Blame SOURCES/0214-Save-Vendor-and-GPG-Fingerprint.patch

baab13
From 95ea12b9a4be68cc25f0811e693c7a024b5e3d4b Mon Sep 17 00:00:00 2001
baab13
From: Matej Habrnal <mhabrnal@redhat.com>
baab13
Date: Tue, 9 Feb 2016 16:53:21 +0100
baab13
Subject: [PATCH] Save Vendor and GPG Fingerprint
baab13
baab13
Red Hat keys can be found at:
baab13
  https://access.redhat.com/security/team/key
baab13
baab13
Related: #1258482
baab13
---
baab13
 src/daemon/abrt-action-save-package-data.c    | 34 ++++++++++++++++++++-----
baab13
 src/daemon/abrt-action-save-package-data.conf |  7 ++++++
baab13
 src/daemon/rpm.c                              | 36 +++++++++++++++++++--------
baab13
 src/daemon/rpm.h                              | 15 +++++++++++
baab13
 src/plugins/abrt-action-save-kernel-data      |  6 +++++
baab13
 5 files changed, 82 insertions(+), 16 deletions(-)
baab13
baab13
diff --git a/src/daemon/abrt-action-save-package-data.c b/src/daemon/abrt-action-save-package-data.c
baab13
index 97d5f5e..ef2007e 100644
baab13
--- a/src/daemon/abrt-action-save-package-data.c
baab13
+++ b/src/daemon/abrt-action-save-package-data.c
baab13
@@ -224,6 +224,7 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
     char *cmdline = NULL;
baab13
     char *executable = NULL;
baab13
     char *package_short_name = NULL;
baab13
+    char *fingerprint = NULL;
baab13
     struct pkg_envra *pkg_name = NULL;
baab13
     char *component = NULL;
baab13
     int error = 1;
baab13
@@ -311,13 +312,12 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
         goto ret; /* return 1 (failure) */
baab13
     }
baab13
 
baab13
-    if (settings_bOpenGPGCheck)
baab13
+    fingerprint = rpm_get_fingerprint(package_short_name);
baab13
+    if (!(fingerprint != NULL && rpm_fingerprint_is_imported(fingerprint))
baab13
+         && settings_bOpenGPGCheck)
baab13
     {
baab13
-        if (!rpm_chk_fingerprint(package_short_name))
baab13
-        {
baab13
-            log("Package '%s' isn't signed with proper key", package_short_name);
baab13
-            goto ret; /* return 1 (failure) */
baab13
-        }
baab13
+        log("Package '%s' isn't signed with proper key", package_short_name);
baab13
+        goto ret; /* return 1 (failure) */
baab13
         /* We used to also check the integrity of the executable here:
baab13
          *  if (!CheckHash(package_short_name.c_str(), executable)) BOOM();
baab13
          * Checking the MD5 sum requires to run prelink to "un-prelink" the
baab13
@@ -340,6 +340,27 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
         dd_save_text(dd, FILENAME_PKG_VERSION, pkg_name->p_version);
baab13
         dd_save_text(dd, FILENAME_PKG_RELEASE, pkg_name->p_release);
baab13
         dd_save_text(dd, FILENAME_PKG_ARCH, pkg_name->p_arch);
baab13
+        dd_save_text(dd, FILENAME_PKG_VENDOR, pkg_name->p_vendor);
baab13
+
baab13
+        if (fingerprint)
baab13
+        {
baab13
+            /* 16 character + 3 spaces + 1 '\0' + 2 Bytes for errors :) */
baab13
+            char key_fingerprint[22] = {0};
baab13
+
baab13
+            /* The condition is just a defense against errors */
baab13
+            for (size_t i = 0, j = 0; j < sizeof(key_fingerprint) - 2; )
baab13
+            {
baab13
+                key_fingerprint[j++] = toupper(fingerprint[i++]);
baab13
+
baab13
+                if (fingerprint[i] == '\0')
baab13
+                    break;
baab13
+
baab13
+                if (!(i & (0x3)))
baab13
+                    key_fingerprint[j++] = ' ';
baab13
+            }
baab13
+
baab13
+            dd_save_text(dd, FILENAME_PKG_FINGERPRINT, key_fingerprint);
baab13
+        }
baab13
     }
baab13
 
