Hello community, here is the log from the commit of package ima-inspect for openSUSE:Factory checked in at 2017-12-23 12:20:23 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ima-inspect (Old) and /work/SRC/openSUSE:Factory/.ima-inspect.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ima-inspect" Sat Dec 23 12:20:23 2017 rev:2 rq:559308 version:0.11 Changes: -------- --- /work/SRC/openSUSE:Factory/ima-inspect/ima-inspect.changes 2017-10-25 17:47:57.738173342 +0200 +++ /work/SRC/openSUSE:Factory/.ima-inspect.new/ima-inspect.changes 2017-12-23 12:20:25.136855045 +0100 @@ -1,0 +2,9 @@ +Fri Dec 22 11:05:09 UTC 2017 - [email protected] + +- update to upstream version 0.11 which provides new features: + + - support limitation to specific attribute types via -a switch + - support for outputting the cryptographic primitive like digest, + signature or HMAC as hex or binary data + +------------------------------------------------------------------- Old: ---- ima-inspect-dist-0.10.tar.gz New: ---- ima-inspect-dist-0.11.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ima-inspect.spec ++++++ --- /var/tmp/diff_new_pack.9Pvr12/_old 2017-12-23 12:20:26.052810384 +0100 +++ /var/tmp/diff_new_pack.9Pvr12/_new 2017-12-23 12:20:26.052810384 +0100 @@ -1,5 +1,5 @@ # -# spec file for package ima-evm-utils +# spec file for package ima-inspect # # Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. # @@ -17,7 +17,7 @@ Name: ima-inspect -Version: 0.10 +Version: 0.11 Release: 0 Summary: Output IMA/EVM extended attributes in a human readable format License: LGPL-2.1+ @@ -27,9 +27,9 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: autoconf BuildRequires: automake -BuildRequires: libattr-devel -BuildRequires: ima-evm-utils-devel BuildRequires: gcc-c++ +BuildRequires: ima-evm-utils-devel +BuildRequires: libattr-devel BuildRequires: tclap %description ++++++ ima-inspect-dist-0.10.tar.gz -> ima-inspect-dist-0.11.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/ChangeLog new/ima-inspect-0.11/ChangeLog --- old/ima-inspect-0.10/ChangeLog 2017-10-18 15:46:46.000000000 +0200 +++ new/ima-inspect-0.11/ChangeLog 2017-12-22 11:57:40.000000000 +0100 @@ -1,3 +1,11 @@ +2017-12-22 Matthias Gerstner <[email protected]> + + version 0.11 + + - support limitation to specific attribute types via `-a` switch + - support for outputting the cryptographic primitive like digest, + signature or HMAC as hex or binary data + 2017-10-18 Matthias Gerstner <[email protected]> version 0.10 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/LICENSE new/ima-inspect-0.11/LICENSE --- old/ima-inspect-0.10/LICENSE 1970-01-01 01:00:00.000000000 +0100 +++ new/ima-inspect-0.11/LICENSE 2017-10-16 18:32:59.000000000 +0200 @@ -0,0 +1,339 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., <http://fsf.org/> + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + {description} + Copyright (C) {year} {fullname} + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + {signature of Ty Coon}, 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/Makefile.am new/ima-inspect-0.11/Makefile.am --- old/ima-inspect-0.10/Makefile.am 2017-10-18 11:48:52.000000000 +0200 +++ new/ima-inspect-0.11/Makefile.am 2017-12-22 11:57:46.000000000 +0100 @@ -1,3 +1,4 @@ +EXTRA_DIST = README.md LICENSE AM_CXXFLAGS = -std=c++11 -Wall -Werror src_ima_inspect_SOURCES = src/ima_inspect.cxx src/ima_helpers.cxx diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/Makefile.in new/ima-inspect-0.11/Makefile.in --- old/ima-inspect-0.10/Makefile.in 2017-10-18 15:53:19.000000000 +0200 +++ new/ima-inspect-0.11/Makefile.in 2017-12-22 11:57:53.000000000 +0100 @@ -80,7 +80,7 @@ subdir = . DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \ $(top_srcdir)/configure $(am__configure_deps) depcomp AUTHORS \ - ChangeLog README install-sh