -- 2.11.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] ima-evm-utils: rework openssl init 2019-02-03 17:47 [PATCH v2] ima-evm-utils: rework openssl init Vitaly Chikunov @ 2019-02-12 22:11 ` Mimi Zohar 2019-03-10 22:32 ` Mimi Zohar 1 sibling, 0 replies; 5+ messages in thread From: Mimi Zohar @ 2019-02-12 22:11 UTC (permalink / raw) To: Vitaly Chikunov, Mimi Zohar, Dmitry Kasatkin, linux-integrity On Sun, 2019-02-03 at 20:47 +0300, Vitaly Chikunov wrote: > Remove deprecated call to OpenSSL_add_all_algorithms(). > Allow to disable openssl config loading via configure > `--disable-openssl-conf' option. > Finish engine initialization properly by calling ENGINE_set_default(), > as suggested by James Bottomley. > > Signed-off-by: Vitaly Chikunov <vt@altlinux.org> Thanks! Mimi ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] ima-evm-utils: rework openssl init 2019-02-03 17:47 [PATCH v2] ima-evm-utils: rework openssl init Vitaly Chikunov 2019-02-12 22:11 ` Mimi Zohar @ 2019-03-10 22:32 ` Mimi Zohar 2019-03-10 23:15 ` Vitaly Chikunov 1 sibling, 1 reply; 5+ messages in thread From: Mimi Zohar @ 2019-03-10 22:32 UTC (permalink / raw) To: Vitaly Chikunov, Mimi Zohar, Dmitry Kasatkin, linux-integrity Hi Vitaly, On Sun, 2019-02-03 at 20:47 +0300, Vitaly Chikunov wrote: > Remove deprecated call to OpenSSL_add_all_algorithms(). > Allow to disable openssl config loading via configure > `--disable-openssl-conf' option. > Finish engine initialization properly by calling ENGINE_set_default(), > as suggested by James Bottomley. > Thanks, could you also display the status under "Give some feedback". Mimi > Signed-off-by: Vitaly Chikunov <vt@altlinux.org> > --- > - v1 is "ima-evm-utils: remove redundant call to OpenSSL_add_all_algorithms" > - everything is changed as suggested in mailing list, not just > redundant OpenSSL_add_all_algorithms() call is removed. > > configure.ac | 6 ++++++ > src/evmctl.c | 1 + > src/libimaevm.c | 8 ++++++-- > 3 files changed, 13 insertions(+), 2 deletions(-) > > diff --git a/configure.ac b/configure.ac > index 60f3684..ff8ac29 100644 > --- a/configure.ac > +++ b/configure.ac > @@ -39,6 +39,12 @@ AC_ARG_WITH(kernel_headers, [AS_HELP_STRING([--with-kernel-headers=PATH], > [KERNEL_HEADERS="$withval"], > [KERNEL_HEADERS=/lib/modules/$(uname -r)/source]) > > +AC_ARG_ENABLE([openssl_conf], > + [AS_HELP_STRING([--disable-openssl-conf], [disable loading of openssl config by libimaevm])], > + if test "$enable_openssl_conf" = "no"; then > + AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by libimaevm.]) > + fi) > + > #debug support - yes for a while > PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) > if test $pkg_cv_enable_debug = yes; then > diff --git a/src/evmctl.c b/src/evmctl.c > index 2e4d551..fa074c4 100644 > --- a/src/evmctl.c > +++ b/src/evmctl.c > @@ -1904,6 +1904,7 @@ int main(int argc, char *argv[]) > ENGINE_free(eng); > eng = NULL; > } > + ENGINE_set_default(eng, ENGINE_METHOD_ALL); > break; > case 140: /* --xattr-user */ > xattr_ima = "user.ima"; > diff --git a/src/libimaevm.c b/src/libimaevm.c > index 799eeec..db27c6f 100644 > --- a/src/libimaevm.c > +++ b/src/libimaevm.c > @@ -976,7 +976,11 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c > > static void libinit() > { > - OpenSSL_add_all_algorithms(); > - OPENSSL_add_all_algorithms_conf(); > + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS | > + OPENSSL_INIT_ADD_ALL_DIGESTS | > +#ifndef DISABLE_OPENSSL_CONF > + OPENSSL_INIT_LOAD_CONFIG | > +#endif > + OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); > ERR_load_crypto_strings(); > } ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] ima-evm-utils: rework openssl init 2019-03-10 22:32 ` Mimi Zohar @ 2019-03-10 23:15 ` Vitaly Chikunov 2019-03-23 1:25 ` Vitaly Chikunov 0 siblings, 1 reply; 5+ messages in thread From: Vitaly Chikunov @ 2019-03-10 23:15 UTC (permalink / raw) To: Mimi Zohar; +Cc: Mimi Zohar, Dmitry Kasatkin, linux-integrity Mimi, On Sun, Mar 10, 2019 at 06:32:02PM -0400, Mimi Zohar wrote: > > On Sun, 2019-02-03 at 20:47 +0300, Vitaly Chikunov wrote: > > Remove deprecated call to OpenSSL_add_all_algorithms(). > > Allow to disable openssl config loading via configure > > `--disable-openssl-conf' option. > > Finish engine initialization properly by calling ENGINE_set_default(), > > as suggested by James Bottomley. > > > > Thanks, could you also display the status under "Give some feedback". OK. > > Mimi > > > > Signed-off-by: Vitaly Chikunov <vt@altlinux.org> > > --- > > - v1 is "ima-evm-utils: remove redundant call to OpenSSL_add_all_algorithms" > > - everything is changed as suggested in mailing list, not just > > redundant OpenSSL_add_all_algorithms() call is removed. > > > > configure.ac | 6 ++++++ > > src/evmctl.c | 1 + > > src/libimaevm.c | 8 ++++++-- > > 3 files changed, 13 insertions(+), 2 deletions(-) > > > > diff --git a/configure.ac b/configure.ac > > index 60f3684..ff8ac29 100644 > > --- a/configure.ac > > +++ b/configure.ac > > @@ -39,6 +39,12 @@ AC_ARG_WITH(kernel_headers, [AS_HELP_STRING([--with-kernel-headers=PATH], > > [KERNEL_HEADERS="$withval"], > > [KERNEL_HEADERS=/lib/modules/$(uname -r)/source]) > > > > +AC_ARG_ENABLE([openssl_conf], > > + [AS_HELP_STRING([--disable-openssl-conf], [disable loading of openssl config by libimaevm])], > > + if test "$enable_openssl_conf" = "no"; then > > + AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by libimaevm.]) > > + fi) > > + > > #debug support - yes for a while > > PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) > > if test $pkg_cv_enable_debug = yes; then > > diff --git a/src/evmctl.c b/src/evmctl.c > > index 2e4d551..fa074c4 100644 > > --- a/src/evmctl.c > > +++ b/src/evmctl.c > > @@ -1904,6 +1904,7 @@ int main(int argc, char *argv[]) > > ENGINE_free(eng); > > eng = NULL; > > } > > + ENGINE_set_default(eng, ENGINE_METHOD_ALL); > > break; > > case 140: /* --xattr-user */ > > xattr_ima = "user.ima"; > > diff --git a/src/libimaevm.c b/src/libimaevm.c > > index 799eeec..db27c6f 100644 > > --- a/src/libimaevm.c > > +++ b/src/libimaevm.c > > @@ -976,7 +976,11 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c > > > > static void libinit() > > { > > - OpenSSL_add_all_algorithms(); > > - OPENSSL_add_all_algorithms_conf(); > > + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS | > > + OPENSSL_INIT_ADD_ALL_DIGESTS | > > +#ifndef DISABLE_OPENSSL_CONF > > + OPENSSL_INIT_LOAD_CONFIG | > > +#endif > > + OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); > > ERR_load_crypto_strings(); > > } ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] ima-evm-utils: rework openssl init 2019-03-10 23:15 ` Vitaly Chikunov @ 2019-03-23 1:25 ` Vitaly Chikunov 0 siblings, 0 replies; 5+ messages in thread From: Vitaly Chikunov @ 2019-03-23 1:25 UTC (permalink / raw) To: Mimi Zohar; +Cc: Mimi Zohar, Dmitry Kasatkin, linux-integrity Mimi, On Mon, Mar 11, 2019 at 02:15:49AM +0300, Vitaly Chikunov wrote: > On Sun, Mar 10, 2019 at 06:32:02PM -0400, Mimi Zohar wrote: > > > > On Sun, 2019-02-03 at 20:47 +0300, Vitaly Chikunov wrote: > > > Remove deprecated