linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v5 ima-evm-utils 0/2] make default hash algorithm dynamic
@ 2021-09-02 19:24 Bruno Meneguele
  2021-09-02 19:24 ` [PATCH v5 ima-evm-utils 1/2] set default hash algorithm in configuration time Bruno Meneguele
  2021-09-02 19:24 ` [PATCH v5 ima-evm-utils 2/2] make SHA-256 the default hash algorithm Bruno Meneguele
  0 siblings, 2 replies; 6+ messages in thread
From: Bruno Meneguele @ 2021-09-02 19:24 UTC (permalink / raw)
  To: zohar, Simon.THOBY, kgold; +Cc: linux-integrity, Bruno Meneguele

In order to allow users to set their own security policies, this patch
adds an option in configuration time to set the default hash algorithm to be
used. Considering that any hash algorithm supported by the kernel can be
used, the chosen algo is then checked against the hash_info.h header file.

At the same time, move from SHA1 to SHA256 default hash algorithm, following
the general movement of dropping SHA1 support in the major distros due to
its weaknesses.

Changelog:
v4: check against hash_info.h kernel header instead of /proc/crypto
v3: remove wrong comment from m4 script
v2: add a config time option for setting DEFAULT_HASH_ALGO.

Bruno Meneguele (2):
  set default hash algorithm in configuration time
  make SHA-256 the default hash algorithm

 README                  |  2 +-
 configure.ac            |  2 ++
 m4/default-hash-algo.m4 | 34 ++++++++++++++++++++++++++++++++++
 src/evmctl.c            |  4 ++--
 src/imaevm.h            |  4 ++++
 src/libimaevm.c         |  2 +-
 6 files changed, 44 insertions(+), 4 deletions(-)
 create mode 100644 m4/default-hash-algo.m4

-- 
2.31.1


^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH v5 ima-evm-utils 1/2] set default hash algorithm in configuration time
  2021-09-02 19:24 [PATCH v5 ima-evm-utils 0/2] make default hash algorithm dynamic Bruno Meneguele
@ 2021-09-02 19:24 ` Bruno Meneguele
  2021-09-09 21:03   ` Mimi Zohar
  2021-09-10 15:24   ` [PATCH v6 " Bruno Meneguele
  2021-09-02 19:24 ` [PATCH v5 ima-evm-utils 2/2] make SHA-256 the default hash algorithm Bruno Meneguele
  1 sibling, 2 replies; 6+ messages in thread
From: Bruno Meneguele @ 2021-09-02 19:24 UTC (permalink / raw)
  To: zohar, Simon.THOBY, kgold; +Cc: linux-integrity, Bruno Meneguele

The default hash algorithm for evmctl is today hardcoded in the libimaevm.c
file. To facilitate package maintainers across different distributions to
set their own default hash algorithm this, patch adds the
--with-default-hash=<algo> option to the configuration script.

The chosen algorithm will then be checked by its available in the kernel,
otherwise IMA won't be able to verify files hashed by the user. For that,
the kernel header hash_info.h used as the source of supported hashes. In
case the hash_info.h header is not present, the configuration script warns
about it, but uses whatever the user specified in the option.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
 README                  |  2 +-
 configure.ac            |  2 ++
 m4/default-hash-algo.m4 | 34 ++++++++++++++++++++++++++++++++++
 src/evmctl.c            |  4 ++--
 src/imaevm.h            |  4 ++++
 src/libimaevm.c         |  2 +-
 6 files changed, 44 insertions(+), 4 deletions(-)
 create mode 100644 m4/default-hash-algo.m4

diff --git a/README b/README
index 87cd3b5cd7da..4e35826cd982 100644
--- a/README
+++ b/README
@@ -41,7 +41,7 @@ COMMANDS
 OPTIONS
 -------
 