missing + ChangeLog install-sh missing ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ @@ -276,6 +276,7 @@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ +EXTRA_DIST = README.md LICENSE AM_CXXFLAGS = -std=c++11 -Wall -Werror src_ima_inspect_SOURCES = src/ima_inspect.cxx src/ima_helpers.cxx \ src/ima_inspect.hxx src/ima_exceptions.hxx src/ima_helpers.hxx diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/README new/ima-inspect-0.11/README --- old/ima-inspect-0.10/README 2017-10-18 15:51:32.000000000 +0200 +++ new/ima-inspect-0.11/README 1970-01-01 01:00:00.000000000 +0100 @@ -1,42 +0,0 @@ -INTRODUCTION -============ - -`ima_inspect` is a small program that allows to give a human-readable -representation of the contents of the extended attributes (xattrs) that the -Linux IMA security subsystem creates and manages for files. - -The ima-evm-utils located here: - - https://git.code.sf.net/p/linux-ima/ima-evm-utils - -represent the userspace part of IMA and can be used for creating signatures -and hashes for files. Depending on the kernel command line parameters the -kernel itself updates the hashes for files automatically. - -Please refer to the official IMA documentation for more information. - -`ima_inspect` is a purely read-only inspection utility. The original `evmctl` -tool from ima-evm-utils currently has no way to easily look into the binary -data stored in the extended attributes. - -LICENSE -======= - -Please refer to the LICENSE file. - -BUILDING -======== - -`ima_inspect` requires the following dependencies: - -- the TCLAP C++ command line parsing library -- the ima-emv-utils (development files) -- the libattr development files - -The build system is autotools based and should work as usual. - -USAGE -===== - -Simply pass the files you want to inspect to the program `ima_inspect`. There -is currently no support for recursive listing or any behavioural switches. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/README.md new/ima-inspect-0.11/README.md --- old/ima-inspect-0.10/README.md 1970-01-01 01:00:00.000000000 +0100 +++ new/ima-inspect-0.11/README.md 2017-12-22 11:57:33.000000000 +0100 @@ -0,0 +1,55 @@ +# ima-inspect + +## Introduction + +`ima_inspect` is a small program that allows to give a human-readable +representation of the contents of the extended attributes (xattrs) that the +Linux IMA security subsystem creates and manages for files. + +The ima-evm-utils located [here](https://git.code.sf.net/p/linux-ima/ima-evm-utils) +represent the userspace part of IMA and can be used for creating signatures +and hashes for files. Depending on the kernel command line parameters the +kernel itself updates the hashes for files automatically. + +Please refer to the official IMA documentation for more information. + +`ima_inspect` is a purely read-only inspection utility. The original `evmctl` +tool from ima-evm-utils currently has no way to easily look into the binary +data stored in the extended attributes. + +## Usage + +Simply pass the files you want to inspect to the program `ima_inspect`. There +is currently no support for recursive listing of directories at the moment. + +You can limit the output to only the `security.evm` or `security.ima` +attribute by specifying the command line switch `-a ima` or `-a evm`, +respectively. + +You can extract the plain cryptographic primitive from the attribute by +specifying both `-a` and `--out <hex, bin>`. The cryptographic primitive is +the plain signature, digest or HMAC depending on the subtype of the attribute. +With this you can for example verify IMA signatures from userspace like this: + +```sh +$ ima_inspect some_file -o bin -a ima >ima_signature.bin +$ openssl dgst -sha256 -verify ima_public.pem -keyform PEM -signature ./ima_signature.bin some_file +``` + +Remember that the digest algorithm and public key must match the ones used in +the `security.ima` attribute. + +## Building + +`ima_inspect` requires the following dependencies: + +- the TCLAP C++ command line parsing library +- the ima-emv-utils (development files) +- the libattr development files + +The build system is autotools based and should work as usual. + + +## License + +Please refer to the LICENSE file. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/configure new/ima-inspect-0.11/configure --- old/ima-inspect-0.10/configure 2017-10-18 15:53:20.000000000 +0200 +++ new/ima-inspect-0.11/configure 2017-12-22 11:57:53.000000000 +0100 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for ima-inspect 0.10. +# Generated by GNU Autoconf 2.69 for ima-inspect 0.11. # # Report bugs to <https://github.com/mgerstner/ima-inspect/issues>. # @@ -579,8 +579,8 @@ # Identity of this package. PACKAGE_NAME='ima-inspect' PACKAGE_TARNAME='ima-inspect' -PACKAGE_VERSION='0.10' -PACKAGE_STRING='ima-inspect 0.10' +PACKAGE_VERSION='0.11' +PACKAGE_STRING='ima-inspect 0.11' PACKAGE_BUGREPORT='https://github.com/mgerstner/ima-inspect/issues' PACKAGE_URL='https://github.com/mgerstner/ima-inspect' @@ -1243,7 +1243,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures ima-inspect 0.10 to adapt to many kinds of systems. +\`configure' configures ima-inspect 0.11 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1309,7 +1309,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of ima-inspect 0.10:";; + short | recursive ) echo "Configuration of ima-inspect 0.11:";; esac cat <<\_ACEOF @@ -1410,7 +1410,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -ima-inspect configure 0.10 +ima-inspect configure 0.11 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -1549,7 +1549,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by ima-inspect $as_me 0.10, which was +It was created by ima-inspect $as_me 0.11, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2983,7 +2983,7 @@ # Define the identity of the package. PACKAGE='ima-inspect' - VERSION='0.10' + VERSION='0.11' cat >>confdefs.h <<_ACEOF @@ -4675,7 +4675,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by ima-inspect $as_me 0.10, which was +This file was extended by ima-inspect $as_me 0.11, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -4733,7 +4733,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -ima-inspect config.status 0.10 +ima-inspect config.status 0.11 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/configure.ac new/ima-inspect-0.11/configure.ac --- old/ima-inspect-0.10/configure.ac 2017-10-18 15:52:37.000000000 +0200 +++ new/ima-inspect-0.11/configure.ac 2017-12-22 11:57:40.000000000 +0100 @@ -1,5 +1,5 @@ AC_INIT([ima-inspect], - [0.10], + [0.11], [https://github.com/mgerstner/ima-inspect/issues], [], [https://github.com/mgerstner/ima-inspect]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/src/ima_inspect.cxx new/ima-inspect-0.11/src/ima_inspect.cxx --- old/ima-inspect-0.10/src/ima_inspect.cxx 2017-10-18 15:40:18.000000000 +0200 +++ new/ima-inspect-0.11/src/ima_inspect.cxx 2017-12-22 11:30:26.000000000 +0100 @@ -82,27 +82,84 @@ ImaInspect::ImaInspect() : m_cmdline("This utility allows to display security.ima and " "security.evm extended attributes created by the " - "'evmctl' utility from ima-evm-utils."), - m_arg_files("files", "one or more files to inspect", true, "path", - m_cmdline) + "'evmctl' utility from ima-evm-utils." + ), + m_arg_attr("a", "attr", + "Type of attribute to inspect. By default all attributes are displayed.", + false, + "", + "[security.]ima, [security.]evm", + m_cmdline + ), + m_arg_output("o", "out", + "Instead of displaying the attribute selected via -a, output " + "just the cryptographic primitive in the given format to " + "stdout. This data contains just the signature, HMAC