Compare commits
32 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
cd8477a2eb | ||
|
0fec26534d | ||
| d06a6e72e4 | |||
|
93c64f2a0d | ||
|
8b1bcf2332 | ||
|
|
c938656c12 | ||
|
df4c12aec8 | ||
|
58d5697b85 | ||
|
74685e918a | ||
|
|
634e808893 | ||
|
|
04f02e8cd7 | ||
|
0b14fad476 | ||
|
|
bb3aaa1ba2 | ||
|
|
4b458cfe9f | ||
|
|
c2da1bf6da | ||
|
f1d5690e2e | ||
|
|
fbf8f35ae7 | ||
|
|
3bf806fd9f | ||
|
|
1d2597d20d | ||
|
|
c324cc0c6c | ||
|
|
b201f43f63 | ||
|
|
bdccb8412c | ||
|
|
57b330e905 | ||
|
|
2638a1181b | ||
|
|
840c1cffff | ||
|
|
eb423047cd | ||
|
|
534c97e8ed | ||
|
|
ed9353e1df | ||
|
|
c7c4e0f825 | ||
|
|
98a054d3eb | ||
|
|
409a7cdd41 | ||
|
|
3c1a1c5064 |
26 changed files with 315 additions and 1344 deletions
27
0001-cms_common-Fixed-Segmentation-fault.patch
Normal file
27
0001-cms_common-Fixed-Segmentation-fault.patch
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Nicolas Frayer <nfrayer@redhat.com>
|
||||
Date: Mon, 20 Feb 2023 15:26:20 +0100
|
||||
Subject: [PATCH] cms_common: Fixed Segmentation fault
|
||||
|
||||
When running efikeygen, the binary crashes with a segfault due
|
||||
to dereferencing a **ptr instead of a *ptr.
|
||||
|
||||
Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
|
||||
(cherry picked from commit 227435af461f38fc4abeafe02884675ad4b1feb4)
|
||||
---
|
||||
src/cms_common.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/cms_common.c b/src/cms_common.c
|
||||
index 24576f2..89d946a 100644
|
||||
--- a/src/cms_common.c
|
||||
+++ b/src/cms_common.c
|
||||
@@ -956,7 +956,7 @@ find_certificate_by_issuer_and_sn(cms_context *cms,
|
||||
if (!ias)
|
||||
cnreterr(-1, cms, "invalid issuer and serial number");
|
||||
|
||||
- return find_certificate_by_callback(cms, match_issuer_and_serial, &ias, cert);
|
||||
+ return find_certificate_by_callback(cms, match_issuer_and_serial, ias, cert);
|
||||
}
|
||||
|
||||
int
|
||||
|
|
@ -1,42 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Tue, 14 May 2019 11:28:38 -0400
|
||||
Subject: [PATCH] efikeygen: Fix the build with nss 3.44
|
||||
|
||||
NSS 3.44 adds some certificate types, which changes a type and makes
|
||||
some encoding stuff weird. As a result, we get:
|
||||
|
||||
gcc8 -I/wrkdirs/usr/ports/sysutils/pesign/work/pesign-0.110/include -O2 -pipe -fstack-protector-strong -Wl,-rpath=/usr/local/lib/gcc8 -isystem /usr/local/include -fno-strict-aliasing -g -O0 -g -O0 -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants --std=gnu99 -D_GNU_SOURCE -Wno-unused-result -Wno-unused-function -I../include/ -I/usr/local/include/nss -I/usr/local/include/nss/nss -I/usr/local/include/nspr -Werror -fPIC -isystem /usr/local/include -DCONFIG_amd64 -DCONFIG_amd64 -c efikeygen.c -o efikeygen.o
|
||||
In file included from /usr/local/include/nss/nss/cert.h:22,
|
||||
from efikeygen.c:39:
|
||||
efikeygen.c: In function 'add_cert_type':
|
||||
/usr/local/include/nss/nss/certt.h:445:5: error: unsigned conversion from 'int' to 'unsigned char' changes value from '496' to '240' [-Werror=overflow]
|
||||
(NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_SSL_SERVER | NS_CERT_TYPE_EMAIL | \
|
||||
^
|
||||
efikeygen.c:208:23: note: in expansion of macro 'NS_CERT_TYPE_APP'
|
||||
unsigned char type = NS_CERT_TYPE_APP;
|
||||
^~~~~~~~~~~~~~~~
|
||||
cc1: all warnings being treated as errors
|
||||
|
||||
This is fixed by just making it an int.
