doczkal / rpms / abrt

Forked from rpms/abrt 4 years ago
Clone

Blame SOURCES/0214-Save-Vendor-and-GPG-Fingerprint.patch

b225ea
From 95ea12b9a4be68cc25f0811e693c7a024b5e3d4b Mon Sep 17 00:00:00 2001
b225ea
From: Matej Habrnal <mhabrnal@redhat.com>
b225ea
Date: Tue, 9 Feb 2016 16:53:21 +0100
b225ea
Subject: [PATCH] Save Vendor and GPG Fingerprint
b225ea
b225ea
Red Hat keys can be found at:
b225ea
  https://access.redhat.com/security/team/key
b225ea
b225ea
Related: #1258482
b225ea
---
b225ea
 src/daemon/abrt-action-save-package-data.c    | 34 ++++++++++++++++++++-----
b225ea
 src/daemon/abrt-action-save-package-data.conf |  7 ++++++
b225ea
 src/daemon/rpm.c                              | 36 +++++++++++++++++++--------
b225ea
 src/daemon/rpm.h                              | 15 +++++++++++
b225ea
 src/plugins/abrt-action-save-kernel-data      |  6 +++++
b225ea
 5 files changed, 82 insertions(+), 16 deletions(-)
b225ea
b225ea
diff --git a/src/daemon/abrt-action-save-package-data.c b/src/daemon/abrt-action-save-package-data.c
b225ea
index 97d5f5e..ef2007e 100644
b225ea
--- a/src/daemon/abrt-action-save-package-data.c
b225ea
+++ b/src/daemon/abrt-action-save-package-data.c
b225ea
@@ -224,6 +224,7 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
b225ea
     char *cmdline = NULL;
b225ea
     char *executable = NULL;
b225ea
     char *package_short_name = NULL;
b225ea
+    char *fingerprint = NULL;
b225ea
     struct pkg_envra *pkg_name = NULL;
b225ea
     char *component = NULL;
b225ea
     int error = 1;
b225ea
@@ -311,13 +312,12 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
b225ea
         goto ret; /* return 1 (failure) */
b225ea
     }
b225ea
 
b225ea
-    if (settings_bOpenGPGCheck)
b225ea
+    fingerprint = rpm_get_fingerprint(package_short_name);
b225ea
+    if (!(fingerprint != NULL && rpm_fingerprint_is_imported(fingerprint))
b225ea
+         && settings_bOpenGPGCheck)
b225ea
     {
b225ea
-        if (!rpm_chk_fingerprint(package_short_name))
b225ea
-        {
b225ea
-            log("Package '%s' isn't signed with proper key", package_short_name);
b225ea
-            goto ret; /* return 1 (failure) */
b225ea
-        }
b225ea
+        log("Package '%s' isn't signed with proper key", package_short_name);
b225ea
+        goto ret; /* return 1 (failure) */
b225ea
         /* We used to also check the integrity of the executable here:
b225ea
          *  if (!CheckHash(package_short_name.c_str(), executable)) BOOM();
b225ea
          * Checking the MD5 sum requires to run prelink to "un-prelink" the
b225ea
@@ -340,6 +340,27 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
b225ea
         dd_save_text(dd, FILENAME_PKG_VERSION, pkg_name->p_version);
b225ea
         dd_save_text(dd, FILENAME_PKG_RELEASE, pkg_name->p_release);
b225ea
         dd_save_text(dd, FILENAME_PKG_ARCH, pkg_name->p_arch);
b225ea
+        dd_save_text(dd, FILENAME_PKG_VENDOR, pkg_name->p_vendor);
b225ea
+
b225ea
+        if (fingerprint)
b225ea
+        {
b225ea
+            /* 16 character + 3 spaces + 1 '\0' + 2 Bytes for errors :) */
b225ea
+            char key_fingerprint[22] = {0};
b225ea
+
b225ea
+            /* The condition is just a defense against errors */
b225ea
+            for (size_t i = 0, j = 0; j < sizeof(key_fingerprint) - 2; )
b225ea
+            {
b225ea
+                key_fingerprint[j++] = toupper(fingerprint[i++]);
b225ea
+
b225ea
+                if (fingerprint[i] == '\0')
b225ea
+                    break;
b225ea
+
b225ea
+                if (!(i & (0x3)))
b225ea
+                    key_fingerprint[j++] = ' ';
b225ea
+            }
b225ea
+
b225ea
+            dd_save_text(dd, FILENAME_PKG_FINGERPRINT, key_fingerprint);
b225ea
+        }
b225ea
     }
b225ea
 
