commit: 2c38515f011fb75697dae1d7456be62f8cf9b73e Author: Christopher Byrne <salah.coronya <AT> gmail <DOT> com> AuthorDate: Sat Nov 6 20:58:58 2021 +0000 Commit: Sam James <sam <AT> gentoo <DOT> org> CommitDate: Sat Feb 26 02:40:52 2022 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2c38515f
app-crypt/ima-evm-utils: Bump to 1.4 Package-Manager: Portage-3.0.28, Repoman-3.0.3 Signed-off-by: Christopher Byrne <salah.coronya <AT> gmail.com> Closes: https://bugs.gentoo.org/822165 Closes: https://github.com/gentoo/gentoo/pull/22850 Signed-off-by: Sam James <sam <AT> gentoo.org> app-crypt/ima-evm-utils/Manifest | 1 + ...nfigure-remove-automagic-TSS-dependencies.patch | 39 ++++ ...Rename-bash-variable-WORKDIR-to-MYWORKDIR.patch | 84 ++++++++ ...-evm-utils-1.4-test-remove-boot_aggregate.patch | 216 +++++++++++++++++++++ app-crypt/ima-evm-utils/ima-evm-utils-1.4.ebuild | 52 +++++ app-crypt/ima-evm-utils/metadata.xml | 3 + 6 files changed, 395 insertions(+) diff --git a/app-crypt/ima-evm-utils/Manifest b/app-crypt/ima-evm-utils/Manifest index 02f3d5d79e9d..3485816848d5 100644 --- a/app-crypt/ima-evm-utils/Manifest +++ b/app-crypt/ima-evm-utils/Manifest @@ -1,2 +1,3 @@ DIST ima-evm-utils-1.1.tar.gz 37825 BLAKE2B 469f5bbc194f3fcc8996f252d01745c0d8d4d4f63476174622ea4569c97978db478bd522ae4672819c5ef995f2bb524eb857e5bf5c303131959f2f5cb9c2ebcc SHA512 fc7efc890812233db888eef210dc4357bee838b56fd95efd9a9e141d684b0b354670a3c053dd93a94a1402dd826074d4a83a4637c8e6c1d90ead3132354a5776 DIST ima-evm-utils-1.3.2.tar.gz 100373 BLAKE2B 04717a934795f7e2a351b1f59388d2d429e00a8a18c57c0eb258bb81bc329342cb9971fa2b4493f7b492f07961ec794a0549fd2d0984381492dcab474915a0d6 SHA512 af96935f953fbec8cdd40ba1a24001fae916633df03f9dee1e96775baec0ffea21a7a13798b3e3c3f375fd493a65fe65b5357887890b46cac0c4dcca5a5b79db +DIST ima-evm-utils-1.4.tar.gz 110104 BLAKE2B 12e09162e0d5e689132dde6b814ceeb8001a0379e8edb89b9aeb87c8e9f6e21fdd554e6626d1496b82cc77213fdf08b26bcc0be77140d7d598589a482940a321 SHA512 2fdf41470d88608162a084c4877ba17d531941b744bcb44dd4913e48ab2c2d131e0af3e3ead74c18748a5d46aced51213ebd7c13a5ee19050c28d54a26c011a3 diff --git a/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-configure-remove-automagic-TSS-dependencies.patch b/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-configure-remove-automagic-TSS-dependencies.patch new file mode 100644 index 000000000000..a5fb28a291fb --- /dev/null +++ b/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-configure-remove-automagic-TSS-dependencies.patch @@ -0,0 +1,39 @@ +From 911cef2b984a947b1020bdcf87d1573600ea754d Mon Sep 17 00:00:00 2001 +From: Christopher Byrne <[email protected]> +Date: Fri, 5 Nov 2021 21:31:10 -0500 +Subject: [PATCH] configure.ac: Remove automagic dependencies on the TSS stacks + +Signed-off-by: Christopher Byrne <[email protected]> +--- + configure.ac | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 1a0f093..c05b72d 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -31,12 +31,18 @@ AC_CHECK_HEADER(unistd.h) + AC_CHECK_HEADERS(openssl/conf.h) + + # Intel TSS +-AC_CHECK_LIB([tss2-esys], [Esys_Free]) +-AC_CHECK_LIB([tss2-rc], [Tss2_RC_Decode]) ++AC_ARG_WITH([pcrtss], AS_HELP_STRING([--with-pcrtss], [Build with Intel TSS library (default: disabled)])) ++AS_IF([test "x$with_pcrtss" = "xyes"], [ ++ AC_CHECK_LIB([tss2-esys], [Esys_Free]) ++ AC_CHECK_LIB([tss2-rc], [Tss2_RC_Decode]) ++]) + AM_CONDITIONAL([USE_PCRTSS], [test "x$ac_cv_lib_tss2_esys_Esys_Free" = "xyes"]) + + # IBM TSS include files +-AC_CHECK_HEADER(ibmtss/tss.h, [], [], [[#define TPM_POSIX]]) ++AC_ARG_WITH([ibmtss], AS_HELP_STRING([--with-ibmtss], [Build with IBM TSS library (default: disabled)])) ++AS_IF([test "x$with_ibmtss" = "xyes"], [ ++ AC_CHECK_HEADER(ibmtss/tss.h, [], [], [[#define TPM_POSIX]]) ++]) + AM_CONDITIONAL([USE_IBMTSS], [test "x$ac_cv_header_ibmtss_tss_h" = "xyes"]) + + AC_CHECK_HEADERS(sys/xattr.h, , [AC_MSG_ERROR([sys/xattr.h header not found. You need the c-library development package.])]) +-- +2.32.0 + diff --git a/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-test-Rename-bash-variable-WORKDIR-to-MYWORKDIR.patch b/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-test-Rename-bash-variable-WORKDIR-to-MYWORKDIR.patch new file mode 100644 index 000000000000..41dd2cd6fb0c --- /dev/null +++ b/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-test-Rename-bash-variable-WORKDIR-to-MYWORKDIR.patch @@ -0,0 +1,84 @@ +From 5be7797f96db606c16701b6cb7e218a487c4cf4a Mon Sep 17 00:00:00 2001 +From: Christopher Byrne <[email protected]> +Date: Sat, 6 Nov 2021 15:36:48 -0500 +Subject: [PATCH] test: Rename bash variable WORKDIR to MYWORKDIR + +Gentoo Portage ALSO uses the variable WORKDIR, and this results in +Portage deleting the entire tree if the tests are run under it + +Signed-off-by: Christopher Byrne <[email protected]> +--- + tests/functions.sh | 12 ++++++------ + tests/sign_verify.test | 6 +++--- + 2 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/tests/functions.sh b/tests/functions.sh +index 8f6f02d..eb6b34a 100755 +--- a/tests/functions.sh ++++ b/tests/functions.sh +@@ -250,8 +250,8 @@ _enable_gost_engine() { + # Show test stats and exit into automake test system + # with proper exit code (same as ours). Do cleanups. + _report_exit_and_cleanup() { +- if [ -n "${WORKDIR}" ]; then +- rm -rf "${WORKDIR}" ++ if [ -n "${MYWORKDIR}" ]; then ++ rm -rf "${MYWORKDIR}" + fi + + if [ $testsfail -gt 0 ]; then +@@ -277,19 +277,19 @@ _report_exit_and_cleanup() { + } + + # Setup SoftHSM for local testing by calling the softhsm_setup script. +-# Use the provided workdir as the directory where SoftHSM will store its state ++# Use the provided myworkdir as the directory where SoftHSM will store its state + # into. + # Upon successfully setting up SoftHSM, this function sets the global variables + # OPENSSL_ENGINE and OPENSSL_KEYFORM so that the openssl command line tool can + # use SoftHSM. Also the PKCS11_KEYURI global variable is set to the test key's + # pkcs11 URI. + _softhsm_setup() { +- local workdir="$1" ++ local myworkdir="$1" + + local msg + +- export SOFTHSM_SETUP_CONFIGDIR="${workdir}/softhsm" +- export SOFTHSM2_CONF="${workdir}/softhsm/softhsm2.conf" ++ export SOFTHSM_SETUP_CONFIGDIR="${myworkdir}/softhsm" ++ export SOFTHSM2_CONF="${myworkdir}/softhsm/softhsm2.conf" + + mkdir -p "${SOFTHSM_SETUP_CONFIGDIR}" + +diff --git a/tests/sign_verify.test b/tests/sign_verify.test +index c56290a..b619c22 100755 +--- a/tests/sign_verify.test ++++ b/tests/sign_verify.test +@@ -29,7 +29,7 @@ fi + ./gen-keys.sh >/dev/null 2>&1 + + trap _report_exit_and_cleanup EXIT +-WORKDIR=$(mktemp -d) ++MYWORKDIR=$(mktemp -d) + set -f # disable globbing + + # Determine keyid from a cert +@@ -426,7 +426,7 @@ expect_fail \ + check_sign TYPE=ima KEY=gost2012_256-B ALG=md_gost12_512 PREFIX=0x0302 OPTS= + + # Test signing with key described by pkcs11 URI +-_softhsm_setup "${WORKDIR}" ++_softhsm_setup "${MYWORKDIR}" + if [ -n "${PKCS11_KEYURI}" ]; then + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY=${PKCS11_KEYURI} ALG=sha256 PREFIX=0x030204aabbccdd0100 OPTS=--keyid=aabbccdd + expect_pass check_sign FILE=pkcs11test TYPE=ima KEY=${PKCS11_KEYURI} ALG=sha1 PREFIX=0x030202aabbccdd0100 OPTS=--keyid=aabbccdd +@@ -436,4 +436,4 @@ else + expect_pass __skip + expect_pass __skip + fi +-_softhsm_teardown "${WORKDIR}" ++_softhsm_teardown "${MYWORKDIR}" +-- +2.32.0 + diff --git a/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-test-remove-boot_aggregate.patch b/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-test-remove-boot_aggregate.patch new file mode 100644 index 000000000000..701a81614f78 --- /dev/null +++ b/app-crypt/ima-evm-utils/files/ima-evm-utils-1.4-test-remove-boot_aggregate.patch @@ -0,0 +1,216 @@ +diff --git a/tests/Makefile.am b/tests/Makefile.am +index ff928e1..029f2ff 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -1,7 +1,7 @@ + check_SCRIPTS = + TESTS = $(check_SCRIPTS) + +-check_SCRIPTS += ima_hash.test sign_verify.test boot_aggregate.test ++check_SCRIPTS += ima_hash.test sign_verify.test + + clean-local: + -rm -f *.txt *.out *.sig *.sig2 +diff --git a/tests/boot_aggregate.test b/tests/boot_aggregate.test +deleted file mode 100755 +index d711566..0000000 +--- a/tests/boot_aggregate.test ++++ /dev/null +@@ -1,197 +0,0 @@ +-#!/bin/bash +- +-# +-# Calculate the boot_aggregate for each TPM bank, verifying that the +-# boot_aggregate in the IMA measurement list matches one of them. +-# +-# A software TPM may be used to verify the boot_aggregate. If a +-# software TPM is not already running on the system, this test +-# starts one and initializes the TPM PCR banks by walking the sample +-# binary_bios_measurements event log, included in this directory, and +-# extending the TPM PCRs. The associated ascii_runtime_measurements +-# for verifying the calculated boot_aggregate is included in this +-# directory as well. +- +-trap cleanup SIGINT SIGTERM EXIT +- +-# Base VERBOSE on the environment variable, if set. +-VERBOSE="${VERBOSE:-0}" +- +-cd "$(dirname "$0")" +-export PATH=../src:$PATH +-export LD_LIBRARY_PATH=$LD_LIBRARY_PATH +-. ./functions.sh +-_require evmctl +-TSSDIR="$(dirname -- "$(which tssstartup)")" +-PCRFILE="/sys/class/tpm/tpm0/device/pcrs" +-MISC_PCRFILE="/sys/class/misc/tpm0/device/pcrs" +- +-# Only stop this test's software TPM +-cleanup() { +- if [ -n "${SWTPM_PID}" ]; then +- kill -SIGTERM "${SWTPM_PID}" +- elif [ -n "${TPMSERVER_PID}" ]; then +- "${TSSDIR}/tsstpmcmd" -stop +- fi +-} +- +-# Try to start a software TPM if needed. +-swtpm_start() { +- local tpm_server swtpm +- +- tpm_server="$(which tpm_server)" +- swtpm="$(which swtpm)" +- if [ -z "${tpm_server}" ] && [ -z "${swtpm}" ]; then +- echo "${CYAN}SKIP: Software TPM (tpm_server and swtpm) not found${NORM}" +- return "$SKIP" +- fi +- +- if [ -n "${swtpm}" ]; then +- pgrep swtpm +- if [ $? -eq 0 ]; then +- echo "INFO: Software TPM (swtpm) already running" +- return 114 +- else +- echo "INFO: Starting software TPM: ${swtpm}" +- mkdir -p ./myvtpm +- ${swtpm} socket --tpmstate dir=./myvtpm --tpm2 --ctrl type=tcp,port=2322 --server type=tcp,port=2321 --flags not-need-init > /dev/null 2>&1 & +- SWTPM_PID=$! +- fi +- elif [ -n "${tpm_server}" ]; then +- # tpm_server uses the Microsoft simulator encapsulated packet format +- export TPM_SERVER_TYPE="mssim" +- pgrep tpm_server +- if [ $? -eq 0 ]; then +- echo "INFO: Software TPM (tpm_server) already running" +- return 114 +- else +- echo "INFO: Starting software TPM: ${tpm_server}" +- ${tpm_server} > /dev/null 2>&1 & +- TPMSERVER_PID=$! +- fi +- fi +- return 0 +-} +- +-# Initialize the software TPM using the sample binary_bios_measurements log. +-swtpm_init() { +- if [ ! -f "${TSSDIR}/tssstartup" ] || [ ! -f "${TSSDIR}/tsseventextend" ]; then +- echo "${CYAN}SKIP: tssstartup and tsseventextend needed for test${NORM}" +- return "$SKIP" +- fi +- +- echo "INFO: Sending software TPM startup" +- "${TSSDIR}/tssstartup" +- if [ $? -ne 0 ]; then +- echo "INFO: Retry sending software TPM startup" +- sleep 1 +- "${TSSDIR}/tssstartup" +- fi +- +- if [ $? -ne 0 ]; then +- echo "INFO: Software TPM startup failed" +- return "$SKIP" +- fi +- +- echo "INFO: Walking ${BINARY_BIOS_MEASUREMENTS} initializing the software TPM" +-# $(${TSSDIR}/tsseventextend -tpm -if "${BINARY_BIOS_MEASUREMENTS}" -v) 2>&1 > /dev/null +- "${TSSDIR}/tsseventextend" -tpm -if "${BINARY_BIOS_MEASUREMENTS}" -v > /dev/null 2>&1 +-} +- +-# In VERBOSE mode, display the calculated TPM PCRs for the different banks. +-display_pcrs() { +- local PCRMAX=9 +- local banks=("sha1" "sha256") +- local i; +- +- for bank in "${banks[@]}"; do +- echo "INFO: Displaying ${bank} TPM bank (PCRs 0 - 9)" +- for i in $(seq 0 $PCRMAX); do +- rc=0 +- pcr=$("${TSSDIR}/tsspcrread" -halg "${bank}" -ha "${i}" -ns) +- if [ $rc -ne 0 ]; then +- echo "INFO: tsspcrread failed: $pcr" +- break +- fi +- echo "$i: $pcr" +- done +- done +-} +- +-# The first entry in the IMA measurement list is the "boot_aggregate". +-# For each kexec, an additional "boot_aggregate" will appear in the +-# measurement list, assuming the previous measurement list is carried +-# across the kexec. +-# +-# Verify that the last "boot_aggregate" record in the IMA measurement +-# list matches. +-check() { +- echo "INFO: Calculating the boot_aggregate (PCRs 0 - 9) for multiple banks" +- bootaggr=$(evmctl ima_boot_aggregate) +- if [ $? -ne 0 ]; then +- echo "${CYAN}SKIP: evmctl ima_boot_aggregate: $bootaggr${NORM}" +- exit "$SKIP" +- fi +- +- boot_aggr=( $bootaggr ) +- +- echo "INFO: Searching for the boot_aggregate in ${ASCII_RUNTIME_MEASUREMENTS}" +- for hash in "${boot_aggr[@]}"; do +- if [ "$VERBOSE" != "0" ]; then +- echo "$hash" +- fi +- if grep -e " boot_aggregate$" -e " boot_aggregate.