|
||||
|
||||
Fixes github issue #48.
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/efikeygen.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/efikeygen.c b/src/efikeygen.c
|
||||
index 121a238..848480a 100644
|
||||
--- a/src/efikeygen.c
|
||||
+++ b/src/efikeygen.c
|
||||
@@ -208,7 +208,7 @@ static int
|
||||
add_cert_type(cms_context *cms, void *extHandle, int is_ca)
|
||||
{
|
||||
SECItem bitStringValue;
|
||||
- unsigned char type = NS_CERT_TYPE_APP;
|
||||
+ int type = NS_CERT_TYPE_APP;
|
||||
|
||||
if (is_ca)
|
||||
type |= NS_CERT_TYPE_SSL_CA |
|
||||
41
0002-Fix-reversed-calloc-arguments.patch
Normal file
41
0002-Fix-reversed-calloc-arguments.patch
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
From 1f9e2fa0b4d872fdd01ca3ba81b04dfb1211a187 Mon Sep 17 00:00:00 2001
|
||||
From: Stephen Gallagher <sgallagh@redhat.com>
|
||||
Date: Fri, 2 Feb 2024 09:32:48 -0500
|
||||
Subject: [PATCH] Fix reversed calloc() arguments
|
||||
|
||||
The prototype is "void *calloc(size_t nelem, size_t elsize);"
|
||||
|
||||
These two instances had them reversed, almost certainly leading to
|
||||
buffer overflow issues. This was detected by
|
||||
-Werror=calloc-transposed-args on gcc.
|
||||
|
||||
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
||||
---
|
||||
src/pesigcheck.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/pesigcheck.c b/src/pesigcheck.c
|
||||
index 6dc67f76a81..8119cf10a7b 100644
|
||||
--- a/src/pesigcheck.c
|
||||
+++ b/src/pesigcheck.c
|
||||
@@ -240,7 +240,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
|
||||
|
||||
cert_iter iter;
|
||||
|
||||
- reasonps = calloc(sizeof(struct reason), 512);
|
||||
+ reasonps = calloc(512, sizeof(struct reason));
|
||||
if (!reasonps)
|
||||
err(1, "check_signature");
|
||||
|
||||
@@ -281,7 +281,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
|
||||
|
||||
num_reasons += 16;
|
||||
|
||||
- new_reasons = calloc(sizeof(struct reason), num_reasons);
|
||||
+ new_reasons = calloc(num_reasons, sizeof(struct reason));
|
||||
if (!new_reasons)
|
||||
err(1, "check_signature");
|
||||
reasonps = new_reasons;
|
||||
--
|
||||
2.41.0
|
||||
|
||||
|
|
@ -1,46 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Tue, 18 Feb 2020 16:28:56 -0500
|
||||
Subject: [PATCH] pesigcheck: Fix a wrong assignment
|
||||
|
||||
gcc says:
|
||||
|
||||
pesigcheck.c: In function 'check_signature':
|
||||
pesigcheck.c:321:17: error: implicit conversion from 'enum <anonymous>' to 'enum <anonymous>' [-Werror=enum-conversion]
|
||||
321 | reason->type = siBuffer;
|
||||
| ^
|
||||
pesigcheck.c:333:17: error: implicit conversion from 'enum <anonymous>' to 'enum <anonymous>' [-Werror=enum-conversion]
|
||||
333 | reason->type = siBuffer;
|
||||
| ^
|
||||
cc1: all warnings being treated as errors
|
||||
|
||||
And indeed, that line of code makes no sense at all - it was supposed to
|
||||
be reason->sig.type.
