richardphibel / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
45e748
From 46db4f6827840e828f42424454410b930895d9a7 Mon Sep 17 00:00:00 2001
45e748
From: Jes Sorensen <jsorensen@fb.com>
45e748
Date: Mon, 13 Apr 2020 18:24:31 -0400
45e748
Subject: [PATCH 30/33] Add --delfilesign flag to delete IMA and fsverity file
45e748
 signatures
45e748
45e748
This allows a user to remove both types of file signatures from the
45e748
package. Previously there was no way to delete IMA signatures, only
45e748
replace them by first removing the package signature and then
45e748
resigning the package and the files.
45e748
45e748
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
45e748
---
45e748
 rpmsign.c        | 12 ++++++++++++
45e748
 sign/rpmgensig.c | 17 ++++++++++++++++-
45e748
 sign/rpmsign.h   |  9 +++++++++
45e748
 3 files changed, 37 insertions(+), 1 deletion(-)
45e748
45e748
diff --git a/rpmsign.c b/rpmsign.c
45e748
index 074dd8b13..e43811e9f 100644
45e748
--- a/rpmsign.c
45e748
+++ b/rpmsign.c
45e748
@@ -14,6 +14,7 @@ enum modes {
45e748
     MODE_ADDSIGN = (1 << 0),
45e748
     MODE_RESIGN  = (1 << 1),
45e748
     MODE_DELSIGN = (1 << 2),
45e748
+    MODE_DELFILESIGN = (1 << 3),
45e748
 };
45e748
 
45e748
 static int mode = MODE_NONE;
45e748
@@ -35,6 +36,10 @@ static struct poptOption signOptsTable[] = {
45e748
 	N_("sign package(s) (identical to --addsign)"), NULL },
45e748
     { "delsign", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode, MODE_DELSIGN,
45e748
 	N_("delete package signatures"), NULL },
45e748
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45e748
+    { "delfilesign", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &mode,
45e748
+      MODE_DELFILESIGN,	N_("delete IMA and fsverity file signatures"), NULL },
45e748
+#endif
45e748
     { "rpmv3", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR),
45e748
 	&sargs.signflags, RPMSIGN_FLAG_RPMV3,
45e748
 	N_("create rpm v3 header+payload signatures") },
45e748
@@ -207,6 +212,13 @@ int main(int argc, char *argv[])
45e748
 		ec++;
45e748
 	}
45e748
 	break;
45e748
+    case MODE_DELFILESIGN:
45e748
+	ec = 0;
45e748
+	while ((arg = poptGetArg(optCon)) != NULL) {
45e748
+	    if (rpmPkgDelFileSign(arg, &sargs) < 0)
45e748
+		ec++;
45e748
+	}
45e748
+	break;
45e748
     case MODE_NONE:
45e748
 	printUsage(optCon, stderr, 0);
45e748
 	break;
45e748
diff --git a/sign/rpmgensig.c b/sign/rpmgensig.c
45e748
index 8d5c5858f..02cf0bc62 100644
45e748
--- a/sign/rpmgensig.c
45e748
+++ b/sign/rpmgensig.c
45e748
@@ -336,6 +336,14 @@ static void deleteSigs(Header sigh)
45e748
     headerDel(sigh, RPMSIGTAG_PGP5);
45e748
 }
45e748
 
45e748
+static void deleteFileSigs(Header sigh)
45e748
+{
45e748
+    headerDel(sigh, RPMSIGTAG_FILESIGNATURELENGTH);
45e748
+    headerDel(sigh, RPMSIGTAG_FILESIGNATURES);
45e748
+    headerDel(sigh, RPMSIGTAG_VERITYSIGNATURES);
45e748
+    headerDel(sigh, RPMSIGTAG_VERITYSIGNATUREALGO);
45e748
+}
45e748
+
45e748
 static int haveSignature(rpmtd sigtd, Header h)
45e748
 {
45e748
     pgpDigParams sig1 = NULL;
45e748
@@ -580,7 +588,9 @@ static int rpmSign(const char *rpm, int deleting, int flags)
45e748
 	    goto exit;
45e748
     }
45e748
 
45e748
-    if (deleting) {	/* Nuke all the signature tags. */
45e748
+    if (deleting == 2) {	/* Nuke IMA + fsverity file signature tags. */
45e748
+	deleteFileSigs(sigh);
45e748
+    } else if (deleting) {	/* Nuke all the signature tags. */
45e748
 	deleteSigs(sigh);
45e748
     } else {
45e748
 	/* Signature target containing header + payload */
45e748
@@ -745,3 +755,8 @@ int rpmPkgDelSign(const char *path, const struct rpmSignArgs * args)
45e748
 {
45e748
     return rpmSign(path, 1, 0);
45e748
 }
45e748
+
45e748
+int rpmPkgDelFileSign(const char *path, const struct rpmSignArgs * args)
45e748
+{
45e748
+    return rpmSign(path, 2, 0);
45e748
+}
45e748
diff --git a/sign/rpmsign.h b/sign/rpmsign.h
45e748
index 2b8a10a1a..5169741dd 100644
45e748
--- a/sign/rpmsign.h
45e748
+++ b/sign/rpmsign.h
45e748
@@ -44,6 +44,15 @@ int rpmPkgSign(const char *path, const struct rpmSignArgs * args);
45e748
  */
45e748
 int rpmPkgDelSign(const char *path, const struct rpmSignArgs * args);
45e748
 
45e748
+
45e748
+/** \ingroup rpmsign
45e748
+ * Delete file signature(s) from a package
45e748
+ * @param path		path to package
45e748
+ * @param args		signing parameters (or NULL for defaults)
45e748
+ * @return		0 on success
45e748
+ */
45e748
+int rpmPkgDelFileSign(const char *path, const struct rpmSignArgs * args);
45e748
+
45e748
 #ifdef __cplusplus
45e748
 }
45e748
 #endif
45e748
-- 
45e748
2.27.0
45e748