-  -a, --hashalgo     sha1 (default), sha224, sha256, sha384, sha512
+  -a, --hashalgo     sha1, sha224, sha256, sha384, sha512
   -s, --imasig       make IMA signature
   -d, --imahash      make IMA hash
   -f, --sigfile      store IMA signature in .sig file instead of xattr
diff --git a/configure.ac b/configure.ac
index a2d91b3db202..aff6fdfb26b4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -62,6 +62,7 @@ else
 fi
 
 EVMCTL_MANPAGE_DOCBOOK_XSL
+AX_DEFAULT_HASH_ALGO([$KERNEL_HEADERS])
 
 # for gcov
 #CFLAGS="$CFLAGS -Wall -fprofile-arcs -ftest-coverage"
@@ -81,6 +82,7 @@ echo
 echo
 echo	"Configuration:"
 echo	"          debug: $pkg_cv_enable_debug"
+echo	"   default-hash: $HASH_ALGO"
 echo	"   openssl-conf: $enable_openssl_conf"
 echo	"      tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free"
 echo	" tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode"
diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4
new file mode 100644
index 000000000000..9a8b2ff34cfc
--- /dev/null
+++ b/m4/default-hash-algo.m4
@@ -0,0 +1,34 @@
+dnl Copyright (c) 2021 Bruno Meneguele <bmeneg@redhat.com>
+dnl Check hash algorithm availability in the kernel
+dnl
+dnl $1 - $KERNEL_HEADERS
+
+AC_DEFUN([AX_DEFAULT_HASH_ALGO], [
+	HASH_INFO_HEADER="$1/include/uapi/linux/hash_info.h"
+
+	AC_ARG_WITH([default_hash],
+		AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]),
+		[HASH_ALGO=$withval],
+		[HASH_ALGO=sha1])
+
+	AC_CHECK_HEADER([$HASH_INFO_HEADER],
+		[HAVE_HASH_INFO_HEADER=yes],
+		[AC_MSG_WARN([$HASH_INFO_HEADER not found.])])
+
+	if test "x$HAVE_HASH_INFO_HEADER" = "x"; then
+		AC_MSG_RESULT([using $HASH_ALGO algorithm as default hash algorith])
+		AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm])
+	else
+		AC_PROG_SED()
+		AC_PROG_GREP()
+		$SED -n 's/HASH_ALGO_\(.*\),/\L\1\E/p' $HASH_INFO_HEADER | $GREP -w -i $HASH_ALGO > /dev/null
+		have_hash=$?
+
+		if test $have_hash -ne 0; then
+			AC_MSG_ERROR([$HASH_ALGO algorithm specified, but not provided by the kernel], 1)
+		else
+			AC_MSG_NOTICE([using $HASH_ALGO as default hash algorithm])
+			AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm])
+		fi
+	fi
+])
diff --git a/src/evmctl.c b/src/evmctl.c
index c999589943aa..d9385a225e88 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -2500,7 +2500,7 @@ static void usage(void)
 
 	printf(
 		"\n"
-		"  -a, --hashalgo     sha1 (default), sha224, sha256, sha384, sha512, streebog256, streebog512\n"
+		"  -a, --hashalgo     sha1, sha224, sha256, sha384, sha512, streebog256, streebog512 (default: %s)\n"
 		"  -s, --imasig       make IMA signature\n"
 		"  -d, --imahash      make IMA hash\n"
 		"  -f, --sigfile      store IMA signature in .sig file instead of xattr\n"
@@ -2534,7 +2534,7 @@ static void usage(void)
 		"      --ignore-violations ignore ToMToU measurement violations\n"
 		"  -v                 increase verbosity level\n"
 		"  -h, --help         display this help and exit\n"
-		"\n");
+		"\n", DEFAULT_HASH_ALGO);
 }
 
 struct command cmds[] = {
diff --git a/src/imaevm.h b/src/imaevm.h
index 491f136c105f..cc3dfd2e9163 100644
--- a/src/imaevm.h
+++ b/src/imaevm.h
@@ -74,6 +74,10 @@
 #define log_err(fmt, args...)		do_log(LOG_ERR, fmt, ##args)
 #define log_errno(fmt, args...)		do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno)
 