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/pesigcheck.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/pesigcheck.c b/src/pesigcheck.c
|
||||
index 524cce3..8fa0f1a 100644
|
||||
--- a/src/pesigcheck.c
|
||||
+++ b/src/pesigcheck.c
|
||||
@@ -318,7 +318,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
|
||||
reason->type = SIGNATURE;
|
||||
reason->sig.data = data;
|
||||
reason->sig.len = datalen;
|
||||
- reason->type = siBuffer;
|
||||
+ reason->sig.type = siBuffer;
|
||||
nreason += 1;
|
||||
is_invalid = true;
|
||||
}
|
||||
@@ -330,7 +330,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
|
||||
reason->type = SIGNATURE;
|
||||
reason->sig.data = data;
|
||||
reason->sig.len = datalen;
|
||||
- reason->type = siBuffer;
|
||||
+ reason->sig.type = siBuffer;
|
||||
nreason += 1;
|
||||
has_valid_cert = true;
|
||||
}
|
||||
|
|
@ -1,314 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Thu, 11 Jun 2020 16:23:14 -0400
|
||||
Subject: [PATCH] Make 0.112 client and server work with the 113 protocol and
|
||||
vise versa
|
||||
|
||||
This makes the version of the sign API that takes a file type optional,
|
||||
and makes the client attempt to negotiate which version it's getting.
|
||||
It also leaves the server able to still handle the version from before
|
||||
the file type was added.
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/client.c | 74 +++++++++++++++++++++++++++++++++++++++++++-----------------
|
||||
src/daemon.c | 63 ++++++++++++++++++++++++++++++++++-----------------
|
||||
src/daemon.h | 2 ++
|
||||
3 files changed, 97 insertions(+), 42 deletions(-)
|
||||
|
||||
diff --git a/src/client.c b/src/client.c
|
||||
index 4a9a44e..a4f1d1d 100644
|
||||
--- a/src/client.c
|
||||
+++ b/src/client.c
|
||||
@@ -23,6 +23,7 @@
|
||||
#include <fcntl.h>
|
||||
#include <popt.h>
|
||||
#include <pwd.h>
|
||||
+#include <stdbool.h>
|
||||
#include <stddef.h>
|
||||
#include <stdlib.h>
|
||||
#include <sys/socket.h>
|
||||
@@ -96,8 +97,8 @@ connect_to_server(void)
|
||||
static int32_t
|
||||
check_response(int sd, char **srvmsg);
|
||||
|
||||
-static void
|
||||
-check_cmd_version(int sd, uint32_t command, char *name, int32_t version)
|
||||
+static int
|
||||
+check_cmd_version(int sd, uint32_t command, char *name, int32_t version, bool do_exit)
|
||||
{
|
||||
struct msghdr msg;
|
||||
struct iovec iov[1];
|
||||
@@ -116,7 +117,7 @@ check_cmd_version(int sd, uint32_t command, char *name, int32_t version)
|
||||
ssize_t n;
|
||||
n = sendmsg(sd, &msg, 0);
|
||||
if (n < 0) {
|
||||
- fprintf(stderr, "check-cmd-version: kill daemon failed: %m\n");
|
||||
+ fprintf(stderr, "check-cmd-version: sendmsg failed: %m\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
@@ -132,11 +133,17 @@ check_cmd_version(int sd, uint32_t command, char *name, int32_t version)
|
||||
|
||||
char *srvmsg = NULL;
|
||||
int32_t rc = check_response(sd, &srvmsg);
|
||||
- if (rc < 0)
|
||||
+
|
||||
+ if (do_exit && rc < 0)
