Put .hmac files into a separate directory
Putting the .hmac files into the same directory as the checked binary causes rpmlint errors and is generaly not a good idea (there could be a multilib conflict). Since dracut is already hard-coded to search for them in /lib(64)?/fipscheck and /lib(64)?/hmaccalc, let's just drop them there.
This commit is contained in:
Ondrej Mosnacek
parent
17d760e698
commit
28355f75fe
@ -0,0 +1,186 @@
|
||||
From 2a0642407dd227d24e646c170d8afd47ab917899 Mon Sep 17 00:00:00 2001
|
||||
From: Ondrej Mosnacek <omosnace@redhat.com>
|
||||
Date: Mon, 16 Jul 2018 15:17:29 +0200
|
||||
Subject: [PATCH] kcapi-hasher: Add missing -d option to fipshmac
|
||||
|
||||
---
|
||||
apps/kcapi-hasher.c | 61 ++++++++++++++++++++++++++++-------------------------
|
||||
1 file changed, 32 insertions(+), 29 deletions(-)
|
||||
|
||||
diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c
|
||||
index 6782dbc..2fc3ddc 100644
|
||||
--- a/apps/kcapi-hasher.c
|
||||
+++ b/apps/kcapi-hasher.c
|
||||
@@ -71,7 +71,7 @@ struct hash_name {
|
||||
};
|
||||
|
||||
struct hash_key {
|
||||
- const char *subdir;
|
||||
+ const char *checkdir;
|
||||
const uint8_t *data;
|
||||
uint32_t len;
|
||||
};
|
||||
@@ -108,12 +108,20 @@ static const char hmaccalc_hmackey[] = "FIPS-FTW-RHT2009";
|
||||
static const struct hash_key KEY_FIPSCHECK = {
|
||||
.data = (const uint8_t *)fipscheck_hmackey,
|
||||
.len = sizeof(fipscheck_hmackey) - 1,
|
||||
- .subdir = "fipscheck",
|
||||
+#ifdef CHECK_DIR
|
||||
+ .checkdir = CHECK_DIR"/fipscheck",
|
||||
+#else
|
||||
+ .checkdir = NULL,
|
||||
+#endif
|
||||
};
|
||||
static const struct hash_key KEY_HMACCALC = {
|
||||
.data = (const uint8_t *)hmaccalc_hmackey,
|
||||
.len = sizeof(hmaccalc_hmackey) - 1,
|
||||
- .subdir = "hmaccalc",
|
||||
+#ifdef CHECK_DIR
|
||||
+ .checkdir = CHECK_DIR"/hmaccalc",
|
||||
+#else
|
||||
+ .checkdir = NULL,
|
||||
+#endif
|
||||
};
|
||||
|
||||
static void usage(char *name, int fipscheck)
|
||||
@@ -142,7 +150,8 @@ static void usage(char *name, int fipscheck)
|
||||
fprintf(stderr, "\t-k --key-file FILE\tUse HMAC key from given file\n");
|
||||
fprintf(stderr, "\t-K --key KEY\t\tUse KEY as the HMAC key\n");
|
||||
fprintf(stderr, "\t --tag\t\tCreate a BSD-style checksum\n");
|
||||
- fprintf(stderr, "\t-b, -d, -P\t\tCompatibility hmaccalc options; ignored\n");
|
||||
+ fprintf(stderr, "\t-d\t\t\tCheck directory for fipshmac; otherwise ignored\n");
|
||||
+ fprintf(stderr, "\t-b, -P\t\t\tCompatibility hmaccalc options; ignored\n");
|
||||
fprintf(stderr, "\t --help\t\tPrint this help text\n");
|
||||
fprintf(stderr, "\t-v --version\t\tShow version\n");
|
||||
}
|
||||
@@ -368,7 +377,7 @@ static char *paste(char *dst, const char *src, size_t size)
|
||||
* return: NULL when malloc failed, a pointer that the caller must free
|
||||
* otherwise.
