diff --git a/include/kernel_lib.h b/include/kernel_lib.h index 303f5283b276d56cb557e52d47ade21c96b2474d..ecfa1911f80d7b8da3fef7695b506751308db5da 100644 --- a/include/kernel_lib.h +++ b/include/kernel_lib.h @@ -233,6 +233,7 @@ enum evm_ima_xattr_type { EVM_IMA_XATTR_DIGSIG, IMA_XATTR_DIGEST_NG, EVM_XATTR_PORTABLE_DIGSIG, + EVM_IMA_XATTR_DIGEST_LIST, IMA_XATTR_LAST }; diff --git a/include/xattr.h b/include/xattr.h index abab131f39a76d1933fd8038a57978d8d5ad15b5..a3b21b595de951e7ca02735a6bf0edd2f84c0743 100644 --- a/include/xattr.h +++ b/include/xattr.h @@ -19,6 +19,7 @@ int write_ima_xattr(int dirfd, char *path, u8 *keyid, size_t keyid_len, u8 *sig, size_t sig_len, enum hash_algo algo); +int write_evm_xattr(char *path, enum hash_algo algo); int parse_ima_xattr(u8 *buf, size_t buf_len, u8 **keyid, size_t *keyid_len, u8 **sig, size_t *sig_len, enum hash_algo *algo); int read_ima_xattr(int dirfd, char *path, u8 **buf, size_t *buf_len, diff --git a/lib/xattr.c b/lib/xattr.c index b5e70959cde0976f16d5da43a497b85e28d679c0..9905885c431eb51630cb3fbfdcd0da375bcf6a4f 100644 --- a/lib/xattr.c +++ b/lib/xattr.c @@ -64,6 +64,23 @@ out: return ret; } +int write_evm_xattr(char *path, enum hash_algo algo) +{ + struct signature_v2_hdr hdr = { 0 }; + int ret; + + hdr.type = EVM_IMA_XATTR_DIGEST_LIST; + hdr.version = 2; + hdr.hash_algo = algo; + + ret = lsetxattr(path, XATTR_NAME_EVM, &hdr, + offsetof(struct signature_v2_hdr, keyid), 0); + if (ret < 0) + printf("Cannot add %s xattr\n", XATTR_NAME_EVM); + + return ret; +} + int parse_ima_xattr(u8 *buf, size_t buf_len, u8 **keyid, size_t *keyid_len, u8 **sig, size_t *sig_len, enum hash_algo *algo) { diff --git a/parsers/compact_tlv.c b/parsers/compact_tlv.c index 67ebb040a035589651feacd49eda6944ac5d2ce8..ee8bbca8dac4d04bc1230718c39eec098d0c63ca 100644 --- a/parsers/compact_tlv.c +++ b/parsers/compact_tlv.c @@ -35,7 +35,6 @@ int parser(int fd, struct list_head *head, loff_t size, void *buf, u8 evm_digest[SHA512_DIGEST_SIZE], *evm_digest_ptr; void *bufp = buf, *bufendp = buf + size; struct compact_list_hdr hdr, *hdrp; - u8 evm_xattr_value = EVM_XATTR_HMAC; int ret, i, j, count; while (bufp < bufendp) { @@ -222,9 +221,8 @@ int parser(int fd, struct list_head *head, loff_t size, void *buf, XATTR_NAME_IMA); break; case PARSER_OP_ADD_EVM_XATTR: - lsetxattr((char *)items_data(ID_PATH), - XATTR_NAME_EVM, &evm_xattr_value, 1, - 0); + write_evm_xattr((char *)items_data(ID_PATH), + hdr.algo); break; case PARSER_OP_REMOVE_EVM_XATTR: if (fs_magic == TMPFS_MAGIC) diff --git a/parsers/rpm.c b/parsers/rpm.c index 9aaba0f14c321ed1a2411b77ce7067206d741ede..70278c3a0cc2a777762e690c3e9462ce83f80b93 100644 --- a/parsers/rpm.c +++ b/parsers/rpm.c @@ -20,6 +20,7 @@ #include "parser_lib.h" #include "selinux.h" +#include "xattr.h" enum pgp_hash_algo { PGP_HASH_MD5 = 1, @@ -73,7 +74,6 @@ int parser(int fd, struct list_head *head, loff_t buf_size, void *buf, u8 digest[SHA512_DIGEST_SIZE]; u8 evm_digest[SHA512_DIGEST_SIZE]; char path[PATH_MAX]; - u8 evm_xattr_value = EVM_XATTR_HMAC; int ret = 0, i; const unsigned char rpm_header_magic[8] = { @@ -266,7 +266,7 @@ int parser(int fd, struct list_head *head, loff_t buf_size, void *buf, removexattr(path, XATTR_NAME_IMA); break; case PARSER_OP_ADD_EVM_XATTR: - lsetxattr(path, XATTR_NAME_EVM, &evm_xattr_value, 1, 0); + write_evm_xattr(path, algo); break; case PARSER_OP_REMOVE_EVM_XATTR: removexattr(path, XATTR_NAME_EVM);