+#ifndef DEFAULT_HASH_ALGO
+#define DEFAULT_HASH_ALGO "sha1"
+#endif
+
 #define	DATA_SIZE	4096
 #define SHA1_HASH_LEN   20
 
diff --git a/src/libimaevm.c b/src/libimaevm.c
index 8e9615796153..2555e58a873b 100644
--- a/src/libimaevm.c
+++ b/src/libimaevm.c
@@ -88,7 +88,7 @@ static const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = {
 struct libimaevm_params imaevm_params = {
 	.verbose = LOG_INFO,
 	.x509 = 1,
-	.hash_algo = "sha1",
+	.hash_algo = DEFAULT_HASH_ALGO,
 };
 
 static void __attribute__ ((constructor)) libinit(void);
-- 
2.31.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH v5 ima-evm-utils 2/2] make SHA-256 the default hash algorithm
  2021-09-02 19:24 [PATCH v5 ima-evm-utils 0/2] make default hash algorithm dynamic Bruno Meneguele
  2021-09-02 19:24 ` [PATCH v5 ima-evm-utils 1/2] set default hash algorithm in configuration time Bruno Meneguele
@ 2021-09-02 19:24 ` Bruno Meneguele
  1 sibling, 0 replies; 6+ messages in thread
From: Bruno Meneguele @ 2021-09-02 19:24 UTC (permalink / raw)
  To: zohar, Simon.THOBY, kgold; +Cc: linux-integrity, Bruno Meneguele

The SHA-1 algorithm is considered a weak hash algorithm and there has been
some movement within certain distros to drop its support completely or at
least drop it from the default behavior. ima-evm-utils uses it as the
default algorithm in case the user doesn't explicitly ask for another
through the --with-default-hash configuration time option or --hashalgo/-a
runtime option. With that, make SHA-256 the default hash algorithm instead.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
 m4/default-hash-algo.m4 | 2 +-
 src/imaevm.h            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4
index 9a8b2ff34cfc..70d00b007fa1 100644
--- a/m4/default-hash-algo.m4
+++ b/m4/default-hash-algo.m4
@@ -9,7 +9,7 @@ AC_DEFUN([AX_DEFAULT_HASH_ALGO], [
 	AC_ARG_WITH([default_hash],
 		AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]),
 		[HASH_ALGO=$withval],
-		[HASH_ALGO=sha1])
+		[HASH_ALGO=sha256])
 
 	AC_CHECK_HEADER([$HASH_INFO_HEADER],
 		[HAVE_HASH_INFO_HEADER=yes],
diff --git a/src/imaevm.h b/src/imaevm.h
index cc3dfd2e9163..ba7b23907669 100644
--- a/src/imaevm.h
+++ b/src/imaevm.h
@@ -75,7 +75,7 @@
 #define log_errno(fmt, args...)		do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno)
 
 #ifndef DEFAULT_HASH_ALGO
-#define DEFAULT_HASH_ALGO "sha1"
+#define DEFAULT_HASH_ALGO "sha256"
 #endif
 
 #define	DATA_SIZE	4096
-- 
2.31.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH v5 ima-evm-utils 1/2] set default hash algorithm in configuration time
  2021-09-02 19:24 ` [PATCH v5 ima-evm-utils 1/2] set default hash algorithm in configuration time Bruno Meneguele
@ 2021-09-09 21:03   ` Mimi Zohar
  2021-09-10 15:19     ` Bruno Meneguele
  2021-09-10 15:24   ` [PATCH v6 " Bruno Meneguele
  1 sibling, 1 reply; 6+ messages in thread
From: Mimi Zohar @ 2021-09-09 21:03 UTC (permalink / raw)
  To: Bruno Meneguele, Simon.THOBY, kgold; +Cc: linux-integrity