|
||||
errx(1, "command \"%s\" not known by server", name);
|
||||
- if (rc != version)
|
||||
+
|
||||
+ if (do_exit && rc != version)
|
||||
errx(1, "command \"%s\": client version %d, server version %d",
|
||||
name, version, rc);
|
||||
+
|
||||
+ if (rc < 0)
|
||||
+ return rc;
|
||||
+ return rc == version;
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -146,7 +153,7 @@ send_kill_daemon(int sd)
|
||||
struct iovec iov;
|
||||
pesignd_msghdr pm;
|
||||
|
||||
- check_cmd_version(sd, CMD_KILL_DAEMON, "kill-daemon", 0);
|
||||
+ check_cmd_version(sd, CMD_KILL_DAEMON, "kill-daemon", 0, true);
|
||||
|
||||
pm.version = PESIGND_VERSION;
|
||||
pm.command = CMD_KILL_DAEMON;
|
||||
@@ -288,7 +295,7 @@ unlock_token(int sd, char *tokenname, char *pin)
|
||||
|
||||
uint32_t size1 = pesignd_string_size(pin);
|
||||
|
||||
- check_cmd_version(sd, CMD_UNLOCK_TOKEN, "unlock-token", 0);
|
||||
+ check_cmd_version(sd, CMD_UNLOCK_TOKEN, "unlock-token", 0, true);
|
||||
|
||||
pm.version = PESIGND_VERSION;
|
||||
pm.command = CMD_UNLOCK_TOKEN;
|
||||
@@ -365,7 +372,7 @@ is_token_unlocked(int sd, char *tokenname)
|
||||
|
||||
uint32_t size0 = pesignd_string_size(tokenname);
|
||||
|
||||
- check_cmd_version(sd, CMD_IS_TOKEN_UNLOCKED, "is-token-unlocked", 0);
|
||||
+ check_cmd_version(sd, CMD_IS_TOKEN_UNLOCKED, "is-token-unlocked", 0, true);
|
||||
|
||||
pm.version = PESIGND_VERSION;
|
||||
pm.command = CMD_IS_TOKEN_UNLOCKED;
|
||||
@@ -464,6 +471,9 @@ static void
|
||||
sign(int sd, char *infile, char *outfile, char *tokenname, char *certname,
|
||||
int attached, uint32_t format)
|
||||
{
|
||||
+ int rc;
|
||||
+ bool add_file_type;
|
||||
+
|
||||
int infd = open(infile, O_RDONLY);
|
||||
if (infd < 0) {
|
||||
fprintf(stderr, "pesign-client: could not open input file "
|
||||
@@ -493,12 +503,28 @@ oom:
|
||||
exit(1);
|
||||
}
|
||||
|
||||
- check_cmd_version(sd, attached ? CMD_SIGN_ATTACHED : CMD_SIGN_DETACHED,
|
||||
- attached ? "sign-attached" : "sign-detached", 0);
|
||||
+ rc = check_cmd_version(sd,
|
||||
+ attached ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE
|
||||
+ : CMD_SIGN_DETACHED_WITH_FILE_TYPE,
|
||||
+ attached ? "sign-attached" : "sign-detached",
|
||||
+ 0, format == FORMAT_KERNEL_MODULE);
|
||||
+ if (rc >= 0) {
|
||||
+ add_file_type = true;
|
||||
+ } else {
|
||||
+ add_file_type = false;
|
||||
+ check_cmd_version(sd, attached ? CMD_SIGN_ATTACHED
|
||||
+ : CMD_SIGN_DETACHED,
|
||||
+ attached ? "sign-attached" : "sign-detached",
|
||||
+ 0, true);
|
||||
+ }
|
||||
|
||||
+ printf("add_file_type:%d\n", add_file_type);
|
||||
pm->version = PESIGND_VERSION;
|
||||
- pm->command = attached ? CMD_SIGN_ATTACHED : CMD_SIGN_DETACHED;
|
||||
- pm->size = size0 + size1 + sizeof(format);
|
||||
+ pm->command = attached ? (add_file_type ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE
|
||||
+ : CMD_SIGN_ATTACHED)
|
||||
+ : (add_file_type ? CMD_SIGN_DETACHED_WITH_FILE_TYPE
|
||||
