mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-06 16:40:47 +00:00
Allow no_hash to appear in manifest.
sbin/veriexec will ignore entries that have no hash anyway, but loader needs to be explicitly told that such files are ok to ignore (not verify). We will report as Unverified depending on verbose level, but with no reason - because we are not rejecting the file. Reviewed by: imp, mindal_semihalf Sponsored by: Juniper Networks MFC After: 1 week Differential Revision: https://reviews.freebsd.org//D20018
This commit is contained in:
parent
c034ecf316
commit
64ca9a7ff6
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=346604
|
@ -86,6 +86,7 @@ ssize_t ve_pcr_get(unsigned char *, size_t);
|
||||||
#define VEF_VERBOSE 1
|
#define VEF_VERBOSE 1
|
||||||
|
|
||||||
#define VE_FINGERPRINT_OK 1
|
#define VE_FINGERPRINT_OK 1
|
||||||
|
#define VE_FINGERPRINT_IGNORE 2
|
||||||
/* errors from verify_fd */
|
/* errors from verify_fd */
|
||||||
#define VE_FINGERPRINT_NONE -2
|
#define VE_FINGERPRINT_NONE -2
|
||||||
#define VE_FINGERPRINT_WRONG -3
|
#define VE_FINGERPRINT_WRONG -3
|
||||||
|
|
|
@ -120,7 +120,10 @@ vectx_open(int fd, const char *path, off_t off, struct stat *stp, int *error)
|
||||||
ctx->vec_status = VE_FINGERPRINT_NONE;
|
ctx->vec_status = VE_FINGERPRINT_NONE;
|
||||||
ve_error_set("%s: no entry", path);
|
ve_error_set("%s: no entry", path);
|
||||||
} else {
|
} else {
|
||||||
if (strncmp(cp, "sha256=", 7) == 0) {
|
if (strncmp(cp, "no_hash", 7) == 0) {
|
||||||
|
ctx->vec_status = VE_FINGERPRINT_IGNORE;
|
||||||
|
hashsz = 0;
|
||||||
|
} else if (strncmp(cp, "sha256=", 7) == 0) {
|
||||||
ctx->vec_md = &br_sha256_vtable;
|
ctx->vec_md = &br_sha256_vtable;
|
||||||
hashsz = br_sha256_SIZE;
|
hashsz = br_sha256_SIZE;
|
||||||
cp += 7;
|
cp += 7;
|
||||||
|
@ -150,11 +153,13 @@ vectx_open(int fd, const char *path, off_t off, struct stat *stp, int *error)
|
||||||
*error = ctx->vec_status;
|
*error = ctx->vec_status;
|
||||||
ctx->vec_hashsz = hashsz;
|
ctx->vec_hashsz = hashsz;
|
||||||
ctx->vec_want = cp;
|
ctx->vec_want = cp;
|
||||||
ctx->vec_md->init(&ctx->vec_ctx.vtable);
|
if (hashsz > 0) {
|
||||||
|
ctx->vec_md->init(&ctx->vec_ctx.vtable);
|
||||||
|
|
||||||
if (hashsz > 0 && off > 0) {
|
if (off > 0) {
|
||||||
lseek(fd, 0, SEEK_SET);
|
lseek(fd, 0, SEEK_SET);
|
||||||
vectx_lseek(ctx, off, SEEK_SET);
|
vectx_lseek(ctx, off, SEEK_SET);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
return (ctx);
|
return (ctx);
|
||||||
|
|
||||||
|
|
|
@ -345,7 +345,9 @@ verify_fingerprint(int fd, const char *path, const char *cp, off_t off)
|
||||||
size_t hlen;
|
size_t hlen;
|
||||||
int n;
|
int n;
|
||||||
|
|
||||||
if (strncmp(cp, "sha256=", 7) == 0) {
|
if (strncmp(cp, "no_hash", 7) == 0) {
|
||||||
|
return (VE_FINGERPRINT_IGNORE);
|
||||||
|
} else if (strncmp(cp, "sha256=", 7) == 0) {
|
||||||
md = &br_sha256_vtable;
|
md = &br_sha256_vtable;
|
||||||
hlen = br_sha256_SIZE;
|
hlen = br_sha256_SIZE;
|
||||||
cp += 7;
|
cp += 7;
|
||||||
|
@ -423,6 +425,7 @@ verify_fd(int fd, const char *path, off_t off, struct stat *stp)
|
||||||
rc = verify_fingerprint(fd, path, cp, off);
|
rc = verify_fingerprint(fd, path, cp, off);
|
||||||
switch (rc) {
|
switch (rc) {
|
||||||
case VE_FINGERPRINT_OK:
|
case VE_FINGERPRINT_OK:
|
||||||
|
case VE_FINGERPRINT_IGNORE:
|
||||||
case VE_FINGERPRINT_UNKNOWN:
|
case VE_FINGERPRINT_UNKNOWN:
|
||||||
return (rc);
|
return (rc);
|
||||||
default:
|
default:
|
||||||
|
|
|
@ -343,10 +343,14 @@ verify_file(int fd, const char *filename, off_t off, int severity)
|
||||||
if ((rc = verify_fd(fd, filename, off, &st)) >= 0) {
|
if ((rc = verify_fd(fd, filename, off, &st)) >= 0) {
|
||||||
if (verbose || severity > VE_WANT) {
|
if (verbose || severity > VE_WANT) {
|
||||||
#if defined(VE_DEBUG_LEVEL) && VE_DEBUG_LEVEL > 0
|
#if defined(VE_DEBUG_LEVEL) && VE_DEBUG_LEVEL > 0
|
||||||
printf("Verified %s %llu,%llu\n", filename,
|
printf("%serified %s %llu,%llu\n",
|
||||||
|
(rc == VE_FINGERPRINT_IGNORE) ? "Unv" : "V",
|
||||||
|
filename,
|
||||||
(long long)st.st_dev, (long long)st.st_ino);
|
(long long)st.st_dev, (long long)st.st_ino);
|
||||||
#else
|
#else
|
||||||
printf("Verified %s\n", filename);
|
printf("%serified %s\n",
|
||||||
|
(rc == VE_FINGERPRINT_IGNORE) ? "Unv" : "V",
|
||||||
|
filename);
|
||||||
#endif
|
#endif
|
||||||
}
|
}
|
||||||
if (severity < VE_MUST) { /* not a kernel or module */
|
if (severity < VE_MUST) { /* not a kernel or module */
|
||||||
|
|
Loading…
Reference in a new issue