|
||||
*/
|
||||
-static char *get_hmac_file(const char *filename, const char *subdir)
|
||||
+static char *get_hmac_file(const char *filename, const char *checkdir)
|
||||
{
|
||||
size_t i, filelen, pathlen, namelen, basenamestart = 0;
|
||||
size_t prefixlen = strlen(CHECK_PREFIX);
|
||||
@@ -386,12 +395,7 @@ static char *get_hmac_file(const char *filename, const char *subdir)
|
||||
}
|
||||
|
||||
namelen = filelen - basenamestart;
|
||||
-#ifdef CHECK_DIR
|
||||
- pathlen = strlen(CHECK_DIR"/") + strlen(subdir) + 1;
|
||||
-#else
|
||||
- (void)subdir; // avoid parameter unused warning
|
||||
- pathlen = basenamestart;
|
||||
-#endif
|
||||
+ pathlen = checkdir ? strlen(checkdir) + 1 : basenamestart;
|
||||
|
||||
checkfile = malloc(pathlen + namelen + prefixlen + 1 /* "." */ +
|
||||
suffixlen + 1 /* null character */);
|
||||
@@ -399,14 +403,12 @@ static char *get_hmac_file(const char *filename, const char *subdir)
|
||||
return NULL;
|
||||
|
||||
cursor = checkfile;
|
||||
-#ifdef CHECK_DIR
|
||||
- cursor = paste(cursor, CHECK_DIR"/", strlen(CHECK_DIR"/"));
|
||||
- cursor = paste(cursor, subdir, strlen(subdir));
|
||||
- cursor = paste(cursor, "/", 1);
|
||||
-#else
|
||||
- if (pathlen > 0)
|
||||
+ if (checkdir) {
|
||||
+ cursor = paste(cursor, checkdir, strlen(checkdir));
|
||||
+ cursor = paste(cursor, "/", 1);
|
||||
+ } else if (pathlen > 0)
|
||||
cursor = paste(cursor, filename, pathlen);
|
||||
-#endif
|
||||
+
|
||||
cursor = paste(cursor, CHECK_PREFIX, prefixlen);
|
||||
cursor = paste(cursor, filename + basenamestart, namelen);
|
||||
cursor = paste(cursor, "."CHECK_SUFFIX, 1 + suffixlen);
|
||||
@@ -417,7 +419,7 @@ static char *get_hmac_file(const char *filename, const char *subdir)
|
||||
|
||||
static int hash_files(const struct hash_params *params,
|
||||
char *filenames[], uint32_t files,
|
||||
- int fipshmac, int just_print)
|
||||
+ int fipshmac, const char *checkdir, int just_print)
|
||||
{
|
||||
struct kcapi_handle *handle;
|
||||
const char *hashname = params->name.kcapiname;
|
||||
@@ -446,9 +448,7 @@ static int hash_files(const struct hash_params *params,
|
||||
const char *filename = filenames[i];
|
||||
|
||||
if (fipshmac) {
|
||||
- char *outfile = get_hmac_file(filenames[i],
|
||||
- params->key.subdir);
|
||||
-
|
||||
+ char *outfile = get_hmac_file(filenames[i], checkdir);
|
||||
if (!outfile) {
|
||||
fprintf(stderr,
|
||||
"Cannot create HMAC file name\n");
|
||||
@@ -712,11 +712,11 @@ static int fipscheck_self(const struct hash_params *params_bin,
|
||||
}
|
||||
|
||||
if (mode == SELFCHECK_PRINT_SELF) {
|
||||
- ret = hash_files(params_bin, names, 1, 0, 1);
|
||||
+ ret = hash_files(params_bin, names, 1, 0, NULL, 1);
|
||||
goto out;
|
||||
}
|
||||
|
||||
