[Rpm-ecosystem] [PATCH v6 00/11] RPM: include and install file signatures

[Florian Festi]

Sorry, it took me a while to find the time to review the patches. So far
things look pretty good.

I wonder if we are still missing some kind of tool to verify the
signatures (guess this is done by the kernel) or the existance of the
signatures (which probably cannot be done by the kernel). May be rpm -V
should check if the signatures are still there. But this is not a show
stopper in any way.

For me the patchset looks (beside the minor nitpits) ready for inclusion
into HEAD. I plan to do an alpha release for rpm-4.13 soonish. Anything
you still want to do before the code goes in?

Florian

On 07/06/2015 08:52 PM, Mimi Zohar wrote:
> This patch set, which includes file signatures in the RPM header
> and installs them as security.ima extended attributes, was last posted
> http://lists.rpm.org/pipermail/rpm-maint/2015-January/003842.html.
> 
> Since the patches were last posted, the patches were rebased, the
> rpmsign man page macro example was updated, a couple of bugs as
> noted in the patch descriptions were fixed and the RPM signature
> header digests is now updated only as needed.
> 
> Mimi 
> 
> Prior cover letter:
> ------------------
> 
> IMA-appraisal, upstreamed in linux-3.7, enforces local file
> integrity based on a known 'good' value stored as an extended
> attribute 'security.ima'.  Labeling the filesystem is currently done
> post install using a local private key.  Including file signatures
> in the package provides not only file integrity, but file
> provenance.
> 
> This patch set extends the existing rpm signing tool to include file
> signatures in packages, and adds a plugin that installs file
> signatures using the psm_post hook.
> 
> There are new options to rpmsign - signfiles and fskpath.
> 
> rpm --addsign [--signfiles [--fskpath <file signing key>]]
> PACKAGE_FILE ...
> 
> Signfiles signs all the file digests included in the package with
> libimaevm and stores the signatures in the package header under the
> tag RPMTAG_FILESIGNATURES. The file signing key can be provided with
> the option fskpath, or in a macro file with %_file_signing_key.
> 
> After including file signatures, the packages are signed normally.
> 
> When a package with signed files is installed, rpmfilesPopulate
> extracts file signatures from the package header and stores them (in
> binary) in rpmfiles struct. Then the ima plugin instantiates the
> psm_post hook and writes the file signatures to security.ima xattr.
> 
> Changelog v5:
> -config file signatures are filtered and not installed
> -removed rpmfiFSignatureHex because it wasn't used
> -added guard to file signature code in rpmfilesPopulate
> -fixed whitespace in rpmfi.c
> -reordered patches to fix dependencies
> 
> Changelog v4:
> -split patch set into more patches
> -added file signature interfaces to rpmfi
> -fixed types and buffer sizes
> -removed double logging of errors
> -removed changes to API/ABI
> -moved file signature installation to ima plugin
> -removed support for inline signing of files
> 
> Changelog v3:
> -split up patch
> 
> Changelog v2:
> -support for inline signing of files
> -command line option for file signing key
> -include missing file
> -fixed typo in rpmDigestAlgo
> 
> fin at linux.vnet.ibm.com (11):
>   Refactor copyFile to not close files
>   Export generateSignature
>   Add rpmtags for file signatures and their length
>   Subroutine for dumping immutable region of header
>   Add support for file signatures to rpmfi and rpmfiles
>   Configure option to build with imaevm support
>   Add file signature support to rpmsign command
>   Add file signature support to package signing
>   Sign file digests and store signatures in header
>   IMA plugin labels ima xattr with file signatures
>   Documentation for file signing
> 
>  build/pack.c        |  90 +--------------------
>  configure.ac        |   8 ++
>  doc/rpmsign.8       |  32 +++++++-
>  lib/Makefile.am     |   3 +-
>  lib/rpmfi.c         |  45 ++++++++++-
>  lib/rpmfi.h         |   8 ++
>  lib/rpmfiles.h      |  10 +++
>  lib/rpmsignfiles.c  | 126 +++++++++++++++++++++++++++++
>  lib/rpmsignfiles.h  |  20 +++++
>  lib/rpmtag.h        |   2 +
>  lib/signature.c     |  87 ++++++++++++++++++++
>  lib/signature.h     |  11 +++
>  macros.in           |   1 +
>  plugins/Makefile.am |   4 +
>  plugins/ima.c       |  60 ++++++++++++++
>  rpmpopt.in          |   1 +
>  rpmsign.c           |  24 +++++-
>  sign/rpmgensig.c    | 225 ++++++++++++++++++++++++++++++++++++++++++++++------
>  sign/rpmsign.h      |   1 +
>  19 files changed, 642 insertions(+), 116 deletions(-)
>  create mode 100644 lib/rpmsignfiles.c
>  create mode 100644 lib/rpmsignfiles.h
>  create mode 100644 plugins/ima.c
> 


-- 

Red Hat GmbH, http://www.de.redhat.com/ Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Michael Cunningham, Michael
O'Neill, Charles Peters