On Thu, 2021-09-02 at 16:24 -0300, Bruno Meneguele wrote:
> +       AC_ARG_WITH([default_hash],
> +               AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]),
> +               [HASH_ALGO=$withval],
> +               [HASH_ALGO=sha1])
> +
> +       AC_CHECK_HEADER([$HASH_INFO_HEADER],
> +               [HAVE_HASH_INFO_HEADER=yes],
> +               [AC_MSG_WARN([$HASH_INFO_HEADER not found.])])
> +
> +       if test "x$HAVE_HASH_INFO_HEADER" = "x"; then
> +               AC_MSG_RESULT([using $HASH_ALGO algorithm as default hash algorith])
> +               AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm])
> +       else
> +               AC_PROG_SED()
> +               AC_PROG_GREP()
> +               $SED -n 's/HASH_ALGO_\(.*\),/\L\1\E/p' $HASH_INFO_HEADER | $GREP -w -i $HASH_ALGO > /dev/null

This does an a case insensitive test for the hash algorithm, but the
code itself doesn't support upper case hash algorithms (e.g. SHA1,
SHA256).

thanks,

Mimi


> +               have_hash=$?
> +
> +               if test $have_hash -ne 0; then
> +                       AC_MSG_ERROR([$HASH_ALGO algorithm specified, but not provided by the kernel], 1)
> +               else
> +                       AC_MSG_NOTICE([using $HASH_ALGO as default hash algorithm])
> +                       AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm])
> +               fi



^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH v5 ima-evm-utils 1/2] set default hash algorithm in configuration time
  2021-09-09 21:03   ` Mimi Zohar
@ 2021-09-10 15:19     ` Bruno Meneguele
  0 siblings, 0 replies; 6+ messages in thread
From: Bruno Meneguele @ 2021-09-10 15:19 UTC (permalink / raw)
  To: Mimi Zohar; +Cc: Simon.THOBY, kgold, linux-integrity

[-- Attachment #1: Type: text/plain, Size: 1856 bytes --]

On Thu, Sep 09, 2021 at 05:03:41PM -0400, Mimi Zohar wrote:
> On Thu, 2021-09-02 at 16:24 -0300, Bruno Meneguele wrote:
> > +       AC_ARG_WITH([default_hash],
> > +               AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]),
> > +               [HASH_ALGO=$withval],
> > +               [HASH_ALGO=sha1])
> > +
> > +       AC_CHECK_HEADER([$HASH_INFO_HEADER],
> > +               [HAVE_HASH_INFO_HEADER=yes],
> > +               [AC_MSG_WARN([$HASH_INFO_HEADER not found.])])
> > +
> > +       if test "x$HAVE_HASH_INFO_HEADER" = "x"; then
> > +               AC_MSG_RESULT([using $HASH_ALGO algorithm as default hash algorith])
> > +               AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm])
> > +       else
> > +               AC_PROG_SED()
> > +               AC_PROG_GREP()
> > +               $SED -n 's/HASH_ALGO_\(.*\),/\L\1\E/p' $HASH_INFO_HEADER | $GREP -w -i $HASH_ALGO > /dev/null
> 
> This does an a case insensitive test for the hash algorithm, but the
> code itself doesn't support upper case hash algorithms (e.g. SHA1,
> SHA256).
> 

This case-insensitive is actually redundant here, since in the 'sed' I'm
already lowering the case with '\L\1\E'. Will remove it.

