rpms/ima-evm-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Rebase to upstream release v1.5

Browse Source 
Related: https://issues.redhat.com/browse/RHEL-2969
Signed-off-by: Coiby Xu <coxu@redhat.com>
This commit is contained in:
Coiby Xu 2024-04-12 14:24:01 +08:00
parent c1406805d0
commit 09e3c9151e
4 changed files with 12 additions and 112 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
0001-evmctl-fix-memory-leak-in-get_password.patch
View File

@ -1,38 +0,0 @@
From 2f1740eab432abc8e85172531d97eba33342474c Mon Sep 17 00:00:00 2001
From: Bruno Meneguele <bmeneg@redhat.com>
Date: Mon, 16 Aug 2021 12:11:15 -0300
Subject: [PATCH] evmctl: fix memory leak in get_password
The variable "password" is not freed nor returned in case get_password()
succeeds. Return it instead of the intermediary variable "pwd". Issue found
by Coverity scan tool.
src/evmctl.c:2565: leaked_storage: Variable "password" going out of scope
leaks the storage it points to.
Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
src/evmctl.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/evmctl.c b/src/evmctl.c
index a8065bbe124a..ab7173723095 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -2625,7 +2625,12 @@ static char *get_password(void)
return NULL;
}
- return pwd;
+ if (pwd == NULL) {
+ free(password);
+ return NULL;
+ }
+
+ return password;
}
int main(int argc, char *argv[])
--
2.31.1

61
0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch
View File

@ -1,61 +0,0 @@
From 916a0f97fd244a48fde429a63ddc04ed1ed94f8b Mon Sep 17 00:00:00 2001
From: Bruno Meneguele <bmeneg@redhat.com>
Date: Mon, 16 Aug 2021 17:58:35 -0300
Subject: [PATCH] libimaevm: make SHA-256 the default hash algorithm
The SHA-1 algorithm is considered a weak hash algorithm and there has been
some movement within certain distros to drop its support completely or at
least drop it from the default behavior. ima-evm-utils uses it as the
default algorithm in case the user doesn't explicitly ask for another
through the --hashalgo/-a option. With that, make SHA-256 the default hash
algorithm instead.
Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
README | 2 +-
src/evmctl.c | 2 +-
src/libimaevm.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/README b/README
index 87cd3b5cd7da..0dc02f551673 100644
--- a/README
+++ b/README
@@ -41,7 +41,7 @@ COMMANDS
OPTIONS
-------
- -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512
+ -a, --hashalgo sha1, sha224, sha256 (default), sha384, sha512
-s, --imasig make IMA signature
-d, --imahash make IMA hash
-f, --sigfile store IMA signature in .sig file instead of xattr
diff --git a/src/evmctl.c b/src/evmctl.c
index a8065bbe124a..e0e55bc0b122 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -2496,7 +2496,7 @@ static void usage(void)
printf(
"\n"
- " -a, --hashalgo sha1 (default), sha224, sha256, sha384, sha512, streebog256, streebog512\n"
+ " -a, --hashalgo sha1, sha224, sha256 (default), sha384, sha512, streebog256, streebog512\n"
" -s, --imasig make IMA signature\n"
" -d, --imahash make IMA hash\n"
" -f, --sigfile store IMA signature in .sig file instead of xattr\n"
diff --git a/src/libimaevm.c b/src/libimaevm.c
index 8e9615796153..f6c72b878d88 100644
--- a/src/libimaevm.c
+++ b/src/libimaevm.c
@@ -88,7 +88,7 @@ static const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = {
struct libimaevm_params imaevm_params = {
.verbose = LOG_INFO,
.x509 = 1,
- .hash_algo = "sha1",
+ .hash_algo = "sha256",
};
static void __attribute__ ((constructor)) libinit(void);
--
2.31.1

23
ima-evm-utils.spec
View File

@ -11,21 +11,20 @@
%endif
%if %{with compat}
%global compat_soversion 2
%global compat_soversion 3
%endif
Name: ima-evm-utils
Version: 1.4
Release: 4%{?dist}
Version: 1.5
Release: 0.1%{?dist}
Summary: IMA/EVM support utilities
License: GPLv2
Url: http://linux-ima.sourceforge.net/
Source: http://sourceforge.net/projects/linux-ima/files/ima-evm-utils/%{name}-%{version}.tar.gz
Source: https://github.com/mimizohar/ima-evm-utils/releases/download/v%{version}/%{name}-%{version}.tar.gz
# compat source and patches
Source10: ima-evm-utils-1.3.2.tar.gz
Patch10: 0001-evmctl-fix-memory-leak-in-get_password.patch
Patch11: 0001-libimaevm-make-SHA-256-the-default-hash-algorithm.patch
Source10: ima-evm-utils-1.4.tar.gz
BuildRequires: asciidoc
BuildRequires: autoconf
@ -58,7 +57,7 @@ This package provides the header files for %{name}
Summary: Compatibility package of %{name}
%description -n %{name}%{compat_soversion}
This package provides the libimaevm.so.%{compat_soversion} relative to %{name}-1.3
This package provides the libimaevm.so.%{compat_soversion} relative to %{name}-1.4
%endif
%prep
@ -67,9 +66,6 @@ This package provides the libimaevm.so.%{compat_soversion} relative to %{name}-1
%if %{with compat}
mkdir compat/
tar -zxf %{SOURCE10} --strip-components=1 -C compat/
cd compat/
%patch10 -p1
%patch11 -p1
%endif
%build
@ -103,7 +99,7 @@ popd
%doc NEWS README AUTHORS
%{_bindir}/evmctl
# if you need to bump the soname version, coordinate with dependent packages
%{_libdir}/libimaevm.so.3*
%{_libdir}/libimaevm.so.4*
%{_mandir}/man1/evmctl*
%files devel
@ -118,6 +114,9 @@ popd
%endif
%changelog
* Fri Apr 12 2024 Coiby Xu <coxu@redhat.com> - 1.5-0.1
- Update to upstream 1.5
* Mon Dec 13 2021 Bruno Meneguele <bmeneg@redhat.com> - 1.4-4
- Fix compat bcond_with value check.

2
sources
View File

@ -1,2 +1,2 @@
SHA512 (ima-evm-utils-1.3.2.tar.gz) = af96935f953fbec8cdd40ba1a24001fae916633df03f9dee1e96775baec0ffea21a7a13798b3e3c3f375fd493a65fe65b5357887890b46cac0c4dcca5a5b79db
SHA512 (ima-evm-utils-1.4.tar.gz) = 2fdf41470d88608162a084c4877ba17d531941b744bcb44dd4913e48ab2c2d131e0af3e3ead74c18748a5d46aced51213ebd7c13a5ee19050c28d54a26c011a3
SHA512 (ima-evm-utils-1.5.tar.gz) = a1f0f2441dd1c41044f1b9a2151c53a02ed539dc1317950c4f8d72ec6340b2ac464bd572e6b0971bc2fe5dcc1842013f5698fe1bf2de92524ae0891c24daa417