Skip to contentSkip to conversation

ima-evm-utils: Fix ima_verify return value on multiple files

PATCH In review Vitaly Chikunov 2 participants 6 messages Jul 27, 2019 – Jul 30, 2019 Keys-trusted

lore
Share & tools
lore

Vitaly Chikunov

author
#0 lore raw

PATCH 1/2 ima-evm-utils: Fix ima_verify return value on multiple files

If any tested file results in failure produce failure exit code. Previously exit code affected only by the last file tested.

Fixes "Allow multiple files in ima_verify"
Signed-off-by Vitaly Chikunov <[email protected]>

---

I decided not to rebase "Allow multiple files in ima_verify" to not create merge conflicts with "Namespace some too generic object names".

 src/evmctl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
src/evmctl.c +4 -2
index b02be8b..d33a91e 100644
@@ -887,7 +887,7 @@ static int verify_ima(const char *file)
 static int cmd_verify_ima(struct command *cmd)
 {
 	char *file = g_argv[optind++];
-	int err;
+	int err, fails = 0;
 
 	if (imaevm_params.keyfile)	/* Support multiple public keys */
 		init_public_keys(imaevm_params.keyfile);

@@ -903,10 +903,12 @@ static int cmd_verify_ima(struct command *cmd)
 
 	do {
 		err = verify_ima(file);
+		if (err)
+			fails++;
 		if (!err && imaevm_params.verbose >= LOG_INFO)
 			log_info("%s: verification is OK\n", file);
 	} while ((file = g_argv[optind++]));
-	return err;
+	return fails > 0;
 }
 
 static int cmd_convert(struct command *cmd)
Signature · 1 line
2.11.0
author
#1 lore raw

PATCH 2/2 ima-evm-utils: Never exit with -1 code

Change main() return code from -1 to 125 as -1 is not really valid exit code. 125 is choosen because exit codes for signals start from 126.

Signed-off-by Vitaly Chikunov <[email protected]>
---
 src/evmctl.c | 2 ++
 1 file changed, 2 insertions(+)
src/evmctl.c +2 -0
index d33a91e..e0a835f 100644
@@ -2100,6 +2100,8 @@ int main(int argc, char *argv[])
 				break;
 			log_err("%s\n", ERR_error_string(error, NULL));
 		}
+		if (err < 0)
+			err = 125;
 	}
 
 	if (eng) {
Signature · 1 line
2.11.0
#5 lore raw
In reply to Vitaly Chikunov
Quoted 9 lines · Vitaly Chikunov

If any tested file results in failure produce failure exit code. Previously exit code affected only by the last file tested.

Fixes "Allow multiple files in ima_verify"
Signed-off-by Vitaly Chikunov <[email protected]>

---

I decided not to rebase "Allow multiple files in ima_verify" to not create merge conflicts with "Namespace some too generic object names".

This is fine, thanks.

Mimi

#2 lore raw

Re: [PATCH 2/2] ima-evm-utils: Never exit with -1 code

In reply to Vitaly Chikunov
Quoted 13 lines · Vitaly Chikunov

Change main() return code from -1 to 125 as -1 is not really valid exit code. 125 is choosen because exit codes for signals start from 126.

Signed-off-by Vitaly Chikunov <[email protected]>
---
 src/evmctl.c | 2 ++
 1 file changed, 2 insertions(+)
src/evmctl.c +0 -0
index d33a91e..e0a835f 100644

src/evmctl.c int main(int argc, char *argv[]) · line 2107

Quoted 8 lines
src/evmctl.c +2 -0
@@ -2100,6 +2100,8 @@ int main(int argc, char *argv[])
 				break;
 			log_err("%s\n", ERR_error_string(error, NULL));
 		}
+		if (err < 0)
+			err = 125;
 	}
 
 	if (eng) {

Agreed we need to return better errors, but instead of always returning 125, would it be better to return the first errno, if err is -1?

Mimi

author
#3 lore raw

Re: [PATCH 2/2] ima-evm-utils: Never exit with -1 code

Mimi,

Quoted 21 lines · Mimi Zohar
Quoted 20 lines · Vitaly Chikunov

Change main() return code from -1 to 125 as -1 is not really valid exit code. 125 is choosen because exit codes for signals start from 126.

Signed-off-by Vitaly Chikunov <[email protected]>
---
 src/evmctl.c | 2 ++
 1 file changed, 2 insertions(+)
src/evmctl.c +2 -0
index d33a91e..e0a835f 100644
@@ -2100,6 +2100,8 @@ int main(int argc, char *argv[])
 				break;
 			log_err("%s\n", ERR_error_string(error, NULL));
 		}
+		if (err < 0)
+			err = 125;
 	}
Quoted 5 lines

src/evmctl.c int main(int argc, char *argv[]) · line 2107

Quoted 1 line
src/evmctl.c +0 -0
 	if (eng) {

Agreed we need to return better errors, but instead of always returning 125, would it be better to return the first errno, if err is -1?

125 will be not always but only to avoid returning -1 (or any negative).

There is no practice to exit with errno, AFAIK. Plus, errno we have at the end (and which is reported to user) frequently is bogus and that should be fixed. (I may do this later maybe, don't know how much work that would require).

We also wish to reserve some exit code as hard error for tests.

Thanks,

Quoted 2 lines

Mimi

author
#4 lore raw

Re: [PATCH 2/2] ima-evm-utils: Never exit with -1 code

Quoted 12 lines · Vitaly Chikunov
Quoted 10 lines · Mimi Zohar

src/evmctl.c int main(int argc, char *argv[]) · line 2107

Quoted 5 lines · Vitaly Chikunov
src/evmctl.c +2 -0
+		if (err < 0)
+			err = 125;
 	}
 
 	if (eng) {

Agreed we need to return better errors, but instead of always returning 125, would it be better to return the first errno, if err is -1?

Quoted 8 lines

125 will be not always but only to avoid returning -1 (or any negative).

There is no practice to exit with errno, AFAIK. Plus, errno we have at the end (and which is reported to user) frequently is bogus and that should be fixed. (I may do this later maybe, don't know how much work that would require).

We also wish to reserve some exit code as hard error for tests.

I meant 'we also may wish'... This needs to be thought over.