Re: [PATCH] ima-evm-utils: Fix compatibility with LibreSSL

[Mimi Zohar <zohar@linux.ibm.com>]

On Sun, 2020-02-16 at 14:10 +0300, Mikhail Novosyolov wrote:
> LibreSSL in most cases can be used as a drop-in replacement of OpenSSL.
> Commit 07d799cb6c37 "ima-evm-utils: Preload OpenSSL engine via '--engine' option"
> added OpenSSL-specific functions: "engines" were removed from LibreSSL long ago.
> Instead of requiring to attach GOST support via an external library ("engine"),
> LibreSSL has build-in implementation of GOST.

OpenSSL had a builtin support for GOST, which was dropped.  From the
OpenSSL news "Changes between 1.0.2h and 1.1.0":

    The GOST engine was out of date and therefore it has been removed. An up
    to date GOST engine is now being maintained in an external repository.
    See:     https://wiki.openssl.org/index.php/Binaries    .  Libssl still retains
    support for GOST ciphersuites (these are only activated if a GOST engine
    is present).

Please update the patch description to reflect the reason for OpenSSL
dropping GOST builtin support, while LibreSSL continues to build it
in.

> Commit ebbfc41ad6ba "ima-evm-utils: try to load digest by its alias" is also not OK
> for LibreSSL because LibreSSL uses different digest names:
> md_gost12_256 -> streebog256
> md_gost12_512 -> streebog512
> 
> Example how it works when linked with LibreSSL:
> $ libressl dgst -streebog256 testfile
> streebog256(a)= 04123f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb
> $ evmctl -v ima_hash -a streebog256 testfile
> hash(streebog256): 04123f539a213e97c802cc229d474c6aa32a825a360b2a933a949fd925208d9ce1bb
> $ evmctl -v ima_hash -a md_gost12_256 testfile
> EVP_get_digestbyname(md_gost12_256) failed

Removing "engine support" is one logical change.  This sounds like it
is a separate issue and should be addressed in its own patch.

> 
> TODO: it would be nice to map
> md_gost12_256 <-> streebog256
> md_gost12_512 <-> streebog512
> in evmctl CLI arguements to make the same commands work on systems both
> where evmctl is linked with LibreSSL and with OpenSSL.
> 
> Fixes: 07d799cb6c37 ("ima-evm-utils: Preload OpenSSL engine via '--engine' option")
> Fixes: ebbfc41ad6ba ("ima-evm-utils: try to load digest by its alias")
> Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
> ---
>  README          |  2 +-
>  src/evmctl.c    | 15 ++++++++++++++-
>  src/libimaevm.c |  2 ++
>  3 files changed, 17 insertions(+), 2 deletions(-)
> 
> diff --git a/README b/README
> index 3603ae8..f843bbe 100644
> --- a/README
> +++ b/README
> @@ -58,7 +58,7 @@ OPTIONS
>        --smack        use extra SMACK xattrs for EVM
>        --m32          force EVM hmac/signature for 32 bit target system
>        --m64          force EVM hmac/signature for 64 bit target system
> -      --engine e     preload OpenSSL engine e (such as: gost)
> +      --engine e     preload OpenSSL engine e (such as: gost) (not valid for LibreSSL)
>    -v                 increase verbosity level
>    -h, --help         display this help and exit
>  
> diff --git a/src/evmctl.c b/src/evmctl.c
> index 3d2a10b..f6507c1 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -62,7 +62,10 @@
>  #include <openssl/hmac.h>
>  #include <openssl/err.h>
>  #include <openssl/rsa.h>
> +/* LibreSSL removed engines */
> +#ifndef LIBRESSL_VERSION_NUMBER
>  #include <openssl/engine.h>
> +#endif

According to the LibreSSL wiki, both OpenSSL and LibreSSL may be
installed on the same system in separate directories.  Instead of
using LIBRESSL_VERSION_NUMBER, consider defining an autotools option.

thanks,

Mimi

>  
>  #ifndef XATTR_APPAARMOR_SUFFIX
>  #define XATTR_APPARMOR_SUFFIX "apparmor"
> @@ -1849,7 +1852,9 @@ static void usage(void)
>          "      --selinux      use custom Selinux label for EVM\n"
>          "      --caps         use custom Capabilities for EVM(unspecified: from FS, empty: do not use)\n"
>          "      --list         measurement list verification\n"
> +#ifndef LIBRESSL_VERSION_NUMBER /* LibreSSL removed engines */
>          "      --engine e     preload OpenSSL engine e (such as: gost)\n"
> +#endif
>          "  -v                 increase verbosity level\n"
>          "  -h, --help         display this help and exit\n"
>          "\n");
> @@ -1902,7 +1907,9 @@ static struct option opts[] = {
>      {"selinux", 1, 0, 136},
>      {"caps", 2, 0, 137},
>      {"list", 0, 0, 138},
> +#ifndef LIBRESSL_VERSION_NUMBER
>      {"engine", 1, 0, 139},
> +#endif
>      {"xattr-user", 0, 0, 140},
>      {}
>  
> @@ -1947,7 +1954,9 @@ static char *get_password(void)
>  int main(int argc, char *argv[])
>  {
>      int err = 0, c, lind;
> +#ifndef LIBRESSL_VERSION_NUMBER
>      ENGINE *eng = NULL;
> +#endif
>  
>  #if !(OPENSSL_VERSION_NUMBER < 0x10100000)
>      OPENSSL_init_crypto(
> @@ -2065,7 +2074,8 @@ int main(int argc, char *argv[])
>          case 138:
>              measurement_list = 1;
>              break;
> -        case 139: /* --engine e */
> +#ifndef LIBRESSL_VERSION_NUMBER
> +        case 139: /* --engine e, only in OpenSSL, not in LibreSSL */
>              eng = ENGINE_by_id(optarg);
>              if (!eng) {
>                  log_err("engine %s isn't available\n", optarg);
> @@ -2078,6 +2088,7 @@ int main(int argc, char *argv[])
>              }
>              ENGINE_set_default(eng, ENGINE_METHOD_ALL);
>              break;
> +#endif
>          case 140: /* --xattr-user */
>              xattr_ima = "user.ima";
>              xattr_evm = "user.evm";
> @@ -2108,6 +2119,7 @@ int main(int argc, char *argv[])
>          }
>      }
>  
> +#ifndef LIBRESSL_VERSION_NUMBER
>      if (eng) {
>          ENGINE_finish(eng);
>          ENGINE_free(eng);
> @@ -2115,6 +2127,7 @@ int main(int argc, char *argv[])
>          ENGINE_cleanup();
>  #endif
>      }
> +#endif
>      ERR_free_strings();
>      EVP_cleanup();
>      BIO_free(NULL);
> diff --git a/src/libimaevm.c b/src/libimaevm.c
> index 7c17bf4..050ea78 100644
> --- a/src/libimaevm.c
> +++ b/src/libimaevm.c
> @@ -71,8 +71,10 @@ static const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
>      [PKEY_HASH_SHA384]    = "sha384",
>      [PKEY_HASH_SHA512]    = "sha512",
>      [PKEY_HASH_SHA224]    = "sha224",
> +#ifndef LIBRESSL_VERSION_NUMBER
>      [PKEY_HASH_STREEBOG_256] = "md_gost12_256",
>      [PKEY_HASH_STREEBOG_512] = "md_gost12_512",
> +#endif
>  };
>  
>  /* Names that are primary for the kernel. */