b225ea
     if (component)
b225ea
@@ -355,6 +376,7 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
b225ea
     free(package_short_name);
b225ea
     free_pkg_envra(pkg_name);
b225ea
     free(component);
b225ea
+    free(fingerprint);
b225ea
 
b225ea
     return error;
b225ea
 }
b225ea
diff --git a/src/daemon/abrt-action-save-package-data.conf b/src/daemon/abrt-action-save-package-data.conf
b225ea
index 3d35bb6..bf97264 100644
b225ea
--- a/src/daemon/abrt-action-save-package-data.conf
b225ea
+++ b/src/daemon/abrt-action-save-package-data.conf
b225ea
@@ -3,6 +3,13 @@
b225ea
 # the list of public keys used to check the signature is
b225ea
 # in the file gpg_keys
b225ea
 #
b225ea
+# How can I check the GPG key used to sign an installed pacakge on
b225ea
+# Red hat Enterprise Linux:
b225ea
+# https://access.redhat.com/solutions/1120013
b225ea
+#
b225ea
+# Product Signing (GPG) Keys:
b225ea
+# https://access.redhat.com/security/team/key
b225ea
+#
b225ea
 OpenGPGCheck = yes
b225ea
 
b225ea
 # Blacklisted packages
b225ea
diff --git a/src/daemon/rpm.c b/src/daemon/rpm.c
b225ea
index b69992c..d3d3d0a 100644
b225ea
--- a/src/daemon/rpm.c
b225ea
+++ b/src/daemon/rpm.c
b225ea
@@ -99,7 +99,22 @@ void rpm_load_gpgkey(const char* filename)
b225ea
 
b225ea
 int rpm_chk_fingerprint(const char* pkg)
b225ea
 {
b225ea
-    int ret = 0;
b225ea
+    char *fingerprint = rpm_get_fingerprint(pkg);
b225ea
+    int res = 0;
b225ea
+    if (fingerprint)
b225ea
+        res = rpm_fingerprint_is_imported(fingerprint);
b225ea
+    free(fingerprint);
b225ea
+    return res;
b225ea
+}
b225ea
+
b225ea
+int rpm_fingerprint_is_imported(const char* fingerprint)
b225ea
+{
b225ea
+    return !!g_list_find_custom(list_fingerprints, fingerprint, (GCompareFunc)g_strcmp0);
b225ea
+}
b225ea
+
b225ea
+char *rpm_get_fingerprint(const char *pkg)
b225ea
+{
b225ea
+    char *fingerprint = NULL;
b225ea
     char *pgpsig = NULL;
b225ea
     const char *errmsg = NULL;
b225ea
 
b225ea
@@ -117,20 +132,15 @@ int rpm_chk_fingerprint(const char* pkg)
b225ea
         goto error;
b225ea
     }
b225ea
 
b225ea
-    {
b225ea
-        char *pgpsig_tmp = strstr(pgpsig, " Key ID ");
b225ea
-        if (pgpsig_tmp)
b225ea
-        {
b225ea
-            pgpsig_tmp += sizeof(" Key ID ") - 1;
b225ea
-            ret = g_list_find_custom(list_fingerprints, pgpsig_tmp, (GCompareFunc)g_strcmp0) != NULL;
b225ea
-        }
b225ea
-    }
b225ea
+    char *pgpsig_tmp = strstr(pgpsig, " Key ID ");
b225ea
+    if (pgpsig_tmp)
b225ea
+        fingerprint = xstrdup(pgpsig_tmp + sizeof(" Key ID ") - 1);
b225ea
 
b225ea
 error:
b225ea
     free(pgpsig);
b225ea
     rpmdbFreeIterator(iter);
b225ea
     rpmtsFree(ts);
b225ea
-    return ret;
b225ea
+    return fingerprint;
b225ea
 }
b225ea
 
