Skip to contentSkip to conversation

ima-evm-utils: Fix reading of sigfile

PATCH In review Vitaly Chikunov 2 participants 3 messages Sep 12, 2020 – Sep 14, 2020 Keys-trusted

lore
Share & tools
lore

Vitaly Chikunov

author
#0 lore raw

PATCH 1/2 ima-evm-utils: Fix reading of sigfile

Fix reading of detached IMA signature (--sigfile). Error message:

Reading to sha1.txt.sig
Failed to fread 147 bytes: sha1.txt.sig
Failed reading: sha1.txt

Reported-by Mimi Zohar <[email protected]>
Fixes 08a51e7460fd ("ima-evm-utils: Fix file2bin stat and fopen relations")
Signed-off-by Vitaly Chikunov <[email protected]>
---
 src/evmctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
src/evmctl.c +1 -1
index 7ad1150..2359550 100644
@@ -221,7 +221,7 @@ static unsigned char *file2bin(const char *file, const char *ext, int *size)
 		fclose(fp);
 		return NULL;
 	}
-	if (fread(data, len, 1, fp) != len) {
+	if (fread(data, len, 1, fp) != 1) {
 		log_err("Failed to fread %zu bytes: %s\n", len, name);
 		fclose(fp);
 		free(data);
Signature · 1 line
2.11.0
author
#1 lore raw

PATCH 2/2 ima-evm-utils: Add test for sigfile reading

Test reading of detached IMA signature (--sigfile).

Suggested-by Mimi Zohar <[email protected]>
Signed-off-by Vitaly Chikunov <[email protected]>
---
 tests/sign_verify.test | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
tests/sign_verify.test +5 -1
index 118c3f6..cddeb15 100755
@@ -93,7 +93,8 @@ _test_sigfile() {
     return "$FAIL"
   fi
 
-  rm "$file_sig" "$file_sig2"
+  # Leave '$file_sig' for ima_verify --sigfile test.
+  rm "$file_sig2"
 }
 
 # Run single sign command

@@ -254,9 +255,12 @@ sign_verify() {
 
     # Normal verify with proper key should pass
     expect_pass check_verify
+    expect_pass check_verify OPTS="--sigfile"
 
     # Multiple files and some don't verify
     expect_fail check_verify FILE="/dev/null $file"
+
+    rm "$FILE.sig"
   fi
 
   TYPE=evm
Signature · 1 line
2.11.0
maintainer
#2 lore raw

Re: [PATCH 2/2] ima-evm-utils: Add test for sigfile reading

Quoted 4 lines · Vitaly Chikunov

Test reading of detached IMA signature (--sigfile).

Suggested-by Mimi Zohar <[email protected]>
Signed-off-by Vitaly Chikunov <[email protected]>

Thanks,

Mimi

Quoted 31 lines
---
 tests/sign_verify.test | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
tests/sign_verify.test +5 -1
index 118c3f6..cddeb15 100755
@@ -93,7 +93,8 @@ _test_sigfile() {
     return "$FAIL"
   fi
 
-  rm "$file_sig" "$file_sig2"
+  # Leave '$file_sig' for ima_verify --sigfile test.
+  rm "$file_sig2"
 }
 
 # Run single sign command

@@ -254,9 +255,12 @@ sign_verify() {
 
     # Normal verify with proper key should pass
     expect_pass check_verify
+    expect_pass check_verify OPTS="--sigfile"
 
     # Multiple files and some don't verify
     expect_fail check_verify FILE="/dev/null $file"
+
+    rm "$FILE.sig"
   fi
 
   TYPE=evm