The libimaevm global variables are not concurrency-safe. Instead of
relying on global variables, define new functions with these variables
as parameters, update static functions definitions with these variables,
and deprecate existing functions. The change is limited to public keys,
hash algorithm, and key password.
To avoid library incompatability, make the existing functions wrappers
for the new function versions and deprecate existing functions.
The deprecated function warnings can be disabled by specifying
'-Wno-deprecated-declarations'. Allow suppressing just the libimevm
warnings by enabling IMAEVM_SUPPRESS_DEPRECATED.
e.g. configure CFLAGS="-DIMAEVM_SUPPRESS_DEPRECATED"
Changelog v3:
Addressed Stefan Berger's comments:
- Forward declare "struct public_key_entry" in order to replace
"void *public_key" usage.
- Move the "__attribute__((deprecated))" from the functions to the function
definitions.
- Allow suppressing just the libimevm deprecated warngings by defining
and enabling "-DIMAEVM_SUPPRESS_DEPRECATED".
- Add "Reviewed-by" tags.
Changelog v2:
Addressed Stefan Berger's comments:
- Prefix the new library functions to avoid namespace pollution.
- Define internal library function 'public_keys' as struct
public_key_entry, not void.
- Prefix new static global variables with 'g_'.
- Annotate deprecated functions with "__attribute__(deprecated)".
- init_public_keys() function was defined as void. The new
imaevm_init_public_keys() function is defined as an int. Check the
return value.
- Update sign_{ima,evm} function definitions to include the hash
algorithm as a paramater.
- Added Stefan's "Reviewed-by" tag.
Mimi Zohar (13):
Rename "public_keys" to "g_public_keys"
Free public keys list
Update library function definitions to include a "public_keys"
parameter
Update imaevm_verify_hash() definition to include "hash_algo"
parameter
Update cmd_verify_ima() to define and use a local list of public keys
Update cmd_verify_evm to define and use a local list of public keys
Update ima_measurements to define and use a local list of public keys
Define library ima_calc_hash2() function with a hash algorithm
parameter
Use a local hash algorithm variable when verifying file signatures
Update EVM signature verification to use a local hash algorithm
variable
Use a file specific hash algorithm variable for signing files
Update sign_hash_v*() definition to include the key password
Define and use a file specific "keypass" variable
src/evmctl.c | 136 +++++++++++++++++++++++++++-----------------
src/imaevm.h | 29 ++++++++--
src/libimaevm.c | 148 +++++++++++++++++++++++++++++++++++-------------
3 files changed, 218 insertions(+), 95 deletions(-)
--
2.39.3
