richardphibel / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
45e748
From f525681b4f66026578bc728b864bfea3d814c29e Mon Sep 17 00:00:00 2001
45e748
From: Jes Sorensen <jsorensen@fb.com>
45e748
Date: Fri, 27 Mar 2020 18:31:36 -0400
45e748
Subject: [PATCH 16/33] Add basic autoconf and framework for fsverity support
45e748
45e748
Use the same signing key argument as is used for IMA file signing.
45e748
45e748
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
45e748
---
45e748
 configure.ac     | 19 +++++++++++++++++++
45e748
 rpmsign.c        | 20 ++++++++++++++------
45e748
 sign/Makefile.am |  5 +++++
45e748
 sign/rpmsign.h   |  1 +
45e748
 4 files changed, 39 insertions(+), 6 deletions(-)
45e748
45e748
diff --git a/configure.ac b/configure.ac
45e748
index 3c102d5eb..cc7144440 100644
45e748
--- a/configure.ac
45e748
+++ b/configure.ac
45e748
@@ -919,6 +919,25 @@ fi
45e748
 AM_CONDITIONAL(WITH_IMAEVM,[test "$with_imaevm" = yes])
45e748
 AC_SUBST(WITH_IMAEVM_LIB)
45e748
 
45e748
+# fsverity
45e748
+AC_ARG_WITH([fsverity], [AS_HELP_STRING([--with-fsverity],[build with fsverity support])],[],[with_fsverity=no])
45e748
+if test "$with_fsverity" = yes ; then
45e748
+  AC_MSG_CHECKING([libfsverity])
45e748
+  AC_COMPILE_IFELSE(
45e748
+    [AC_LANG_PROGRAM(
45e748
+      [[#include <libfsverity.h>]],
45e748
+      [[return libfsverity_sign_digest(NULL, NULL, NULL, NULL);]]
45e748
+    )],
45e748
+    [AC_MSG_RESULT(yes)
45e748
+      AC_DEFINE(WITH_FSVERITY, 1, [Build with fsverity support?])
45e748
+      WITH_FSVERITY_LIB="-lfsverity"
45e748
+    ],
45e748
+    [AC_MSG_ERROR([--with-fsverity given, libfsverity or libfsverity.h missing])]
45e748
+  )
45e748
+fi
45e748
+AM_CONDITIONAL(WITH_FSVERITY,[test "$with_fsverity" = yes])
45e748
+AC_SUBST(WITH_FSVERITY_LIB)
45e748
+
45e748
 # libcap
45e748
 WITH_CAP_LIB=
45e748
 AC_ARG_WITH(cap, [AS_HELP_STRING([--with-cap],[build with capability support])],
45e748
diff --git a/rpmsign.c b/rpmsign.c
45e748
index e1d207da5..8861c2c59 100644
45e748
--- a/rpmsign.c
45e748
+++ b/rpmsign.c
45e748
@@ -18,7 +18,7 @@ enum modes {
45e748
 
45e748
 static int mode = MODE_NONE;
45e748
 
45e748
-#ifdef WITH_IMAEVM
45e748
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45e748
 static int fskpass = 0;
45e748
 static char * fileSigningKey = NULL;
45e748
 #endif
45e748
@@ -39,6 +39,13 @@ static struct poptOption signOptsTable[] = {
45e748
     { "signfiles", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR),
45e748
 	&sargs.signflags, RPMSIGN_FLAG_IMA,
45e748
 	N_("sign package(s) files"), NULL},
45e748
+#endif
45e748
+#ifdef WITH_FSVERITY
45e748
+    { "signverity", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR),
45e748
+	&sargs.signflags, RPMSIGN_FLAG_FSVERITY,
45e748
+	N_("generate fsverity signatures for package(s) files"), NULL},
45e748
+#endif
45e748
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45e748
     { "fskpath", '\0', POPT_ARG_STRING, &fileSigningKey, 0,
45e748
 	N_("use file signing key <key>"),
45e748
 	N_("<key>") },
45e748
@@ -59,7 +66,7 @@ static struct poptOption optionsTable[] = {
45e748
     POPT_TABLEEND
45e748
 };
45e748
 
45e748
-#ifdef WITH_IMAEVM
45e748
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45e748
 static char *get_fskpass(void)
45e748
 {
45e748
     struct termios flags, tmp_flags;
45e748
@@ -106,12 +113,12 @@ static int doSign(poptContext optCon, struct rpmSignArgs *sargs)
45e748
 	goto exit;
45e748
     }
45e748
 
45e748
-#ifdef WITH_IMAEVM
45e748
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45e748
     if (fileSigningKey) {
45e748
 	rpmPushMacro(NULL, "_file_signing_key", NULL, fileSigningKey, RMIL_GLOBAL);
45e748
     }
45e748
 
45e748
-    if (sargs->signflags & RPMSIGN_FLAG_IMA) {
45e748
+    if (sargs->signflags & (RPMSIGN_FLAG_IMA | RPMSIGN_FLAG_FSVERITY)) {
45e748
 	char *fileSigningKeyPassword = NULL;
45e748
 	char *key = rpmExpand("%{?_file_signing_key}", NULL);
45e748
 	if (rstreq(key, "")) {
45e748
@@ -165,8 +172,9 @@ int main(int argc, char *argv[])
45e748
 	argerror(_("no arguments given"));
45e748
     }
45e748
 
45e748
-#ifdef WITH_IMAEVM
45e748
-    if (fileSigningKey && !(sargs.signflags & RPMSIGN_FLAG_IMA)) {
45e748
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45e748
+    if (fileSigningKey &&
45e748
+	!(sargs.signflags & (RPMSIGN_FLAG_IMA | RPMSIGN_FLAG_FSVERITY))) {
45e748
 	argerror(_("--fskpath may only be specified when signing files"));
45e748
     }
45e748
 #endif
45e748
diff --git a/sign/Makefile.am b/sign/Makefile.am
45e748
index db774de0e..8d372915a 100644
45e748
--- a/sign/Makefile.am
45e748
+++ b/sign/Makefile.am
45e748
@@ -24,3 +24,8 @@ if WITH_IMAEVM
45e748
 librpmsign_la_SOURCES += rpmsignfiles.c rpmsignfiles.h
45e748
 librpmsign_la_LIBADD += @WITH_IMAEVM_LIB@
45e748
 endif
45e748
+
45e748
+if WITH_FSVERITY
45e748
+librpmsign_la_SOURCES += rpmsignverity.c rpmsignverity.h
45e748
+librpmsign_la_LIBADD += @WITH_FSVERITY_LIB@
45e748
+endif
45e748
diff --git a/sign/rpmsign.h b/sign/rpmsign.h
45e748
index 7a770d879..2b8a10a1a 100644
45e748
--- a/sign/rpmsign.h
45e748
+++ b/sign/rpmsign.h
45e748
@@ -17,6 +17,7 @@ enum rpmSignFlags_e {
45e748
     RPMSIGN_FLAG_NONE		= 0,
45e748
     RPMSIGN_FLAG_IMA		= (1 << 0),
45e748
     RPMSIGN_FLAG_RPMV3		= (1 << 1),
45e748
+    RPMSIGN_FLAG_FSVERITY	= (1 << 2),
45e748
 };
45e748
 typedef rpmFlags rpmSignFlags;
45e748
 
45e748
-- 
45e748
2.27.0
45e748