Re: [PATCH ima-evm-utils] Improve memory handling for private keys and passwords

[Vitaly Chikunov <vt@altlinux.org>]

Hi,

On Fri, Aug 13, 2021 at 12:21:43AM +0300, Vitaly Chikunov wrote:
> After CRYPTO_secure_malloc_init OpenSSL will store private keys in
> secure heap. This facility is only available since OpenSSL_1_1_0-pre1
> and enabled for 'ima_sign', 'sign', 'sign_hash', and 'hmac'.

> setvbuf(3) _IONBF is used to hopefully avoid private key and password
> being stored inside of stdio buffers.

I should note that usefulness of this method (of avoiding buffering) is
not proven. I don't find other implementations doing it. So, I'm open to
suggestion of removing it.

Thanks,

> 
> Unfortunately, secure heap is not used for the passwords (`-p') due to
> absence of its support in the older OpenSSL where ima-evem-utils still
> should work, thus simple cleansing of password memory is used where
> possible to shorten its lifespan.
> 
> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> ---
> Perhaps, it will conflict with Bruno's patch, we should decide which
> one goes first if this will be accepted.
> 
>  src/evmctl.c    | 83 ++++++++++++++++++++++++++++++++++++++++++++++---
>  src/libimaevm.c | 14 ++++++++-
>  2 files changed, 92 insertions(+), 5 deletions(-)