+ : CMD_SIGN_DETACHED);
|
||||
+ pm->size = size0 + size1 + (add_file_type ? sizeof(format) : 0);
|
||||
iov[0].iov_base = pm;
|
||||
iov[0].iov_len = sizeof (*pm);
|
||||
|
||||
@@ -515,25 +541,31 @@ oom:
|
||||
}
|
||||
|
||||
char *buffer;
|
||||
- buffer = malloc(size0 + size1);
|
||||
+ buffer = malloc(pm->size);
|
||||
if (!buffer)
|
||||
goto oom;
|
||||
|
||||
- iov[0].iov_base = &format;
|
||||
- iov[0].iov_len = sizeof(format);
|
||||
+ int pos = 0;
|
||||
+
|
||||
+ if (add_file_type) {
|
||||
+ iov[pos].iov_base = &format;
|
||||
+ iov[pos].iov_len = sizeof(format);
|
||||
+ pos++;
|
||||
+ }
|
||||
|
||||
pesignd_string *tn = (pesignd_string *)buffer;
|
||||
pesignd_string_set(tn, tokenname);
|
||||
- iov[1].iov_base = tn;
|
||||
- iov[1].iov_len = size0;
|
||||
+ iov[pos].iov_base = tn;
|
||||
+ iov[pos].iov_len = size0;
|
||||
+ pos++;
|
||||
|
||||
pesignd_string *cn = pesignd_string_next(tn);
|
||||
pesignd_string_set(cn, certname);
|
||||
- iov[2].iov_base = cn;
|
||||
- iov[2].iov_len = size1;
|
||||
+ iov[pos].iov_base = cn;
|
||||
+ iov[pos].iov_len = size1;
|
||||
|
||||
msg.msg_iov = iov;
|
||||
- msg.msg_iovlen = 3;
|
||||
+ msg.msg_iovlen = add_file_type ? 3 : 2;
|
||||
|
||||
n = sendmsg(sd, &msg, 0);
|
||||
if (n < 0) {
|
||||
@@ -547,7 +579,7 @@ oom:
|
||||
send_fd(sd, outfd);
|
||||
|
||||
char *srvmsg = NULL;
|
||||
- int rc = check_response(sd, &srvmsg);
|
||||
+ rc = check_response(sd, &srvmsg);
|
||||
if (rc < 0) {
|
||||
fprintf(stderr, "pesign-client: signing failed: \"%s\"\n",
|
||||
srvmsg);
|
||||
diff --git a/src/daemon.c b/src/daemon.c
|
||||
index 84b9ebc..8522250 100644
|
||||
--- a/src/daemon.c
|
||||
+++ b/src/daemon.c
|
||||
@@ -25,6 +25,7 @@
|
||||
#include <poll.h>
|
||||
#include <pwd.h>
|
||||
#include <signal.h>
|
||||
+#include <stdbool.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@@ -569,7 +570,7 @@ out:
|
||||
|
||||
static void
|
||||
handle_signing(context *ctx, struct pollfd *pollfd, socklen_t size,
|
||||
- int attached)
|
||||
+ int attached, bool with_file_type)
|
||||
{
|
||||
struct msghdr msg;
|
||||
struct iovec iov;
|
||||
@@ -593,8 +594,12 @@ oom:
|
||||
|
||||
n = recvmsg(pollfd->fd, &msg, MSG_WAITALL);
|
||||
|
||||
- file_format = *((uint32_t *) buffer);
|
||||
- n -= sizeof(uint32_t);
|
||||
+ if (with_file_type) {
|
||||
+ file_format = *((uint32_t *) buffer);
|
||||
+ n -= sizeof(uint32_t);
|
||||
+ } else {
|
||||
+ file_format = FORMAT_PE_BINARY;
|
||||
+ }
|
||||
|
||||
pesignd_string *tn = (pesignd_string *)(buffer + sizeof(uint32_t));
|
||||
if (n < (long long)sizeof(tn->size)) {
|
||||
@@ -674,34 +679,44 @@ finish:
|
||||
teardown_digests(ctx->cms);
|
||||
}
|
||||
|
||||
+static inline void
|
||||
+handle_sign_helper(context *ctx, struct pollfd *pollfd, socklen_t size,
|
||||
+ int attached, bool with_file_type)
|
||||
+{
|
||||
+ int rc = cms_context_alloc(&ctx->cms);
|
||||
+ if (rc < 0)
|
||||
+ return;
|
||||
+
|
||||
+ steal_from_cms(ctx->backup_cms, ctx->cms);
