[PATCH 1/2] ima-evm-utils: Fix reading of sigfile

[PATCH 1/2] ima-evm-utils: Fix reading of sigfile

[Vitaly Chikunov]

Fix reading of detached IMA signature (--sigfile). Error message:

  Reading to sha1.txt.sig
  Failed to fread 147 bytes: sha1.txt.sig
  Failed reading: sha1.txt

Reported-by: Mimi Zohar <zohar@linux.ibm.com>
Fixes: 08a51e7460fd ("ima-evm-utils: Fix file2bin stat and fopen relations")
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
---
 src/evmctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/evmctl.c b/src/evmctl.c
index 7ad1150..2359550 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -221,7 +221,7 @@ static unsigned char *file2bin(const char *file, const char *ext, int *size)
 		fclose(fp);
 		return NULL;
 	}
-	if (fread(data, len, 1, fp) != len) {
+	if (fread(data, len, 1, fp) != 1) {
 		log_err("Failed to fread %zu bytes: %s\n", len, name);
 		fclose(fp);
 		free(data);
-- 
2.11.0

[PATCH 2/2] ima-evm-utils: Add test for sigfile reading

[Vitaly Chikunov]

Test reading of detached IMA signature (--sigfile).

Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
---
 tests/sign_verify.test | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/sign_verify.test b/tests/sign_verify.test
index 118c3f6..cddeb15 100755
--- a/tests/sign_verify.test
+++ b/tests/sign_verify.test
@@ -93,7 +93,8 @@ _test_sigfile() {
     return "$FAIL"
   fi
 
-  rm "$file_sig" "$file_sig2"
+  # Leave '$file_sig' for ima_verify --sigfile test.
+  rm "$file_sig2"
 }
 
 # Run single sign command
@@ -254,9 +255,12 @@ sign_verify() {
 
     # Normal verify with proper key should pass
     expect_pass check_verify
+    expect_pass check_verify OPTS="--sigfile"
 
     # Multiple files and some don't verify
     expect_fail check_verify FILE="/dev/null $file"
+
+    rm "$FILE.sig"
   fi
 
   TYPE=evm
-- 
2.11.0

Re: [PATCH 2/2] ima-evm-utils: Add test for sigfile reading

[Mimi Zohar]

On Sat, 2020-09-12 at 22:36 +0300, Vitaly Chikunov wrote:
> Test reading of detached IMA signature (--sigfile).
> 
> Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>

Thanks,

Mimi

> ---
>  tests/sign_verify.test | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/tests/sign_verify.test b/tests/sign_verify.test
> index 118c3f6..cddeb15 100755
> --- a/tests/sign_verify.test
> +++ b/tests/sign_verify.test
> @@ -93,7 +93,8 @@ _test_sigfile() {
>      return "$FAIL"
>    fi
>  
> -  rm "$file_sig" "$file_sig2"
> +  # Leave '$file_sig' for ima_verify --sigfile test.
> +  rm "$file_sig2"
>  }
>  
>  # Run single sign command
> @@ -254,9 +255,12 @@ sign_verify() {
>  
>      # Normal verify with proper key should pass
>      expect_pass check_verify
> +    expect_pass check_verify OPTS="--sigfile"
>  
>      # Multiple files and some don't verify
>      expect_fail check_verify FILE="/dev/null $file"
> +
> +    rm "$FILE.sig"
>    fi
>  
>    TYPE=evm