> thanks,
> 
> Mimi
> 
> 
> > +               have_hash=$?
> > +
> > +               if test $have_hash -ne 0; then
> > +                       AC_MSG_ERROR([$HASH_ALGO algorithm specified, but not provided by the kernel], 1)
> > +               else
> > +                       AC_MSG_NOTICE([using $HASH_ALGO as default hash algorithm])
> > +                       AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm])
> > +               fi
> 
> 

-- 
bmeneg 
PGP Key: http://bmeneg.com/pubkey.txt

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH v6 ima-evm-utils 1/2] set default hash algorithm in configuration time
  2021-09-02 19:24 ` [PATCH v5 ima-evm-utils 1/2] set default hash algorithm in configuration time Bruno Meneguele
  2021-09-09 21:03   ` Mimi Zohar
@ 2021-09-10 15:24   ` Bruno Meneguele
  1 sibling, 0 replies; 6+ messages in thread
From: Bruno Meneguele @ 2021-09-10 15:24 UTC (permalink / raw)
  To: zohar, Simon.THOBY, kgold; +Cc: linux-integrity, Bruno Meneguele

The default hash algorithm for evmctl is today hardcoded in the libimaevm.c
file. To facilitate package maintainers across different distributions to
set their own default hash algorithm this, patch adds the
--with-default-hash=<algo> option to the configuration script.

The chosen algorithm will then be checked by its available in the kernel,
otherwise IMA won't be able to verify files hashed by the user. For that,
the kernel header hash_info.h used as the source of supported hashes. In
case the hash_info.h header is not present, the configuration script warns
about it, but uses whatever the user specified in the option.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
Changelog:
v5 - remove case insensitive grep (suggested by Mimi)

 README                  |  2 +-
 configure.ac            |  2 ++
 m4/default-hash-algo.m4 | 34 ++++++++++++++++++++++++++++++++++
 src/evmctl.c            |  4 ++--
 src/imaevm.h            |  4 ++++
 src/libimaevm.c         |  2 +-
 6 files changed, 44 insertions(+), 4 deletions(-)
 create mode 100644 m4/default-hash-algo.m4

diff --git a/README b/README
index 87cd3b5cd7da..4e35826cd982 100644
--- a/README
+++ b/README
@@ -41,7 +41,7 @@ COMMANDS
 OPTIONS
 -------
 
-  -a, --hashalgo     sha1 (default), sha224, sha256, sha384, sha512
+  -a, --hashalgo     sha1, sha224, sha256, sha384, sha512
   -s, --imasig       make IMA signature
   -d, --imahash      make IMA hash
   -f, --sigfile      store IMA signature in .sig file instead of xattr
diff --git a/configure.ac b/configure.ac
index a2d91b3db202..aff6fdfb26b4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -62,6 +62,7 @@ else
 fi
 
 EVMCTL_MANPAGE_DOCBOOK_XSL
+AX_DEFAULT_HASH_ALGO([$KERNEL_HEADERS])
 
 # for gcov
 #CFLAGS="$CFLAGS -Wall -fprofile-arcs -ftest-coverage"
@@ -81,6 +82,7 @@ echo
 echo
 echo	"Configuration:"
 echo	"          debug: $pkg_cv_enable_debug"
+echo	"   default-hash: $HASH_ALGO"
 echo	"   openssl-conf: $enable_openssl_conf"
 echo	"      tss2-esys: $ac_cv_lib_tss2_esys_Esys_Free"
 echo	" tss2-rc-decode: $ac_cv_lib_tss2_rc_Tss2_RC_Decode"
diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4
new file mode 100644
index 000000000000..0b6a94349e79
--- /dev/null
+++ b/m4/default-hash-algo.m4
@@ -0,0 +1,34 @@
+dnl Copyright (c) 2021 Bruno Meneguele <bmeneg@redhat.com>
+dnl Check hash algorithm availability in the kernel
+dnl
+dnl $1 - $KERNEL_HEADERS
+
+AC_DEFUN([AX_DEFAULT_HASH_ALGO], [
+	HASH_INFO_HEADER="$1/include/uapi/linux/hash_info.h"
+
+	AC_ARG_WITH([default_hash],
+		AS_HELP_STRING([--with-default-hash=ALGORITHM], [specifies the default hash algorithm to be used]),
+		[HASH_ALGO=$withval],
+		[HASH_ALGO=sha1])
+
+	AC_CHECK_HEADER([$HASH_INFO_HEADER],
+		[HAVE_HASH_INFO_HEADER=yes],
+		[AC_MSG_WARN([$HASH_INFO_HEADER not found.])])
+
+	if test "x$HAVE_HASH_INFO_HEADER" = "x"; then
+		AC_MSG_RESULT([using $HASH_ALGO algorithm as default hash algorith])
+		AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm])
+	else
+		AC_PROG_SED()
+		AC_PROG_GREP()
+		$SED -n 's/HASH_ALGO_\(.*\),/\L\1\E/p' $HASH_INFO_HEADER | $GREP -w $HASH_ALGO > /dev/null
+		have_hash=$?
+
+		if test $have_hash -ne 0; then
+			AC_MSG_ERROR([$HASH_ALGO algorithm specified, but not provided by the kernel], 1)
+		else
+			AC_MSG_NOTICE([using $HASH_ALGO as default hash algorithm])
+			AC_DEFINE_UNQUOTED(DEFAULT_HASH_ALGO, "$HASH_ALGO", [Define default hash algorithm])
+		fi
+	fi
+])
diff --git a/src/evmctl.c b/src/evmctl.c
index c999589943aa..d9385a225e88 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -2500,7 +2500,7 @@ static void usage(void)
 
