179 lines
6.2 KiB
Diff
179 lines
6.2 KiB
Diff
From 5d257019cb4de4681e60f6e15bf2c1be73275b9c Mon Sep 17 00:00:00 2001
|
|
From: Petr Lautrbach <plautrba@redhat.com>
|
|
Date: Fri, 30 Jul 2021 14:14:37 +0200
|
|
Subject: [PATCH] Use SHA-2 instead of SHA-1
|
|
Content-type: text/plain
|
|
|
|
The use of SHA-1 in RHEL9 is deprecated
|
|
---
|
|
policycoreutils/setfiles/restorecon.8 | 10 +++++-----
|
|
policycoreutils/setfiles/restorecon_xattr.8 | 8 ++++----
|
|
policycoreutils/setfiles/restorecon_xattr.c | 12 ++++++------
|
|
policycoreutils/setfiles/setfiles.8 | 10 +++++-----
|
|
4 files changed, 20 insertions(+), 20 deletions(-)
|
|
|
|
diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
|
|
index c3cc5c9b0e52..6160aced5922 100644
|
|
--- a/policycoreutils/setfiles/restorecon.8
|
|
+++ b/policycoreutils/setfiles/restorecon.8
|
|
@@ -95,14 +95,14 @@ display usage information and exit.
|
|
ignore files that do not exist.
|
|
.TP
|
|
.B \-I
|
|
-ignore digest to force checking of labels even if the stored SHA1 digest
|
|
-matches the specfiles SHA1 digest. The digest will then be updated provided
|
|
+ignore digest to force checking of labels even if the stored SHA256 digest
|
|
+matches the specfiles SHA256 digest. The digest will then be updated provided
|
|
there are no errors. See the
|
|
.B NOTES
|
|
section for further details.
|
|
.TP
|
|
.B \-D
|
|
-Set or update any directory SHA1 digests. Use this option to
|
|
+Set or update any directory SHA256 digests. Use this option to
|
|
enable usage of the
|
|
.IR security.sehash
|
|
extended attribute.
|
|
@@ -200,7 +200,7 @@ the
|
|
.B \-D
|
|
option to
|
|
.B restorecon
|
|
-will cause it to store a SHA1 digest of the default specfiles set in an extended
|
|
+will cause it to store a SHA256 digest of the default specfiles set in an extended
|
|
attribute named
|
|
.IR security.sehash
|
|
on each directory specified in
|
|
@@ -217,7 +217,7 @@ for further details.
|
|
.sp
|
|
The
|
|
.B \-I
|
|
-option will ignore the SHA1 digest from each directory specified in
|
|
+option will ignore the SHA256 digest from each directory specified in
|
|
.IR pathname \ ...
|
|
and provided the
|
|
.B \-n
|
|
diff --git a/policycoreutils/setfiles/restorecon_xattr.8 b/policycoreutils/setfiles/restorecon_xattr.8
|
|
index 51d12a4dbb80..09bfd8c40ab4 100644
|
|
--- a/policycoreutils/setfiles/restorecon_xattr.8
|
|
+++ b/policycoreutils/setfiles/restorecon_xattr.8
|
|
@@ -23,7 +23,7 @@ or
|
|
|
|
.SH "DESCRIPTION"
|
|
.B restorecon_xattr
|
|
-will display the SHA1 digests added to extended attributes
|
|
+will display the SHA256 digests added to extended attributes
|
|
.I security.sehash
|
|
or delete the attribute completely. These attributes are set by
|
|
.BR restorecon (8)
|
|
@@ -48,12 +48,12 @@ extended attribute and are automatically excluded from searches.
|
|
.sp
|
|
By default
|
|
.B restorecon_xattr
|
|
-will display the SHA1 digests with "Match" appended if they match the default
|
|
+will display the SHA256 digests with "Match" appended if they match the default
|
|
specfile set or the
|
|
.I specfile
|
|
set used with the
|
|
.B \-f
|
|
-option. Non-matching SHA1 digests will be displayed with "No Match" appended.
|
|
+option. Non-matching SHA256 digests will be displayed with "No Match" appended.
|
|
This feature can be disabled by the
|
|
.B \-n
|
|
option.
|
|
@@ -87,7 +87,7 @@ Do not append "Match" or "No Match" to displayed digests.
|
|
recursively descend directories.