baab13
     if (component)
baab13
@@ -355,6 +376,7 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
     free(package_short_name);
baab13
     free_pkg_envra(pkg_name);
baab13
     free(component);
baab13
+    free(fingerprint);
baab13
 
baab13
     return error;
baab13
 }
baab13
diff --git a/src/daemon/abrt-action-save-package-data.conf b/src/daemon/abrt-action-save-package-data.conf
baab13
index 3d35bb6..bf97264 100644
baab13
--- a/src/daemon/abrt-action-save-package-data.conf
baab13
+++ b/src/daemon/abrt-action-save-package-data.conf
baab13
@@ -3,6 +3,13 @@
baab13
 # the list of public keys used to check the signature is
baab13
 # in the file gpg_keys
baab13
 #
baab13
+# How can I check the GPG key used to sign an installed pacakge on
baab13
+# Red hat Enterprise Linux:
baab13
+# https://access.redhat.com/solutions/1120013
baab13
+#
baab13
+# Product Signing (GPG) Keys:
baab13
+# https://access.redhat.com/security/team/key
baab13
+#
baab13
 OpenGPGCheck = yes
baab13
 
baab13
 # Blacklisted packages
baab13
diff --git a/src/daemon/rpm.c b/src/daemon/rpm.c
baab13
index b69992c..d3d3d0a 100644
baab13
--- a/src/daemon/rpm.c
baab13
+++ b/src/daemon/rpm.c
baab13
@@ -99,7 +99,22 @@ void rpm_load_gpgkey(const char* filename)
baab13
 
baab13
 int rpm_chk_fingerprint(const char* pkg)
baab13
 {
baab13
-    int ret = 0;
baab13
+    char *fingerprint = rpm_get_fingerprint(pkg);
baab13
+    int res = 0;
baab13
+    if (fingerprint)
baab13
+        res = rpm_fingerprint_is_imported(fingerprint);
baab13
+    free(fingerprint);
baab13
+    return res;
baab13
+}
baab13
+
baab13
+int rpm_fingerprint_is_imported(const char* fingerprint)
baab13
+{
baab13
+    return !!g_list_find_custom(list_fingerprints, fingerprint, (GCompareFunc)g_strcmp0);
baab13
+}
baab13
+
baab13
+char *rpm_get_fingerprint(const char *pkg)
baab13
+{
baab13
+    char *fingerprint = NULL;
baab13
     char *pgpsig = NULL;
baab13
     const char *errmsg = NULL;
baab13
 
baab13
@@ -117,20 +132,15 @@ int rpm_chk_fingerprint(const char* pkg)
baab13
         goto error;
baab13
     }
baab13
 
baab13
-    {
baab13
-        char *pgpsig_tmp = strstr(pgpsig, " Key ID ");
baab13
-        if (pgpsig_tmp)
baab13
-        {
baab13
-            pgpsig_tmp += sizeof(" Key ID ") - 1;
baab13
-            ret = g_list_find_custom(list_fingerprints, pgpsig_tmp, (GCompareFunc)g_strcmp0) != NULL;
baab13
-        }
baab13
-    }
baab13
+    char *pgpsig_tmp = strstr(pgpsig, " Key ID ");
baab13
+    if (pgpsig_tmp)
baab13
+        fingerprint = xstrdup(pgpsig_tmp + sizeof(" Key ID ") - 1);
baab13
 
baab13
 error:
baab13
     free(pgpsig);
baab13
     rpmdbFreeIterator(iter);
baab13
     rpmtsFree(ts);
baab13
-    return ret;
baab13
+    return fingerprint;
baab13
 }
baab13
 
baab13
 /*
baab13
@@ -244,6 +254,7 @@ pkg_add_id(name);
baab13
 pkg_add_id(version);
baab13
 pkg_add_id(release);
baab13
 pkg_add_id(arch);
baab13
+pkg_add_id(vendor);
baab13
 