 	printf(
 		"\n"
-		"  -a, --hashalgo     sha1 (default), sha224, sha256, sha384, sha512, streebog256, streebog512\n"
+		"  -a, --hashalgo     sha1, sha224, sha256, sha384, sha512, streebog256, streebog512 (default: %s)\n"
 		"  -s, --imasig       make IMA signature\n"
 		"  -d, --imahash      make IMA hash\n"
 		"  -f, --sigfile      store IMA signature in .sig file instead of xattr\n"
@@ -2534,7 +2534,7 @@ static void usage(void)
 		"      --ignore-violations ignore ToMToU measurement violations\n"
 		"  -v                 increase verbosity level\n"
 		"  -h, --help         display this help and exit\n"
-		"\n");
+		"\n", DEFAULT_HASH_ALGO);
 }
 
 struct command cmds[] = {
diff --git a/src/imaevm.h b/src/imaevm.h
index 491f136c105f..cc3dfd2e9163 100644
--- a/src/imaevm.h
+++ b/src/imaevm.h
@@ -74,6 +74,10 @@
 #define log_err(fmt, args...)		do_log(LOG_ERR, fmt, ##args)
 #define log_errno(fmt, args...)		do_log(LOG_ERR, fmt ": errno: %s (%d)\n", ##args, strerror(errno), errno)
 
+#ifndef DEFAULT_HASH_ALGO
+#define DEFAULT_HASH_ALGO "sha1"
+#endif
+
 #define	DATA_SIZE	4096
 #define SHA1_HASH_LEN   20
 
diff --git a/src/libimaevm.c b/src/libimaevm.c
index 8e9615796153..2555e58a873b 100644
--- a/src/libimaevm.c
+++ b/src/libimaevm.c
@@ -88,7 +88,7 @@ static const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = {
 struct libimaevm_params imaevm_params = {
 	.verbose = LOG_INFO,
 	.x509 = 1,
-	.hash_algo = "sha1",
+	.hash_algo = DEFAULT_HASH_ALGO,
 };
 
 static void __attribute__ ((constructor)) libinit(void);
-- 
2.31.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-09-10 15:25 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-02 19:24 [PATCH v5 ima-evm-utils 0/2] make default hash algorithm dynamic Bruno Meneguele
2021-09-02 19:24 ` [PATCH v5 ima-evm-utils 1/2] set default hash algorithm in configuration time Bruno Meneguele
2021-09-09 21:03   ` Mimi Zohar
2021-09-10 15:19     ` Bruno Meneguele
2021-09-10 15:24   ` [PATCH v6 " Bruno Meneguele
2021-09-02 19:24 ` [PATCH v5 ima-evm-utils 2/2] make SHA-256 the default hash algorithm Bruno Meneguele

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).