b225ea
 /*
b225ea
@@ -244,6 +254,7 @@ pkg_add_id(name);
b225ea
 pkg_add_id(version);
b225ea
 pkg_add_id(release);
b225ea
 pkg_add_id(arch);
b225ea
+pkg_add_id(vendor);
b225ea
 
b225ea
 // caller is responsible to free returned value
b225ea
 struct pkg_envra *rpm_get_package_nvr(const char *filename, const char *rootdir_or_NULL)
b225ea
@@ -314,6 +325,10 @@ struct pkg_envra *rpm_get_package_nvr(const char *filename, const char *rootdir_
b225ea
     if (r)
b225ea
         goto error;
b225ea
 
b225ea
+    r = pkg_add_vendor(header, p);
b225ea
+    if (r)
b225ea
+        goto error;
b225ea
+
b225ea
     p->p_nvr = xasprintf("%s-%s-%s", p->p_name, p->p_version, p->p_release);
b225ea
 
b225ea
     rpmdbFreeIterator(iter);
b225ea
@@ -334,6 +349,7 @@ void free_pkg_envra(struct pkg_envra *p)
b225ea
     if (!p)
b225ea
         return;
b225ea
 
b225ea
+    free(p->p_vendor);
b225ea
     free(p->p_epoch);
b225ea
     free(p->p_name);
b225ea
     free(p->p_version);
b225ea
diff --git a/src/daemon/rpm.h b/src/daemon/rpm.h
b225ea
index 1b90368..89aa088 100644
b225ea
--- a/src/daemon/rpm.h
b225ea
+++ b/src/daemon/rpm.h
b225ea
@@ -38,6 +38,7 @@ struct pkg_envra {
b225ea
     char *p_version;
b225ea
     char *p_release;
b225ea
     char *p_arch;
b225ea
+    char *p_vendor;
b225ea
 };
b225ea
 
b225ea
 void free_pkg_envra(struct pkg_envra *p);
b225ea
@@ -69,6 +70,20 @@ void rpm_load_gpgkey(const char* filename);
b225ea
 int rpm_chk_fingerprint(const char* pkg);
b225ea
 
b225ea
 /**
b225ea
+ * A function, which checks if the given finger print is imported.
b225ea
+ * @param pkg A package name.
b225ea
+ * @return 1 if imported, otherwise (not-imported, or error) 0
b225ea
+ */
b225ea
+int rpm_fingerprint_is_imported(const char* fingerprint);
b225ea
+
b225ea
+/**
b225ea
+ * A function, which returns package's finger print
b225ea
+ * @param pkg A package name.
b225ea
+ * @return NULL if not-valid, otherwise malloced NULL-terminated string.
b225ea
+ */
b225ea
+char *rpm_get_fingerprint(const char* pkg);
b225ea
+
b225ea
+/**
b225ea
  * Gets a package name. This package contains particular
b225ea
  * file. If the file doesn't belong to any package, empty string is
b225ea
  * returned.
b225ea
diff --git a/src/plugins/abrt-action-save-kernel-data b/src/plugins/abrt-action-save-kernel-data
b225ea
index 7df85cf..5f1ddc7 100755
b225ea
--- a/src/plugins/abrt-action-save-kernel-data
b225ea
+++ b/src/plugins/abrt-action-save-kernel-data
b225ea
@@ -29,3 +29,9 @@ rpm -q --qf "%{release}\n" "$package" > pkg_release
b225ea
 epoch="$( rpm -q --qf "%{epoch}" "$package" )"
b225ea
 test "$epoch" = "(none)"  && epoch=0
b225ea
 echo "$epoch" > pkg_epoch
b225ea
+rpm -q --qf "%{vendor}\n" "$package" > pkg_vendor
b225ea
+
b225ea
+FINGERPRINT=$(rpm -q --qf "%|SIGGPG?{%{SIGGPG:pgpsig}}:{%{SIGPGP:pgpsig}}|" "$package" 2>/dev/null | tail -1)
b225ea
+if [ -n "$FINGERPRINT" -a "_(none)" != "_$FINGERPRINT" ]; then
b225ea
+    echo $FINGERPRINT | sed 's/.*Key ID \(....\)\(....\)\(....\)\(....\)$/\U\1 \U\2 \U\3 \U\4/' > pkg_fingerprint
b225ea
+fi
b225ea
-- 
b225ea
1.8.3.1
b225ea