|
||||
+
|
||||
+ handle_signing(ctx, pollfd, size, attached, with_file_type);
|
||||
+
|
||||
+ hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms);
|
||||
+ cms_context_fini(ctx->cms);
|
||||
+}
|
||||
+
|
||||
static void
|
||||
handle_sign_attached(context *ctx, struct pollfd *pollfd, socklen_t size)
|
||||
{
|
||||
- int rc = cms_context_alloc(&ctx->cms);
|
||||
- if (rc < 0)
|
||||
- return;
|
||||
+ handle_sign_helper(ctx, pollfd, size, 1, false);
|
||||
+}
|
||||
|
||||
- steal_from_cms(ctx->backup_cms, ctx->cms);
|
||||
-
|
||||
- handle_signing(ctx, pollfd, size, 1);
|
||||
-
|
||||
- hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms);
|
||||
- cms_context_fini(ctx->cms);
|
||||
+static void
|
||||
+handle_sign_attached_with_file_type(context *ctx, struct pollfd *pollfd, socklen_t size)
|
||||
+{
|
||||
+ handle_sign_helper(ctx, pollfd, size, 1, true);
|
||||
}
|
||||
|
||||
static void
|
||||
handle_sign_detached(context *ctx, struct pollfd *pollfd, socklen_t size)
|
||||
{
|
||||
- int rc = cms_context_alloc(&ctx->cms);
|
||||
- if (rc < 0)
|
||||
- return;
|
||||
+ handle_sign_helper(ctx, pollfd, size, 0, false);
|
||||
+}
|
||||
|
||||
- steal_from_cms(ctx->backup_cms, ctx->cms);
|
||||
-
|
||||
- handle_signing(ctx, pollfd, size, 0);
|
||||
-
|
||||
- hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms);
|
||||
- cms_context_fini(ctx->cms);
|
||||
+static void
|
||||
+handle_sign_detached_with_file_type(context *ctx, struct pollfd *pollfd, socklen_t size)
|
||||
+{
|
||||
+ handle_sign_helper(ctx, pollfd, size, 0, true);
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -733,6 +748,12 @@ cmd_table_t cmd_table[] = {
|
||||
{ CMD_UNLOCK_TOKEN, handle_unlock_token, "unlock-token", 0 },
|
||||
{ CMD_SIGN_ATTACHED, handle_sign_attached, "sign-attached", 0 },
|
||||
{ CMD_SIGN_DETACHED, handle_sign_detached, "sign-detached", 0 },
|
||||
+ { CMD_SIGN_ATTACHED_WITH_FILE_TYPE,
|
||||
+ handle_sign_attached_with_file_type,
|
||||
+ "sign-attached-with-file-type", 0 },
|
||||
+ { CMD_SIGN_DETACHED_WITH_FILE_TYPE,
|
||||
+ handle_sign_detached_with_file_type,
|
||||
+ "sign-detached-with-file-type", 0 },
|
||||
{ CMD_RESPONSE, NULL, "response", 0 },
|
||||
{ CMD_IS_TOKEN_UNLOCKED, handle_is_token_unlocked,
|
||||
"is-token-unlocked", 0 },
|
||||
diff --git a/src/daemon.h b/src/daemon.h
|
||||
index 69384ce..0368dc9 100644
|
||||
--- a/src/daemon.h
|
||||
+++ b/src/daemon.h
|
||||
@@ -45,6 +45,8 @@ typedef enum {
|
||||
CMD_RESPONSE,
|
||||
CMD_IS_TOKEN_UNLOCKED,
|
||||
CMD_GET_CMD_VERSION,
|
||||
+ CMD_SIGN_ATTACHED_WITH_FILE_TYPE,
|
||||
+ CMD_SIGN_DETACHED_WITH_FILE_TYPE,
|
||||
CMD_LIST_END
|
||||
} pesignd_cmd;
|
||||
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
From dc17b1d248c705073a5160e7c871a52aa9ce6e99 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Thu, 21 Nov 2024 13:58:05 -0500
|
||||
Subject: [PATCH] Work around OpenSC changing token names on fedora builders
|
||||
*again*.