call to OpenSSL_add_all_algorithms(). > > > Allow to disable openssl config loading via configure > > > `--disable-openssl-conf' option. > > > Finish engine initialization properly by calling ENGINE_set_default(), > > > as suggested by James Bottomley. > > > > > > > Thanks, could you also display the status under "Give some feedback". > > OK. > > > > > Mimi > > > > > > > Signed-off-by: Vitaly Chikunov <vt@altlinux.org> > > > --- > > > - v1 is "ima-evm-utils: remove redundant call to OpenSSL_add_all_algorithms" > > > - everything is changed as suggested in mailing list, not just > > > redundant OpenSSL_add_all_algorithms() call is removed. > > > > > > configure.ac | 6 ++++++ > > > src/evmctl.c | 1 + > > > src/libimaevm.c | 8 ++++++-- > > > 3 files changed, 13 insertions(+), 2 deletions(-) > > > > > > diff --git a/configure.ac b/configure.ac > > > index 60f3684..ff8ac29 100644 > > > --- a/configure.ac > > > +++ b/configure.ac > > > @@ -39,6 +39,12 @@ AC_ARG_WITH(kernel_headers, [AS_HELP_STRING([--with-kernel-headers=PATH], > > > [KERNEL_HEADERS="$withval"], > > > [KERNEL_HEADERS=/lib/modules/$(uname -r)/source]) > > > > > > +AC_ARG_ENABLE([openssl_conf], > > > + [AS_HELP_STRING([--disable-openssl-conf], [disable loading of openssl config by libimaevm])], > > > + if test "$enable_openssl_conf" = "no"; then > > > + AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by libimaevm.]) > > > + fi) > > > + > > > #debug support - yes for a while > > > PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support]) > > > if test $pkg_cv_enable_debug = yes; then > > > diff --git a/src/evmctl.c b/src/evmctl.c > > > index 2e4d551..fa074c4 100644 > > > --- a/src/evmctl.c > > > +++ b/src/evmctl.c > > > @@ -1904,6 +1904,7 @@ int main(int argc, char *argv[]) > > > ENGINE_free(eng); > > > eng = NULL; > > > } > > > + ENGINE_set_default(eng, ENGINE_METHOD_ALL); > > > break; > > > case 140: /* --xattr-user */ > > > xattr_ima = "user.ima"; > > > diff --git a/src/libimaevm.c b/src/libimaevm.c > > > index 799eeec..db27c6f 100644 > > > --- a/src/libimaevm.c > > > +++ b/src/libimaevm.c > > > @@ -976,7 +976,11 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c > > > > > > static void libinit() > > > { > > > - OpenSSL_add_all_algorithms(); > > > - OPENSSL_add_all_algorithms_conf(); > > > + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS | > > > + OPENSSL_INIT_ADD_ALL_DIGESTS | > > > +#ifndef DISABLE_OPENSSL_CONF > > > + OPENSSL_INIT_LOAD_CONFIG | > > > +#endif > > > + OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL); I think now, that libimaevm should not load config, because it is library and that decision should be of the program that uses it. Thus, src/libimaevm.c:libinit should only call OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS | OPENSSL_INIT_ADD_ALL_DIGESTS, NULL); (like OpenSSL_add_all_algorithms*() was doing) and option `--disable-openssl-conf` should be removed. But, evmctl should always call OPENSSL_init_crypto() again, with `OPENSSL_INIT_LOAD_CONFIG | OPENSSL_INIT_ENGINE_ALL_BUILTIN`. What do you think? If you wish we can repurpose `--disable-openssl-conf` to affect `evmctl` instead of `libimaevm`. Thanks, ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-03-23 1:25 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-02-03 17:47 [PATCH v2] ima-evm-utils: rework openssl init Vitaly Chikunov 2019-02-12 22:11 ` Mimi Zohar 2019-03-10 22:32 ` Mimi Zohar 2019-03-10 23:15 ` Vitaly Chikunov 2019-03-23 1:25 ` Vitaly Chikunov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).