richardphibel / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
45afda
From f525681b4f66026578bc728b864bfea3d814c29e Mon Sep 17 00:00:00 2001
45afda
From: Jes Sorensen <jsorensen@fb.com>
45afda
Date: Fri, 27 Mar 2020 18:31:36 -0400
45afda
Subject: [PATCH 16/33] Add basic autoconf and framework for fsverity support
45afda
45afda
Use the same signing key argument as is used for IMA file signing.
45afda
45afda
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
45afda
---
45afda
 configure.ac     | 19 +++++++++++++++++++
45afda
 rpmsign.c        | 20 ++++++++++++++------
45afda
 sign/Makefile.am |  5 +++++
45afda
 sign/rpmsign.h   |  1 +
45afda
 4 files changed, 39 insertions(+), 6 deletions(-)
45afda
45afda
diff --git a/configure.ac b/configure.ac
45afda
index 3c102d5eb..cc7144440 100644
45afda
--- a/configure.ac
45afda
+++ b/configure.ac
45afda
@@ -919,6 +919,25 @@ fi
45afda
 AM_CONDITIONAL(WITH_IMAEVM,[test "$with_imaevm" = yes])
45afda
 AC_SUBST(WITH_IMAEVM_LIB)
45afda
 
45afda
+# fsverity
45afda
+AC_ARG_WITH([fsverity], [AS_HELP_STRING([--with-fsverity],[build with fsverity support])],[],[with_fsverity=no])
45afda
+if test "$with_fsverity" = yes ; then
45afda
+  AC_MSG_CHECKING([libfsverity])
45afda
+  AC_COMPILE_IFELSE(
45afda
+    [AC_LANG_PROGRAM(
45afda
+      [[#include <libfsverity.h>]],
45afda
+      [[return libfsverity_sign_digest(NULL, NULL, NULL, NULL);]]
45afda
+    )],
45afda
+    [AC_MSG_RESULT(yes)
45afda
+      AC_DEFINE(WITH_FSVERITY, 1, [Build with fsverity support?])
45afda
+      WITH_FSVERITY_LIB="-lfsverity"
45afda
+    ],
45afda
+    [AC_MSG_ERROR([--with-fsverity given, libfsverity or libfsverity.h missing])]
45afda
+  )
45afda
+fi
45afda
+AM_CONDITIONAL(WITH_FSVERITY,[test "$with_fsverity" = yes])
45afda
+AC_SUBST(WITH_FSVERITY_LIB)
45afda
+
45afda
 # libcap
45afda
 WITH_CAP_LIB=
45afda
 AC_ARG_WITH(cap, [AS_HELP_STRING([--with-cap],[build with capability support])],
45afda
diff --git a/rpmsign.c b/rpmsign.c
45afda
index e1d207da5..8861c2c59 100644
45afda
--- a/rpmsign.c
45afda
+++ b/rpmsign.c
45afda
@@ -18,7 +18,7 @@ enum modes {
45afda
 
45afda
 static int mode = MODE_NONE;
45afda
 
45afda
-#ifdef WITH_IMAEVM
45afda
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45afda
 static int fskpass = 0;
45afda
 static char * fileSigningKey = NULL;
45afda
 #endif
45afda
@@ -39,6 +39,13 @@ static struct poptOption signOptsTable[] = {
45afda
     { "signfiles", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR),
45afda
 	&sargs.signflags, RPMSIGN_FLAG_IMA,
45afda
 	N_("sign package(s) files"), NULL},
45afda
+#endif
45afda
+#ifdef WITH_FSVERITY
45afda
+    { "signverity", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR),
45afda
+	&sargs.signflags, RPMSIGN_FLAG_FSVERITY,
45afda
+	N_("generate fsverity signatures for package(s) files"), NULL},
45afda
+#endif
45afda
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45afda
     { "fskpath", '\0', POPT_ARG_STRING, &fileSigningKey, 0,
45afda
 	N_("use file signing key <key>"),
45afda
 	N_("<key>") },
45afda
@@ -59,7 +66,7 @@ static struct poptOption optionsTable[] = {
45afda
     POPT_TABLEEND
45afda
 };
45afda
 
45afda
-#ifdef WITH_IMAEVM
45afda
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45afda
 static char *get_fskpass(void)
45afda
 {
45afda
     struct termios flags, tmp_flags;
45afda
@@ -106,12 +113,12 @@ static int doSign(poptContext optCon, struct rpmSignArgs *sargs)
45afda
 	goto exit;
45afda
     }
45afda
 
45afda
-#ifdef WITH_IMAEVM
45afda
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45afda
     if (fileSigningKey) {
45afda
 	rpmPushMacro(NULL, "_file_signing_key", NULL, fileSigningKey, RMIL_GLOBAL);
45afda
     }
45afda
 
45afda
-    if (sargs->signflags & RPMSIGN_FLAG_IMA) {
45afda
+    if (sargs->signflags & (RPMSIGN_FLAG_IMA | RPMSIGN_FLAG_FSVERITY)) {
45afda
 	char *fileSigningKeyPassword = NULL;
45afda
 	char *key = rpmExpand("%{?_file_signing_key}", NULL);
45afda
 	if (rstreq(key, "")) {
45afda
@@ -165,8 +172,9 @@ int main(int argc, char *argv[])
45afda
 	argerror(_("no arguments given"));
45afda
     }
45afda
 
45afda
-#ifdef WITH_IMAEVM
45afda
-    if (fileSigningKey && !(sargs.signflags & RPMSIGN_FLAG_IMA)) {
45afda
+#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45afda
+    if (fileSigningKey &&
45afda
+	!(sargs.signflags & (RPMSIGN_FLAG_IMA | RPMSIGN_FLAG_FSVERITY))) {
45afda
 	argerror(_("--fskpath may only be specified when signing files"));
45afda
     }
45afda
 #endif
45afda
diff --git a/sign/Makefile.am b/sign/Makefile.am
45afda
index db774de0e..8d372915a 100644
45afda
--- a/sign/Makefile.am
45afda
+++ b/sign/Makefile.am
45afda
@@ -24,3 +24,8 @@ if WITH_IMAEVM
45afda
 librpmsign_la_SOURCES += rpmsignfiles.c rpmsignfiles.h
45afda
 librpmsign_la_LIBADD += @WITH_IMAEVM_LIB@
45afda
 endif
45afda
+
45afda
+if WITH_FSVERITY
45afda
+librpmsign_la_SOURCES += rpmsignverity.c rpmsignverity.h
45afda
+librpmsign_la_LIBADD += @WITH_FSVERITY_LIB@
45afda
+endif
45afda
diff --git a/sign/rpmsign.h b/sign/rpmsign.h
45afda
index 7a770d879..2b8a10a1a 100644
45afda
--- a/sign/rpmsign.h
45afda
+++ b/sign/rpmsign.h
45afda
@@ -17,6 +17,7 @@ enum rpmSignFlags_e {
45afda
     RPMSIGN_FLAG_NONE		= 0,
45afda
     RPMSIGN_FLAG_IMA		= (1 << 0),
45afda
     RPMSIGN_FLAG_RPMV3		= (1 << 1),
45afda
+    RPMSIGN_FLAG_FSVERITY	= (1 << 2),
45afda
 };
45afda
 typedef rpmFlags rpmSignFlags;
45afda
 
45afda
-- 
45afda
2.27.0
45afda