Skip to contentSkip to conversation

ima-evm-utils: Rework openssl init

PATCH In review Vitaly Chikunov 2 participants 2 messages Mar 23, 2019 – Apr 3, 2019 Keys-trusted

lore
Share & tools
lore

Vitaly Chikunov

author
#0 lore raw

PATCH v3 1/1 ima-evm-utils: Rework openssl init

Remove deprecated call to OpenSSL_add_all_algorithms(). Allow to disable openssl config loading by evmctl via configure `--disable-openssl-conf' option. Show status of that in configure. Move config loading from libimaevm to evmctl.
Finish engine initialization properly by calling ENGINE_set_default(), as suggested by James Bottomley.

Signed-off-by Vitaly Chikunov <[email protected]>

---
Changes since v2:
- Display --disable-openssl-conf status under "Give some feedback".
- Move config load from libimaevm to evmctl.

 configure.ac    | 10 ++++++++--
 src/evmctl.c    |  6 ++++++
 src/libimaevm.c |  4 ++--
 3 files changed, 16 insertions(+), 4 deletions(-)
configure.ac +8 -2
index 60f3684..10d1d88 100644
@@ -39,6 +39,12 @@ AC_ARG_WITH(kernel_headers, [AS_HELP_STRING([--with-kernel-headers=PATH],
 	    [KERNEL_HEADERS="$withval"],
 	    [KERNEL_HEADERS=/lib/modules/$(uname -r)/source])
 
+AC_ARG_ENABLE([openssl_conf],
+	      [AS_HELP_STRING([--disable-openssl-conf], [disable loading of openssl config by evmctl])],
+	      [if test "$enable_openssl_conf" = "no"; then
+		AC_DEFINE(DISABLE_OPENSSL_CONF, 1, [Define to disable loading of openssl config by evmctl.])
+	      fi], [enable_openssl_conf=yes])
+
 #debug support - yes for a while
 PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support])
 if test $pkg_cv_enable_debug = yes; then

@@ -65,6 +71,6 @@ AC_OUTPUT
 echo
 echo
 echo	"Configuration:"
-echo	"	debug:	$pkg_cv_enable_debug"
+echo	"          debug: $pkg_cv_enable_debug"
+echo	"   openssl-conf: $enable_openssl_conf"
 echo
-
src/evmctl.c +6 -0
index 0459798..15a7226 100644
@@ -1779,6 +1779,11 @@ int main(int argc, char *argv[])
 	int err = 0, c, lind;
 	ENGINE *eng = NULL;
 
+	OPENSSL_init_crypto(
+#ifndef DISABLE_OPENSSL_CONF
+			    OPENSSL_INIT_LOAD_CONFIG |
+#endif
+			    OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL);
 	g_argv = argv;
 	g_argc = argc;
 

@@ -1899,6 +1904,7 @@ int main(int argc, char *argv[])
 				ENGINE_free(eng);
 				eng = NULL;
 			}
+			ENGINE_set_default(eng, ENGINE_METHOD_ALL);
 			break;
 		case 140: /* --xattr-user */
 			xattr_ima = "user.ima";
src/libimaevm.c +2 -2
index 6783110..3a9ab63 100644
@@ -937,7 +937,7 @@ int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const c
 
 static void libinit()
 {
-	OpenSSL_add_all_algorithms();
-	OPENSSL_add_all_algorithms_conf();
+	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS |
+			    OPENSSL_INIT_ADD_ALL_DIGESTS, NULL);
 	ERR_load_crypto_strings();
 }
Signature · 1 line
2.11.0
maintainer Reviewed-by on v3 1/1
#1 lore raw
Quoted 8 lines · Vitaly Chikunov

Remove deprecated call to OpenSSL_add_all_algorithms(). Allow to disable openssl config loading by evmctl via configure `--disable-openssl-conf' option. Show status of that in configure. Move config loading from libimaevm to evmctl.
Finish engine initialization properly by calling ENGINE_set_default(), as suggested by James Bottomley.

Signed-off-by Vitaly Chikunov <[email protected]>
Reviewed-by Mimi Zohar <[email protected]>