From: Mimi Zohar <zohar@linux.ibm.com>
To: linux-integrity@vger.kernel.org
Cc: Stefan Berger <stefanb@linux.ibm.com>, Mimi Zohar <zohar@linux.ibm.com>
Subject: [ima-evm-utils PATCH v2 00/13] Address non concurrency-safe libimaevm global variables
Date: Wed, 6 Dec 2023 14:27:21 -0500 [thread overview]
Message-ID: <20231206192734.339999-1-zohar@linux.ibm.com> (raw)
The libimaevm global variables are not concurrency-safe. Instead of
relying on global variables, define new functions with these variables
as parameters, update static functions definitions with these variables,
and deprecate existing functions. The change is limited to public keys,
hash algorithm, and key password.
To avoid library incompatability, make the existing functions wrappers
for the new function versions and deprecate existing functions.
Changelog v2:
Addressed Stefan Berger's comments:
- Prefix the new library functions to avoid namespace pollution.
- Define internal library function 'public_keys' as struct
public_key_entry, not void.
- Prefix new static global variables with 'g_'.
- Annotate deprecated functions with "__attribute__(deprecated)".
- init_public_keys() function was defined as void. The new
imaevm_init_public_keys() function is defined as an int. Check the
return value.
- Update sign_{ima,evm} function definitions to include the hash
algorithm as a paramater.
- Added Stefan's "Reviewed-by" tag.
Mimi Zohar (13):
Rename "public_keys" to "g_public_keys"
Free public keys list
Update library function definitions to include a "public_keys"
parameter
Update imaevm_verify_hash() definition to include "hash_algo"
parameter
Update cmd_verify_ima() to define and use a local list of public keys
Update cmd_verify_evm to define and use a local list of public keys
Update ima_measurements to define and use a local list of public keys
Define library ima_calc_hash2() function with a hash algorithm
parameter
Use a local hash algorithm variable when verifying file signatures
Update EVM signature verification to use a local hash algorithm
variable
Use a file specific hash algorithm variable for signing files
Update sign_hash_v*() definition to include the key password
Define and use a file specific "keypass" variable
src/evmctl.c | 135 ++++++++++++++++++++++++++----------------
src/imaevm.h | 9 +++
src/libimaevm.c | 153 +++++++++++++++++++++++++++++++++++-------------
3 files changed, 205 insertions(+), 92 deletions(-)
--
2.39.3
next reply other threads:[~2023-12-06 19:28 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-06 19:27 Mimi Zohar [this message]
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 01/13] Rename "public_keys" to "g_public_keys" Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 02/13] Free public keys list Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 03/13] Update library function definitions to include a "public_keys" parameter Mimi Zohar
2024-01-02 13:11 ` Stefan Berger
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 04/13] Update imaevm_verify_hash() definition to include "hash_algo" parameter Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 05/13] Update cmd_verify_ima() to define and use a local list of public keys Mimi Zohar
2024-01-02 13:18 ` Stefan Berger
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 06/13] Update cmd_verify_evm " Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 07/13] Update ima_measurements " Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 08/13] Define library ima_calc_hash2() function with a hash algorithm parameter Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 09/13] Use a local hash algorithm variable when verifying file signatures Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 10/13] Update EVM signature verification to use a local hash algorithm variable Mimi Zohar
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 11/13] Use a file specific hash algorithm variable for signing files Mimi Zohar
2024-01-02 13:42 ` Stefan Berger
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 12/13] Update sign_hash_v*() definition to include the key password Mimi Zohar
2024-01-02 13:44 ` Stefan Berger
2023-12-06 19:27 ` [ima-evm-utils PATCH v2 13/13] Define and use a file specific "keypass" variable Mimi Zohar
2024-01-02 13:46 ` Stefan Berger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231206192734.339999-1-zohar@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=linux-integrity@vger.kernel.org \
--cc=stefanb@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox