1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
|
From: Sascha Hauer <s.hauer@pengutronix.de>
Date: Mon, 1 Dec 2014 15:23:21 +0100
Subject: [PATCH] evmctl: add support for offline image preparation
With this patch it's possible to sign a directory hierarchy, so that a
filesystem image (e.g. an ubifs) can be generated.
Creating the ima and evm signatues for an images with evmctl has to problems:
1) The inode-numbers of the files are different in the to be created image and
in the current filesystem.
2) The inode generation can be different, too.
These problems are solved in a 4-step process:
1) evmctl generates signatures and writes them to the extended attributed
(the usual process so far).
2) The image, for example an ubifs image, is generted. mkfs.ubifs generates
the image (including extended attributes) and stores the used inode number
in an extended attribute "user.image-inode-number".
3) evmct is started again to generate the signatures, this time with the
additional paramter "--image". Instead of using an ioctl to get the inode
number and generation, the inode is read from the extended attribute
"user.image-inode-number", the generation is set to "0".
4) The image (omitting the exteneded attribute "user.image-inode-number") is
generated.
This patch adds the command line parameter "--image" to read the inode number
from the extended attribute "user.image-inode-number" instead of using an
ioctl(). The inode generation is set to 0, too.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
src/evmctl.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++--------
src/imaevm.h | 1 +
src/libimaevm.c | 25 ++++++++++++++++++++++++-
3 files changed, 74 insertions(+), 9 deletions(-)
diff --git a/src/evmctl.c b/src/evmctl.c
index 6606e4958080..d66e6b06ad23 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -314,6 +314,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
char uuid[16];
struct h_misc_64 hmac_misc;
int hmac_size;
+ ino_t ino;
if (lstat(file, &st)) {
log_err("Failed to stat: %s\n", file);
@@ -336,9 +337,25 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
}
close(fd);
}
- log_info("generation: %u\n", generation);
}
+ if (params.image_mode) {
+ char buf[128] = { };
+
+ err = lgetxattr(file, "user.image-inode-number", buf, sizeof(buf) - 1);
+ if (err < 0) {
+ log_err("image mode: xattr 'user.image-inode-number' not found.\n");
+ return -1;
+ }
+ ino = strtoull(buf, NULL, 10);
+ generation = 0;
+ } else {
+ ino = st.st_ino;
+ }
+
+ log_info("inode-number: %llu\n", (unsigned long long)ino);
+ log_info("generation: %u\n", generation);
+
list_size = llistxattr(file, list, sizeof(list));
if (list_size < 0) {
log_err("llistxattr() failed\n");
@@ -384,7 +401,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
struct h_misc *hmac = (struct h_misc *)&hmac_misc;
hmac_size = sizeof(*hmac);
- hmac->ino = st.st_ino;
+ hmac->ino = ino;
hmac->generation = generation;
hmac->uid = st.st_uid;
hmac->gid = st.st_gid;
@@ -393,7 +410,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
struct h_misc_64 *hmac = (struct h_misc_64 *)&hmac_misc;
hmac_size = sizeof(*hmac);
- hmac->ino = st.st_ino;
+ hmac->ino = ino;
hmac->generation = generation;
hmac->uid = st.st_uid;
hmac->gid = st.st_gid;
@@ -402,7 +419,7 @@ static int calc_evm_hash(const char *file, unsigned char *hash)
struct h_misc_32 *hmac = (struct h_misc_32 *)&hmac_misc;
hmac_size = sizeof(*hmac);
- hmac->ino = st.st_ino;
+ hmac->ino = ino;
hmac->generation = generation;
hmac->uid = st.st_uid;
hmac->gid = st.st_gid;
@@ -855,6 +872,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
ssize_t list_size;
struct h_misc_64 hmac_misc;
int hmac_size;
+ ino_t ino;
key = file2bin(keyfile, NULL, &keylen);
if (!key) {
@@ -892,10 +910,26 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
close(fd);
}
+ if (params.image_mode) {
+ char buf[128] = { };
+
+ err = lgetxattr(file, "user.image-inode-number", buf, sizeof(buf) - 1);
+ if (err < 0) {
+ log_err("image mode: xattr 'user.image-inode-number' not found.\n");
+ goto out;
+ }
+ ino = strtoull(buf, NULL, 10);
+ generation = 0;
+ } else {
+ ino = st.st_ino;
+ }
+
+ log_info("inode-number: %llu\n", (unsigned long long)ino);
log_info("generation: %u\n", generation);
list_size = llistxattr(file, list, sizeof(list));
if (list_size <= 0) {
+ err = -1;
log_err("llistxattr() failed: %s\n", file);
goto out;
}
@@ -932,7 +966,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
struct h_misc *hmac = (struct h_misc *)&hmac_misc;
hmac_size = sizeof(*hmac);
- hmac->ino = st.st_ino;
+ hmac->ino = ino;
hmac->generation = generation;
hmac->uid = st.st_uid;
hmac->gid = st.st_gid;
@@ -941,7 +975,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
struct h_misc_64 *hmac = (struct h_misc_64 *)&hmac_misc;
hmac_size = sizeof(*hmac);
- hmac->ino = st.st_ino;
+ hmac->ino = ino;
hmac->generation = generation;
hmac->uid = st.st_uid;
hmac->gid = st.st_gid;
@@ -950,7 +984,7 @@ static int calc_evm_hmac(const char *file, const char *keyfile, unsigned char *h
struct h_misc_32 *hmac = (struct h_misc_32 *)&hmac_misc;
hmac_size = sizeof(*hmac);
- hmac->ino = st.st_ino;
+ hmac->ino = ino;
hmac->generation = generation;
hmac->uid = st.st_uid;
hmac->gid = st.st_gid;
@@ -1469,6 +1503,9 @@ static void usage(void)
" --smack use extra SMACK xattrs for EVM\n"
" --m32 force EVM hmac/signature for 32 bit target system\n"
" --m64 force EVM hmac/signature for 64 bit target system\n"
+ " -m, --image image generation mode:\n"
+ " Read inode number from xattr 'user.image-inode-number',\n"
+ " and force inode generation to 0.\n"
" -v increase verbosity level\n"
" -h, --help display this help and exit\n"
"\n");
@@ -1507,6 +1544,7 @@ static struct option opts[] = {
{"recursive", 0, 0, 'r'},
{"m32", 0, 0, '3'},
{"m64", 0, 0, '6'},
+ {"image", 0, 0, 'm'},
{"smack", 0, 0, 256},
{"version", 0, 0, 257},
{}
@@ -1555,7 +1593,7 @@ int main(int argc, char *argv[])
g_argc = argc;
while (1) {
- c = getopt_long(argc, argv, "hvnsda:p::fu::k:t:ri", opts, &lind);
+ c = getopt_long(argc, argv, "hvnsda:p::fu::k:t:rim", opts, &lind);
if (c == -1)
break;
@@ -1619,6 +1657,9 @@ int main(int argc, char *argv[])
case '6':
msize = 64;
break;
+ case 'm':
+ params.image_mode = true;
+ break;
case 256:
evm_config_xattrnames = evm_extra_smack_xattrs;
break;
diff --git a/src/imaevm.h b/src/imaevm.h
index 711596c3f3fa..84632a487074 100644
--- a/src/imaevm.h
+++ b/src/imaevm.h
@@ -180,6 +180,7 @@ struct libevm_params {
const char *hash_algo;
const char *keyfile;
const char *keypass;
+ bool image_mode;
};
struct RSA_ASN1_template {
diff --git a/src/libimaevm.c b/src/libimaevm.c
index 575f0535fe07..6b81e7e2d7aa 100644
--- a/src/libimaevm.c
+++ b/src/libimaevm.c
@@ -40,6 +40,7 @@
/* should we use logger instead for library? */
#define USE_FPRINTF
+#define _GNU_SOURCE
#include <sys/types.h>
#include <sys/param.h>
@@ -49,6 +50,7 @@
#include <dirent.h>
#include <string.h>
#include <stdio.h>
+#include <attr/xattr.h>
#include <openssl/pem.h>
#include <openssl/evp.h>
@@ -222,7 +224,28 @@ static int add_dir_hash(const char *file, EVP_MD_CTX *ctx)
}
while ((de = readdir(dir))) {
- ino = de->d_ino;
+ if (params.image_mode) {
+ char *name;
+ char buf[128] = { };
+
+ err = asprintf(&name, "%s/%s", file, de->d_name);
+ if (err == -1) {
+ log_err("failed to allocate mem\n");
+ return err;
+ }
+
+ err = lgetxattr(file, "user.image-inode-number", buf, sizeof(buf) - 1);
+ if (err < 0) {
+ log_err("image mode: xattr 'user.image-inode-number' not found.\n");
+ return -1;
+ }
+ ino = strtoull(buf, NULL, 10);
+
+ free(name);
+ } else {
+ ino = de->d_ino;
+ }
+
off = de->d_off;
type = de->d_type;
log_debug("entry: %s, ino: %llu, type: %u, off: %llu, reclen: %hu\n",
|
