Re: [PATCH v3 ima-evm-utils 1/2] set default hash algorithm in configuration time

[Bruno Meneguele <bmeneg@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2589 bytes --]

On Fri, Aug 20, 2021 at 07:49:16PM -0300, Bruno Meneguele wrote:
> The default hash algorithm for evmctl is today hardcoded at libimaevm.c
> file. To facilitate different distributions and users to set their own
> default hash algorithm this patch adds the --with-default-hash=<algo> option
> to the configuration script.
> 
> The algorithm chosen by the user will then be checked if is available in the
> kernel, otherwise IMA won't be able to verify files hashed by the user. For
> that, the file exposed by the kernel crypto API (/proc/crypto) is filtered
> by an AWK script in order to check the algorithm's name and the module
> providing it. Initally, only "module: kernel" is accepted, following IMA's
> CONFIG_CRYPTO_SHA1/SHA256 dependency.
> 
> Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
> ---
>  README                  |  2 +-
>  configure.ac            |  1 +
>  m4/default-hash-algo.m4 | 48 +++++++++++++++++++++++++++++++++++++++++
>  src/evmctl.c            |  4 ++--
>  src/imaevm.h            |  4 ++++
>  src/libimaevm.c         |  2 +-
>  6 files changed, 57 insertions(+), 4 deletions(-)
>  create mode 100644 m4/default-hash-algo.m4
> 
> diff --git a/README b/README
> index 87cd3b5cd7da..4e35826cd982 100644
> --- a/README
> +++ b/README
> @@ -41,7 +41,7 @@ COMMANDS
>  OPTIONS
>  -------
>  
> -  -a, --hashalgo     sha1 (default), sha224, sha256, sha384, sha512
> +  -a, --hashalgo     sha1, sha224, sha256, sha384, sha512
>    -s, --imasig       make IMA signature
>    -d, --imahash      make IMA hash
>    -f, --sigfile      store IMA signature in .sig file instead of xattr
> diff --git a/configure.ac b/configure.ac
> index a2d91b3db202..1c45f7f757ea 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -62,6 +62,7 @@ else
>  fi
>  
>  EVMCTL_MANPAGE_DOCBOOK_XSL
> +AX_DEFAULT_HASH_ALGO
>  
>  # for gcov
>  #CFLAGS="$CFLAGS -Wall -fprofile-arcs -ftest-coverage"
> diff --git a/m4/default-hash-algo.m4 b/m4/default-hash-algo.m4
> new file mode 100644
> index 000000000000..14be44731ba6
> --- /dev/null
> +++ b/m4/default-hash-algo.m4
> @@ -0,0 +1,48 @@
> +dnl Copyright (c) 2021 Bruno Meneguele <bmeneg@redhat.com>
> +dnl Check hash algorithm availability in the kernel
> +dnl
> +dnl $1 = hash algorithm passed through --with-default-hash=<algo>
> +

^ this comment is useless here. At first I was keeping the AC_ARG_WITH()
outside the function and passing the result to that later.

I'm going to send a v4 removing this comment.

-- 
bmeneg 
PGP Key: http://bmeneg.com/pubkey.txt

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]