$" "${ASCII_RUNTIME_MEASUREMENTS}" | tail -n 1 | grep -q "${hash}"; then +- echo "${GREEN}SUCCESS: boot_aggregate ${hash} found${NORM}" +- return "$OK" +- fi +- done +- echo "${RED}FAILURE: boot_aggregate not found${NORM}" +- echo "$bootaggr" +- return "$FAIL" +-} +- +-if [ "$(id -u)" = 0 ] && [ -c "/dev/tpm0" ]; then +- ASCII_RUNTIME_MEASUREMENTS="/sys/kernel/security/ima/ascii_runtime_measurements" +- if [ ! -d "/sys/kernel/security/ima" ]; then +- echo "${CYAN}SKIP: CONFIG_IMA not enabled${NORM}" +- exit "$SKIP" +- fi +-else +- BINARY_BIOS_MEASUREMENTS="./sample-binary_bios_measurements-pcrs-8-9" +- ASCII_RUNTIME_MEASUREMENTS="./sample-ascii_runtime_measurements-pcrs-8-9" +- export TPM_INTERFACE_TYPE="socsim" +- export TPM_COMMAND_PORT=2321 +- export TPM_PLATFORM_PORT=2322 +- export TPM_SERVER_NAME="localhost" +- +- # swtpm uses the raw, unencapsulated packet format +- export TPM_SERVER_TYPE="raw" +-fi +- +-# Start and initialize a software TPM as needed +-if [ "$(id -u)" != 0 ] || [ ! -c "/dev/tpm0" ]; then +- if [ -f "$PCRFILE" ] || [ -f "$MISC_PCRFILE" ]; then +- echo "${CYAN}SKIP: system has discrete TPM 1.2, sample TPM 2.0 event log test not supported.${NORM}" +- exit "$SKIP" +- fi +- +- swtpm_start +- error=$? +- if [ $error -eq "$SKIP" ]; then +- echo "skip: swtpm not installed" +- exit "$SKIP" +- fi +- +- if [ $error -eq 0 ]; then +- swtpm_init +- if [ $? -eq "$SKIP" ]; then +- echo "testing boot_aggregate without entries" +- exit "$SKIP" +- fi +- fi +- if [ "$VERBOSE" != "0" ]; then +- display_pcrs +- fi +-fi +- +-expect_pass check diff --git a/app-crypt/ima-evm-utils/ima-evm-utils-1.4.ebuild b/app-crypt/ima-evm-utils/ima-evm-utils-1.4.ebuild new file mode 100644 index 000000000000..8a6872dda3e1 --- /dev/null +++ b/app-crypt/ima-evm-utils/ima-evm-utils-1.4.ebuild @@ -0,0 +1,52 @@ +# Copyright 1999-2021 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +inherit autotools + +DESCRIPTION="Supporting tools for IMA and EVM" +HOMEPAGE="http://linux-ima.sourceforge.net"; +SRC_URI="https://download.sourceforge.net/linux-ima/${P}.tar.gz"; + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="debug test tpm" + +RDEPEND=" + dev-libs/openssl:0= + sys-apps/keyutils:= + tpm? ( app-crypt/tpm2-tss )" +DEPEND="${RDEPEND}" +BDEPEND=" + app-text/asciidoc + app-text/docbook-xsl-stylesheets + dev-libs/libxslt + test? ( app-editors/vim-core )" + +RESTRICT="!test? ( test )" + +PATCHES=( + "${FILESDIR}/${PN}-1.4-configure-remove-automagic-TSS-dependencies.patch" + "${FILESDIR}/${PN}-1.4-test-Rename-bash-variable-WORKDIR-to-MYWORKDIR.patch" + "${FILESDIR}/${PN}-1.4-test-remove-boot_aggregate.patch" + ) + +src_prepare() { + default + + sed -i '/^MANPAGE_DOCBOOK_XSL/s:/usr/share/xml/docbook/stylesheet/docbook-xsl/manpages/docbook.xsl:/usr/share/sgml/docbook/xsl-stylesheets/manpages/docbook.xsl:' Makefile.am || die + eautoreconf +} + +src_configure() { + econf \ + $(use_enable debug) \ + $(use_with tpm pcrtss) +} + +src_install() { + default + find "${ED}" -name '*.la' -delete || die +} diff --git a/app-crypt/ima-evm-utils/metadata.xml b/app-crypt/ima-evm-utils/metadata.xml index 1beb74ffb739..06e244511370 100644 --- a/app-crypt/ima-evm-utils/metadata.xml +++ b/app-crypt/ima-evm-utils/metadata.xml @@ -8,4 +8,7 @@ <upstream> <remote-id type="sourceforge">linux-ima</remote-id> </upstream> + <use> + <flag name="tpm">Enable TPM support</flag> + </use> </pkgmetadata>
