* [PATCH] libimaevm: get key description out of verbose condition
@ 2018-11-30 20:04 Bruno E. O. Meneguele
2018-11-30 20:12 ` Bruno E. O. Meneguele
0 siblings, 1 reply; 2+ messages in thread
From: Bruno E. O. Meneguele @ 2018-11-30 20:04 UTC (permalink / raw)
To: linux-integrity; +Cc: zohar, dmitry.kasatkin
Key description in keyring is being filled with memory garbage during import
process if the LOG_LEVEL is not satisfied (using '-vv').
Testing in kernels without trusted keyring support, and importing a v1 (RSA) key
pair, the kernel fails to find the key since it looks for the key description,
which is not found due to this issue:
"digsig: key not found, id: DD0558FEB7DDBD26"
Looking at:
# keyctl show
Session Keyring
635748007 --alswrv 0 0 keyring: _ses
673181018 --alswrv 0 65534 \_ keyring: _uid.0
360651479 --alswrv 0 0 \_ keyring: _ima
499360916 --alswrv 0 0 | \_ user: .N=
266933436 --alswrv 0 0 | \_ user: B641632DA94DEE26
Key id 499360916 and 266933436 are both the same key, but the first was added
without '-vv' in the command line, while the second one was using it.
Signed-off-by: Bruno E. O. Meneguele <bmeneg@redhat.com>
---
src/libimaevm.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/src/libimaevm.c b/src/libimaevm.c
index 6fa0ed4..b6f9b9f 100644
--- a/src/libimaevm.c
+++ b/src/libimaevm.c
@@ -672,12 +672,11 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len
memcpy(keyid, sha1 + 12, 8);
log_debug("keyid: ");
log_debug_dump(keyid, 8);
+ id = __be64_to_cpup((__be64 *) keyid);
+ sprintf(str, "%llX", (unsigned long long)id);
- if (params.verbose > LOG_INFO) {
- id = __be64_to_cpup((__be64 *) keyid);
- sprintf(str, "%llX", (unsigned long long)id);
+ if (params.verbose > LOG_INFO)
log_info("keyid-v1: %s\n", str);
- }
}
void calc_keyid_v2(uint32_t *keyid, char *str, RSA *key)
@@ -694,11 +693,10 @@ void calc_keyid_v2(uint32_t *keyid, char *str, RSA *key)
memcpy(keyid, sha1 + 16, 4);
log_debug("keyid: ");
log_debug_dump(keyid, 4);
+ sprintf(str, "%x", __be32_to_cpup(keyid));
- if (params.verbose > LOG_INFO) {
- sprintf(str, "%x", __be32_to_cpup(keyid));
+ if (params.verbose > LOG_INFO)
log_info("keyid: %s\n", str);
- }
free(pkey);
}
--
2.19.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] libimaevm: get key description out of verbose condition
2018-11-30 20:04 [PATCH] libimaevm: get key description out of verbose condition Bruno E. O. Meneguele
@ 2018-11-30 20:12 ` Bruno E. O. Meneguele
0 siblings, 0 replies; 2+ messages in thread
From: Bruno E. O. Meneguele @ 2018-11-30 20:12 UTC (permalink / raw)
To: linux-integrity; +Cc: zohar, dmitry.kasatkin
[-- Attachment #1: Type: text/plain, Size: 2504 bytes --]
Ignore this patch, forgot to add "ima-evm-utils" as a prefix in the
subject line. I already sent a new patch with the correction.
Sorry for the noise.
On Fri, Nov 30, 2018 at 06:04:11PM -0200, Bruno E. O. Meneguele wrote:
> Key description in keyring is being filled with memory garbage during import
> process if the LOG_LEVEL is not satisfied (using '-vv').
>
> Testing in kernels without trusted keyring support, and importing a v1 (RSA) key
> pair, the kernel fails to find the key since it looks for the key description,
> which is not found due to this issue:
>
> "digsig: key not found, id: DD0558FEB7DDBD26"
>
> Looking at:
> # keyctl show
> Session Keyring
> 635748007 --alswrv 0 0 keyring: _ses
> 673181018 --alswrv 0 65534 \_ keyring: _uid.0
> 360651479 --alswrv 0 0 \_ keyring: _ima
> 499360916 --alswrv 0 0 | \_ user: .N=
> 266933436 --alswrv 0 0 | \_ user: B641632DA94DEE26
>
> Key id 499360916 and 266933436 are both the same key, but the first was added
> without '-vv' in the command line, while the second one was using it.
>
> Signed-off-by: Bruno E. O. Meneguele <bmeneg@redhat.com>
> ---
> src/libimaevm.c | 12 +++++-------
> 1 file changed, 5 insertions(+), 7 deletions(-)
>
> diff --git a/src/libimaevm.c b/src/libimaevm.c
> index 6fa0ed4..b6f9b9f 100644
> --- a/src/libimaevm.c
> +++ b/src/libimaevm.c
> @@ -672,12 +672,11 @@ void calc_keyid_v1(uint8_t *keyid, char *str, const unsigned char *pkey, int len
> memcpy(keyid, sha1 + 12, 8);
> log_debug("keyid: ");
> log_debug_dump(keyid, 8);
> + id = __be64_to_cpup((__be64 *) keyid);
> + sprintf(str, "%llX", (unsigned long long)id);
>
> - if (params.verbose > LOG_INFO) {
> - id = __be64_to_cpup((__be64 *) keyid);
> - sprintf(str, "%llX", (unsigned long long)id);
> + if (params.verbose > LOG_INFO)
> log_info("keyid-v1: %s\n", str);
> - }
> }
>
> void calc_keyid_v2(uint32_t *keyid, char *str, RSA *key)
> @@ -694,11 +693,10 @@ void calc_keyid_v2(uint32_t *keyid, char *str, RSA *key)
> memcpy(keyid, sha1 + 16, 4);
> log_debug("keyid: ");
> log_debug_dump(keyid, 4);
> + sprintf(str, "%x", __be32_to_cpup(keyid));
>
> - if (params.verbose > LOG_INFO) {
> - sprintf(str, "%x", __be32_to_cpup(keyid));
> + if (params.verbose > LOG_INFO)
> log_info("keyid: %s\n", str);
> - }
>
> free(pkey);
> }
> --
> 2.19.1
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-11-30 20:12 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-11-30 20:04 [PATCH] libimaevm: get key description out of verbose condition Bruno E. O. Meneguele
2018-11-30 20:12 ` Bruno E. O. Meneguele
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.