- checkfile = get_hmac_file(selfname, params_bin->key.subdir);
|
||||
+ checkfile = get_hmac_file(selfname, params_bin->key.checkdir);
|
||||
if (!checkfile) {
|
||||
ret = -ENOMEM;
|
||||
goto out;
|
||||
@@ -750,13 +750,13 @@ static int fipscheck_self(const struct hash_params *params_bin,
|
||||
strncpy(selfname, info.dli_fname, (sizeof(selfname) - 1));
|
||||
|
||||
if (mode == SELFCHECK_PRINT_LIB) {
|
||||
- ret = hash_files(params_lib, names, 1, 0, 1);
|
||||
+ ret = hash_files(params_lib, names, 1, 0, NULL, 1);
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (checkfile)
|
||||
free(checkfile);
|
||||
- checkfile = get_hmac_file(selfname, params_lib->key.subdir);
|
||||
+ checkfile = get_hmac_file(selfname, params_lib->key.checkdir);
|
||||
if (!checkfile) {
|
||||
ret = -ENOMEM;
|
||||
goto out;
|
||||
@@ -799,6 +799,7 @@ int main(int argc, char *argv[])
|
||||
|
||||
char *checkfile = NULL;
|
||||
const char *targetfile = NULL;
|
||||
+ const char *checkdir = NULL;
|
||||
uint8_t *hmackey_alloc = NULL;
|
||||
uint8_t *hmackey_mmap = NULL;
|
||||
int opt_index = 0;
|
||||
@@ -1055,8 +1056,10 @@ int main(int argc, char *argv[])
|
||||
version(argv[0]);
|
||||
ret = 0;
|
||||
goto out;
|
||||
- case 'b':
|
||||
case 'd':
|
||||
+ checkdir = optarg;
|
||||
+ break;
|
||||
+ case 'b':
|
||||
case 'P':
|
||||
/* Compatibility options, just ignore */
|
||||
break;
|
||||
@@ -1110,7 +1113,7 @@ int main(int argc, char *argv[])
|
||||
targetfile = argv[optind];
|
||||
if (checkfile)
|
||||
free(checkfile);
|
||||
- checkfile = get_hmac_file(targetfile, params.key.subdir);
|
||||
+ checkfile = get_hmac_file(targetfile, params.key.checkdir);
|
||||
if (!checkfile) {
|
||||
ret = 1;
|
||||
goto out;
|
||||
@@ -1120,7 +1123,7 @@ int main(int argc, char *argv[])
|
||||
|
||||
if (!checkfile)
|
||||
ret = hash_files(¶ms, argv + optind, (argc - optind),
|
||||
- fipshmac, 0);
|
||||
+ fipshmac, checkdir, 0);
|
||||
else if (optind == argc)
|
||||
ret = process_checkfile(¶ms, checkfile, targetfile, loglevel);
|
||||
else {
|
||||
@ -75,23 +75,24 @@ lib_path=%{buildroot}/%{_lib} \
|
||||
for app in %{apps_hmaccalc}; do \
|
||||
test -e "$bin_path"/$app || continue \
|
||||
{ bin/kcapi-hasher -n sha512hmac "$bin_path"/$app || exit 1; } \\\
|
||||
| cut -f 1 -d ' ' >"$bin_path"/.$app.hmac \
|
||||
| cut -f 1 -d ' ' >"$lib_path"/hmaccalc/$app.hmac \
|
||||
done \
|
||||
for app in %{apps_fipscheck}; do \
|
||||
test -e "$bin_path"/$app || continue \
|
||||
bin/kcapi-hasher -n fipshmac "$bin_path"/$app || exit 1 \
|
||||
bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\
|
||||
"$bin_path"/$app || exit 1 \
|
||||
done \
|
||||
%{_sbindir}/hardlink -cfv %{buildroot}%{_bindir} \
|
||||
bin/kcapi-hasher -n fipshmac "$lib_path"/libkcapi.so.%{version} \\\
|
||||
|| exit 1 \
|
||||