baab13
 // caller is responsible to free returned value
baab13
 struct pkg_envra *rpm_get_package_nvr(const char *filename, const char *rootdir_or_NULL)
baab13
@@ -314,6 +325,10 @@ struct pkg_envra *rpm_get_package_nvr(const char *filename, const char *rootdir_
baab13
     if (r)
baab13
         goto error;
baab13
 
baab13
+    r = pkg_add_vendor(header, p);
baab13
+    if (r)
baab13
+        goto error;
baab13
+
baab13
     p->p_nvr = xasprintf("%s-%s-%s", p->p_name, p->p_version, p->p_release);
baab13
 
baab13
     rpmdbFreeIterator(iter);
baab13
@@ -334,6 +349,7 @@ void free_pkg_envra(struct pkg_envra *p)
baab13
     if (!p)
baab13
         return;
baab13
 
baab13
+    free(p->p_vendor);
baab13
     free(p->p_epoch);
baab13
     free(p->p_name);
baab13
     free(p->p_version);
baab13
diff --git a/src/daemon/rpm.h b/src/daemon/rpm.h
baab13
index 1b90368..89aa088 100644
baab13
--- a/src/daemon/rpm.h
baab13
+++ b/src/daemon/rpm.h
baab13
@@ -38,6 +38,7 @@ struct pkg_envra {
baab13
     char *p_version;
baab13
     char *p_release;
baab13
     char *p_arch;
baab13
+    char *p_vendor;
baab13
 };
baab13
 
baab13
 void free_pkg_envra(struct pkg_envra *p);
baab13
@@ -69,6 +70,20 @@ void rpm_load_gpgkey(const char* filename);
baab13
 int rpm_chk_fingerprint(const char* pkg);
baab13
 
baab13
 /**
baab13
+ * A function, which checks if the given finger print is imported.
baab13
+ * @param pkg A package name.
baab13
+ * @return 1 if imported, otherwise (not-imported, or error) 0
baab13
+ */
baab13
+int rpm_fingerprint_is_imported(const char* fingerprint);
baab13
+
baab13
+/**
baab13
+ * A function, which returns package's finger print
baab13
+ * @param pkg A package name.
baab13
+ * @return NULL if not-valid, otherwise malloced NULL-terminated string.
baab13
+ */
baab13
+char *rpm_get_fingerprint(const char* pkg);
baab13
+
baab13
+/**
baab13
  * Gets a package name. This package contains particular
baab13
  * file. If the file doesn't belong to any package, empty string is
baab13
  * returned.
baab13
diff --git a/src/plugins/abrt-action-save-kernel-data b/src/plugins/abrt-action-save-kernel-data
baab13
index 7df85cf..5f1ddc7 100755
baab13
--- a/src/plugins/abrt-action-save-kernel-data
baab13
+++ b/src/plugins/abrt-action-save-kernel-data
baab13
@@ -29,3 +29,9 @@ rpm -q --qf "%{release}\n" "$package" > pkg_release
baab13
 epoch="$( rpm -q --qf "%{epoch}" "$package" )"
baab13
 test "$epoch" = "(none)"  && epoch=0
baab13
 echo "$epoch" > pkg_epoch
baab13
+rpm -q --qf "%{vendor}\n" "$package" > pkg_vendor
baab13
+
baab13
+FINGERPRINT=$(rpm -q --qf "%|SIGGPG?{%{SIGGPG:pgpsig}}:{%{SIGPGP:pgpsig}}|" "$package" 2>/dev/null | tail -1)
baab13
+if [ -n "$FINGERPRINT" -a "_(none)" != "_$FINGERPRINT" ]; then
baab13
+    echo $FINGERPRINT | sed 's/.*Key ID \(....\)\(....\)\(....\)\(....\)$/\U\1 \U\2 \U\3 \U\4/' > pkg_fingerprint
baab13
+fi
baab13
-- 
baab13
1.8.3.1
baab13