|
|
.TP
|
|
.B \-v
|
|
-display SHA1 digest generated by specfile set (Note that this digest is not
|
|
+display SHA256 digest generated by specfile set (Note that this digest is not
|
|
used to match the
|
|
.I security.sehash
|
|
directory digest entries, and is shown for reference only).
|
|
diff --git a/policycoreutils/setfiles/restorecon_xattr.c b/policycoreutils/setfiles/restorecon_xattr.c
|
|
index 31fb82fd2099..bc22d3fd4560 100644
|
|
--- a/policycoreutils/setfiles/restorecon_xattr.c
|
|
+++ b/policycoreutils/setfiles/restorecon_xattr.c
|
|
@@ -38,7 +38,7 @@ int main(int argc, char **argv)
|
|
unsigned int xattr_flags = 0, delete_digest = 0, recurse = 0;
|
|
unsigned int delete_all_digests = 0, ignore_mounts = 0;
|
|
bool display_digest = false;
|
|
- char *sha1_buf, **specfiles, *fc_file = NULL, *pathname = NULL;
|
|
+ char *sha256_buf, **specfiles, *fc_file = NULL, *pathname = NULL;
|
|
unsigned char *fc_digest = NULL;
|
|
size_t i, fc_digest_len = 0, num_specfiles;
|
|
|
|
@@ -133,8 +133,8 @@ int main(int argc, char **argv)
|
|
exit(-1);
|
|
}
|
|
|
|
- sha1_buf = malloc(fc_digest_len * 2 + 1);
|
|
- if (!sha1_buf) {
|
|
+ sha256_buf = malloc(fc_digest_len * 2 + 1);
|
|
+ if (!sha256_buf) {
|
|
fprintf(stderr,
|
|
"Error allocating digest buffer: %s\n",
|
|
strerror(errno));
|
|
@@ -143,16 +143,16 @@ int main(int argc, char **argv)
|
|
}
|
|
|
|
for (i = 0; i < fc_digest_len; i++)
|
|
- sprintf((&sha1_buf[i * 2]), "%02x", fc_digest[i]);
|
|
+ sprintf((&sha256_buf[i * 2]), "%02x", fc_digest[i]);
|
|
|
|
- printf("specfiles SHA1 digest: %s\n", sha1_buf);
|
|
+ printf("specfiles SHA256 digest: %s\n", sha256_buf);
|
|
|
|
printf("calculated using the following specfile(s):\n");
|
|
if (specfiles) {
|
|
for (i = 0; i < num_specfiles; i++)
|
|
printf("%s\n", specfiles[i]);
|
|
}
|
|
- free(sha1_buf);
|
|
+ free(sha256_buf);
|
|
printf("\n");
|
|
}
|
|
|
|
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
|
|
index ee01725050bb..57c663a99d67 100644
|
|
--- a/policycoreutils/setfiles/setfiles.8
|
|
+++ b/policycoreutils/setfiles/setfiles.8
|
|
@@ -95,14 +95,14 @@ display usage information and exit.
|
|
ignore files that do not exist.
|
|
.TP
|
|
.B \-I
|
|
-ignore digest to force checking of labels even if the stored SHA1 digest
|
|
-matches the specfiles SHA1 digest. The digest will then be updated provided
|
|
+ignore digest to force checking of labels even if the stored SHA256 digest
|
|
+matches the specfiles SHA256 digest. The digest will then be updated provided
|
|
there are no errors. See the
|
|
.B NOTES
|
|
section for further details.
|
|
.TP
|
|
.B \-D
|
|
-Set or update any directory SHA1 digests. Use this option to
|
|
+Set or update any directory SHA256 digests. Use this option to
|
|
enable usage of the
|
|
.IR security.sehash
|
|
extended attribute.
|
|
@@ -261,7 +261,7 @@ the
|
|
.B \-D
|
|
option to
|
|
.B setfiles
|
|
-will cause it to store a SHA1 digest of the
|
|
+will cause it to store a SHA256 digest of the
|
|
.B spec_file
|
|
set in an extended attribute named
|
|
.IR security.sehash
|
|
@@ -282,7 +282,7 @@ for further details.
|
|
.sp
|
|
The
|
|
.B \-I
|
|
-option will ignore the SHA1 digest from each directory specified in
|
|
+option will ignore the SHA256 digest from each directory specified in
|
|
.IR pathname \ ...
|
|
and provided the
|
|
.B \-n
|
|
--
|
|
2.41.0
|
|
|