Re: [ima-evm-utils PATCH v2 05/13] Update cmd_verify_ima() to define and use a local list of public keys

Stefan Berger
2024-01-02T13:18:28Z

On 12/6/23 14:27, Mimi Zohar wrote:
> Update the static verify_ima() function definition to include
> "public_keys".
>
> Replace calling init_public_keys() with the imaevm_init_public_keys()
> version. Similarly replace ima_verify_signature() with the
> ima_verify_signature2() version.
>
> Free the local public keys list.
>
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> src/evmctl.c | 29 +++++++++++++++++++----------
> 1 file changed, 19 insertions(+), 10 deletions(-)
>
> diff --git a/src/evmctl.c b/src/evmctl.c
> index 2710a27cb305..3ae79262efbb 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -972,7 +972,7 @@ static int cmd_verify_evm(struct command *cmd)
> return err;
> }
>
> -static int verify_ima(const char *file) > +static int verify_ima(void *public_keys, const char *file)

Use struct public_key_entry *.

> {
> unsigned char sig[MAX_SIGNATURE_SIZE];
> int len;
> @@ -999,34 +999,43 @@ static int verify_ima(const char *file)
> }
> }
>
> - return ima_verify_signature(file, sig, len, NULL, 0);
> + return ima_verify_signature2(public_keys, file, sig, len, NULL, 0);
> }
>
> static int cmd_verify_ima(struct command *cmd)
> {
> char *file = g_argv[optind++];
> + void *public_keys = NULL;

Use struct public_key_entry *.

> int err, fails = 0;
>
> - if (imaevm_params.x509) {
> - if (imaevm_params.keyfile) /* Support multiple public keys */
> - init_public_keys(imaevm_params.keyfile);
> - else /* assume read pubkey from x509 cert */
> - init_public_keys("/etc/keys/x509_evm.der");
> - }
> -
> if (!file) {
> log_err("Parameters missing\n");
> print_usage(cmd);
> return -1;
> }
>
> + if (imaevm_params.x509) {
> + if (imaevm_params.keyfile) /* Support multiple public keys */
> + err = imaevm_init_public_keys(imaevm_params.keyfile,
> + &public_keys);
> + else /* assume read pubkey from x509 cert */
> + err = imaevm_init_public_keys("/etc/keys/x509_evm.der",
> + &public_keys);
> + if (err < 0) {
> + log_info("Failed loading public keys");
> + return err;
> + }
> + }
> +
> do {
> - err = verify_ima(file);
> + err = verify_ima(public_keys, file);
> if (err)
> fails++;
> if (!err && imaevm_params.verbose >= LOG_INFO)
> log_info("%s: verification is OK\n", file);
> } while ((file = g_argv[optind++]));
> +
> + imaevm_free_public_keys(public_keys);
> return fails > 0;
> }
>

Rest LGTM.