or " + "digest data, depending on the attribute content.", + false, + "hex", + "hex, bin", + m_cmdline + ), + m_arg_files("files", "One or more files to inspect.", true, "path", + m_cmdline + ) { + m_outstream = &std::cout; } void ImaInspect::parseArgs(const int argc, const char **argv) { m_cmdline.parse(argc, argv); + + if( m_arg_attr.isSet() ) + { + const auto &attr = m_arg_attr.getValue(); + + if( attr.find("ima") == attr.npos && + attr.find("evm") == attr.npos ) + { + throw UsageError("ambiguous or invalid value for --attr encountered"); + } + } + + if( m_arg_output.isSet() ) + { + if( ! m_arg_attr.isSet() ) + { + throw UsageError("--out also required --attr"); + } + + const auto &out = m_arg_output.getValue(); + + if( out != "hex" && out != "bin" ) + { + throw UsageError("invalid value for --out encountered"); + } + + m_dump_as_binary = m_arg_output.getValue() == "bin"; + + if( m_dump_as_binary && isatty(STDOUT_FILENO) == 1 ) + { + throw UsageError("refusing to output binary data to terminal"); + } + + setupNullOut(); + } } void ImaInspect::run() { bool first = true; + auto &out = getOutstream(); + for( const auto &file: m_arg_files.getValue() ) { try { - if( first ) first = false; else std::cout << "\n"; - std::cout << file << "\n"; + if( first ) first = false; else out << "\n"; + out << file << "\n"; inspectFile(file); } catch( const std::exception &ex ) @@ -122,13 +179,18 @@ throw SysError("open"); } + auto &out = getOutstream(); + for( const auto &attr: m_attr_names ) { + if( skipAttr(attr) ) + continue; + try { - std::cout << "\n"; - std::cout << attr << "\n"; - std::cout << std::string(attr.size(), '-') << "\n"; + out << "\n"; + out << attr << "\n"; + out << std::string(attr.size(), '-') << "\n"; bool have_attr = getAttr(fd, attr); if( !have_attr ) @@ -152,6 +214,8 @@ m_attr_data.clear(); int res = -1; + auto &out = getOutstream(); + while( true ) { res = fgetxattr( @@ -171,7 +235,7 @@ } else if( errno == ENOATTR ) { - std::cout << "no such attribute\n"; + out << "no such attribute\n"; // no attribute return false; } @@ -215,6 +279,37 @@ } } +bool ImaInspect::skipAttr(const std::string &attr) +{ + if( !m_arg_attr.isSet() ) + { + return false; + } + + // support any substring as argument for simplicity + return attr.find(m_arg_attr.getValue()) == attr.npos; +} + +void ImaInspect::setupNullOut() +{ + m_null_dev.open("/dev/null"); + m_outstream = &m_null_dev; +} + +void ImaInspect::dumpData(const uint8_t *p, const size_t bytes) const +{ + // explicitly use std::cout here, because in this mode of operation + // the dump shall not be discarded to /dev/null. + if( m_dump_as_binary ) + { + std::cout.write(reinterpret_cast<const char*>(p), bytes); + } + else + { + std::cout << HexDumpData(p, bytes); + } +} + template<typename T> void ImaInspect::fetchNextType(T*& out_ptr, const char *label) const { @@ -244,7 +339,7 @@ inspectDigsig(); break; default: - std::cout << "unknown IMA/EVM attribute tagged with " + std::cerr << "unknown IMA/EVM attribute tagged with " << static_cast<int>(type) << std::endl; break; } @@ -258,7 +353,9 @@ assertDataLeft(1, "digsig version"); uint8_t digsig_version = static_cast<uint8_t>(*nextData()); - std::cout << "digital signature version " << (unsigned)digsig_version + auto &out = getOutstream(); + + out << "digital signature version " << (unsigned)digsig_version << "\n"; switch(digsig_version) @@ -279,7 +376,8 @@ inspectDigsigV2(); break; default: - std::cout << "unknown digital signature version encountered\n"; + std::cerr << "unknown digital signature version encountered\n"; + m_res = 2; break; } } @@ -289,39 +387,49 @@ const struct signature_hdr* header; fetchNextType(header, "signature_hdr"); + // following is a header containing the length of the signature in bits + const uint16_t *mpi_length_be; + fetchNextType(mpi_length_be, "mpi_length"); + + const auto mpi_length_host = ntohs(*mpi_length_be); + + // shift by 3 (div by 8) gives us the bytes unit again + const auto mpi_length_bytes = mpi_length_host >> 3; + const uint8_t *mpi_sig = reinterpret_cast<const uint8_t*>( + fetchNextData(mpi_length_bytes, "mpi_sig") + ); + + if( m_arg_output.isSet() ) + { + return dumpData(mpi_sig, mpi_length_bytes); + } + + auto &out = getOutstream(); + time_t ts = static_cast<time_t>(header->timestamp); // NOTE: ctime() seems to include a newline already - std::cout << "creation time: " << ::ctime(&ts); + out << "creation time: " << ::ctime(&ts); auto sig_algo = static_cast<pubkey_algo>(header->algo); - std::cout << "signature algorithm: " + out << "signature algorithm: " << getSignAlgoLabel(sig_algo) << "\n"; auto dig_algo = static_cast<digest_algo>(header->hash); - std::cout << "digest algorithm: " + out << "digest algorithm: " << getDigestAlgoLabel(dig_algo) << "\n"; // these are bytes 12 - 19 of the sha1 digest of the binary public key // used // TODO: does this need to be displayed in big-endian? // see calc_keyid_v1() from libimaevm.c - std::cout << "key-id v1 (gpg compatible): " + out << "key-id v1 (gpg compatible): " << HexDumpData(header->keyid, sizeof(header->keyid)) << "\n"; // the kernel digsig code was taken from the GMP library, thus the // nomenclature // also see kernel Documentation/digsig.txt - std::cout << "nmpi (number of multi-precision-integers): " + out << "nmpi (number of multi-precision-integers): " << (size_t)header->nmpi << "\n"; - // following is a header containing the length of the signature in bits - const uint16_t *mpi_length_be; - fetchNextType(mpi_length_be, "mpi_length"); - const auto mpi_length_host = ntohs(*mpi_length_be); - std::cout << "signature length: " << mpi_length_host << " bits\n"; + out << "signature length: " << mpi_length_host << " bits\n"; - // shift by 3 (div by 8) gives us the bytes unit again - const auto mpi_length_bytes = mpi_length_host >> 3; - const uint8_t *mpi_sig = reinterpret_cast<const uint8_t*>( - fetchNextData(mpi_length_bytes, "mpi_sig") - ); - std::cout << "signature data:\n\n" + out << "signature data:\n\n" << HexDumpData(mpi_sig, mpi_length_bytes) << "\n"; } @@ -330,64 +438,92 @@ const struct signature_v2_hdr* header; fetchNextType(header, "signature_v2_hdr"); auto hash_algo = static_cast<pkey_hash_algo>(header->hash_algo); - std::cout << "digest algorithm: " << getHashAlgoLabel(hash_algo) << "\n"; + const auto sig_size_bytes = ntohs(header->sig_size); + const auto sig_size_bits = sig_size_bytes << 3; + const uint8_t *sig_data = reinterpret_cast<const uint8_t*>( + fetchNextData(sig_size_bytes, "sig") + ); + + if( m_arg_output.isSet() ) + { + return dumpData(sig_data, sig_size_bytes); + } + + auto &out = getOutstream(); + out << "digest algorithm: " << getHashAlgoLabel(hash_algo) << "\n"; // for V2 the keyid is only 4 bytes long for some reason // TODO: does this need to be displayed in big-endian? - std::cout << "key-id v2 (gpg compatible): " + out << "key-id v2 (gpg compatible): " << HexDumpData( reinterpret_cast<const uint8_t*>(&header->keyid), sizeof(header->keyid) ) << "\n"; - const auto sig_size_bytes = ntohs(header->sig_size); - const auto sig_size_bits = sig_size_bytes << 3; - std::cout << "signature length: " << sig_size_bits << " bits\n"; + out << "signature length: " << sig_size_bits << " bits\n"; - const uint8_t *sig_data = reinterpret_cast<const uint8_t*>( - fetchNextData(sig_size_bytes, "sig") - ); - std::cout << "signature data:\n\n" + out << "signature data:\n\n" << HexDumpData(sig_data, sig_size_bytes) << "\n"; } void ImaInspect::inspectDigest() const { - std::cout << "digest (legacy sha1)" << "\n"; + auto &out = getOutstream(); const auto digest_len = m_attr_data_left; - std::cout << "digest length: " << digest_len << " bytes\n"; const uint8_t *digest = reinterpret_cast<const uint8_t*>( fetchNextData(digest_len, "digest") ); - std::cout << "digest: " << HexDumpData(digest, digest_len) << "\n"; + + if( m_arg_output.isSet() ) + { + return dumpData(digest, digest_len); + } + + out << "digest (legacy sha1)" << "\n"; + out << "digest length: " << digest_len << " bytes\n"; + out << "digest: " << HexDumpData(digest, digest_len) << "\n"; } void ImaInspect::inspectDigestNg() const { - std::cout << "digest (NG)" << "\n"; + auto &out = getOutstream(); const uint8_t *algo; fetchNextType(algo, "digest-ng algo"); const auto algo_enum = static_cast<enum pkey_hash_algo>(*algo); - std::cout << "digest algorithm: " << getHashAlgoLabel(algo_enum) << "\n"; const auto digest_len = m_attr_data_left; - std::cout << "digest length: " << m_attr_data_left << " bytes\n"; const uint8_t *digest = reinterpret_cast<const uint8_t*>( fetchNextData(digest_len, "digest") ); - std::cout << "digest: " << HexDumpData(digest, digest_len) << "\n"; + + if( m_arg_output.isSet() ) + { + return dumpData(digest, digest_len); + } + + out << "digest (NG)" << "\n"; + out << "digest algorithm: " << getHashAlgoLabel(algo_enum) << "\n"; + out << "digest length: " << m_attr_data_left << " bytes\n"; + out << "digest: " << HexDumpData(digest, digest_len) << "\n"; } void ImaInspect::inspectHmac() const { - // The EVM HMAC seems still to be fixed at SHA1? - std::cout << "EVM HMAC\n"; - std::cout << "digest algo: sha1 (fixed)\n"; + auto &out = getOutstream(); const auto digest_len = m_attr_data_left; - std::cout << "digest length: " << digest_len << " bytes\n"; const uint8_t *digest = reinterpret_cast<const uint8_t*>( fetchNextData(digest_len, "digest") ); - std::cout << "digest: " << HexDumpData(digest, digest_len) << "\n"; + + if( m_arg_output.isSet() ) + { + return dumpData(digest, digest_len); + } + + // The EVM HMAC seems still to be fixed at SHA1? + out << "EVM HMAC\n"; + out << "digest algo: sha1 (fixed)\n"; + out << "digest length: " << digest_len << " bytes\n"; + out << "digest: " << HexDumpData(digest, digest_len) << "\n"; } int main(const int argc, const char **argv) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ima-inspect-0.10/src/ima_inspect.hxx new/ima-inspect-0.11/src/ima_inspect.hxx --- old/ima-inspect-0.10/src/ima_inspect.hxx 2017-10-18 15:11:04.000000000 +0200 +++ new/ima-inspect-0.11/src/ima_inspect.hxx 2017-11-24 10:17:05.000000000 +0100 @@ -9,6 +9,8 @@ // C++ #include <array> +#include <iostream> +#include <fstream> // third-party #include <tclap/CmdLine.h> @@ -63,9 +65,23 @@ void assertDataLeft(const size_t bytes, const char *purpose) const; + //! returns whether we should skip display of the given attribute + bool skipAttr(const std::string &attr); + + void setupNullOut(); + + //! returns the output stream for human readable output + std::ostream& getOutstream() const { return *m_outstream; } + + /** + * \brief + * Dumps the given data area according to m_arg_output + **/ + void dumpData(const uint8_t *p, const size_t bytes) const; + protected: // data - int m_res = 0; + mutable int m_res = 0; //! holds the currently handled xattr value std::vector<char> m_attr_data; //! how much bytes are left unprocessed in the current m_attr_data @@ -74,8 +90,17 @@ // the xattr names to inspect per file static const std::array<std::string, 2> m_attr_names; + //! where regular messages should be written to + mutable std::ostream *m_outstream = nullptr; + //! an output stream ending up in /dev/null + std::fstream m_null_dev; + //! cached converted value for m_arg_output + bool m_dump_as_binary = false; + // command line parsing TCLAP::CmdLine m_cmdline; + TCLAP::ValueArg<std::string> m_arg_attr; + TCLAP::ValueArg<std::string> m_arg_output; TCLAP::UnlabeledMultiArg<std::string> m_arg_files; };