%{__ln_s} .libkcapi.so.%{version}.hmac \\\
|
||||
"$lib_path"/.libkcapi.so.%{vmajor}.hmac \
|
||||
bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\
|
||||
"$lib_path"/libkcapi.so.%{version} || exit 1 \
|
||||
%{__ln_s} libkcapi.so.%{version}.hmac \\\
|
||||
"$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac \
|
||||
%{nil}
|
||||
|
||||
|
||||
Name: libkcapi
|
||||
Version: %{vmajor}.%{vminor}.%{vpatch}
|
||||
Release: 5%{?dist}
|
||||
Release: 6%{?dist}
|
||||
Summary: User space interface to the Linux Kernel Crypto API
|
||||
|
||||
License: BSD or GPLv2
|
||||
@ -101,6 +102,7 @@ Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc
|
||||
|
||||
Patch0: %{giturl}/pull/60.patch#/%{name}-1.1.1-kcapi-hasher_Fix_command-line_parsing.patch
|
||||
Patch1: %{giturl}/pull/61.patch#/%{name}-1.1.1-kcapi-hasher_Fix_off-by-one_error.patch
|
||||
Patch2: %{giturl}/pull/64.patch#/%{name}-1.1.1-kcapi-hasher_Add_missing_-d_option_to_fipshmac.patch
|
||||
|
||||
# Workaround for failing builds on rawhide (F29).
|
||||
# To be removed when this issue is patched in the kernel:
|
||||
@ -285,7 +287,7 @@ EOF
|
||||
--enable-kcapi-test \
|
||||
--enable-shared \
|
||||
--enable-static \
|
||||
--enable-sum-prefix=. \
|
||||
--enable-sum-dir=/%{_lib} \
|
||||
--with-pkgconfigdir=%{_libdir}/pkgconfig
|
||||
%make_build all doc
|
||||
|
||||
@ -371,8 +373,8 @@ popd
|
||||
%license COPYING*
|
||||
/%{_lib}/%{name}.so.%{vmajor}
|
||||
/%{_lib}/%{name}.so.%{version}
|
||||
/%{_lib}/.%{name}.so.%{vmajor}.hmac
|
||||
/%{_lib}/.%{name}.so.%{version}.hmac
|
||||
/%{_lib}/fipscheck/%{name}.so.%{vmajor}.hmac
|
||||
/%{_lib}/fipscheck/%{name}.so.%{version}.hmac
|
||||
%if %{with_sysctl_tweak}
|
||||
%doc %{_pkgdocdir}/README.%{distroname_ext}
|
||||
%{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf
|
||||
@ -396,21 +398,21 @@ popd
|
||||
%if %{with replace_coreutils}
|
||||
%files checksum
|
||||
%{_bindir}/md5sum
|
||||
%{_bindir}/.md5sum.hmac
|
||||
%{_bindir}/sha*sum
|
||||
%{_bindir}/.sha*sum.hmac
|
||||
/%{_lib}/fipscheck/md5sum.hmac
|
||||
/%{_lib}/fipscheck/sha*sum.hmac
|
||||
%endif
|
||||
|
||||
%if %{with replace_fipscheck}
|
||||
%files fipscheck
|
||||
%{_bindir}/fips*
|
||||
%{_bindir}/.fips*.hmac
|
||||
/%{_lib}/fipscheck/fips*.hmac
|
||||
%endif
|
||||
|
||||
%if %{with replace_hmaccalc}
|
||||
%files hmaccalc
|
||||
%{_bindir}/sha*hmac
|
||||
%{_bindir}/.sha*hmac.hmac
|
||||
/%{_lib}/hmaccalc/sha*hmac.hmac
|
||||
%endif
|
||||
|
||||
|
||||
@ -424,6 +426,9 @@ popd
|
||||
|
||||
|
||||
%changelog
|
||||
* Mon Jul 16 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-6
|
||||
- Put .hmac files into a separate directory
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.1-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user