|
||||
|
||||
Once again OpenSC has changed how token names work in an incompatible
|
||||
way, and we need to work around it even harder on the Fedora kernel
|
||||
builders.
|
||||
|
||||
Reviewed-by: Kevin Fenzi <kevin@fedoraproject.org>
|
||||
Reviewed-by: Justin Forbes <jforbes@fedoraproject.org>
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/macros.pesign | 3 ++-
|
||||
src/pesign-rpmbuild-helper.in | 15 ++++++++++++++-
|
||||
2 files changed, 16 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/macros.pesign b/src/macros.pesign
|
||||
index b7d6af1f6f5..47e3f19f8ed 100644
|
||||
--- a/src/macros.pesign
|
||||
+++ b/src/macros.pesign
|
||||
@@ -9,7 +9,8 @@
|
||||
%__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"}
|
||||
%__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"}
|
||||
|
||||
-%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"}
|
||||
+# See the comment in pesign-rpmbuild-helper.in about the token name here.
|
||||
+%__pesign_client_token %{!?pe_signing_token:"OpenSC Card"}%{?pe_signing_token:"%{pe_signing_token}"}
|
||||
%__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"}
|
||||
|
||||
%_pesign /usr/bin/pesign
|
||||
diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in
|
||||
index 30d5441207b..42de1a1e002 100644
|
||||
--- a/src/pesign-rpmbuild-helper.in
|
||||
+++ b/src/pesign-rpmbuild-helper.in
|
||||
@@ -214,7 +214,20 @@ main() {
|
||||
rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}"
|
||||
elif [[ -n "${socket}" ]] ; then
|
||||
### welcome haaaaack city
|
||||
- if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then
|
||||
+ ### different versions of the opensc library name the token different
|
||||
+ ### things, and as of this commit:
|
||||
+ ### https://github.com/OpenSC/OpenSC/commit/259decf656a77a6d1bd3e944d6f198ed70832ff5
|
||||
+ ### that includes just not including the token label unless there's
|
||||
+ ### more than one token. Unfortunately this is both for the displayed
|
||||
+ ### info and for the token name you specify to /use/ the token, so we
|
||||
+ ### have to handle all of those options here, and change the name to
|
||||
+ ### match whatever the current version of opensc is using in the rpm
|
||||
+ ### macro where we're setting it. Thankfully this is just a "is this
|
||||
+ ### Fedora" check for us, and if it's RHEL we're not using OpenSC at
|
||||
+ ### all.
|
||||
+ if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] \
|
||||
+ || [[ "${client_token[1]}" = "Fedora Signer" ]] \
|
||||
+ || [[ "${client_token[1]}" = "OpenSC Card" ]] ; then
|
||||
if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \
|
||||
|| [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then
|
||||
if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \
|
||||
--
|
||||
2.47.0
|
||||
|
||||
|
|
@ -1,43 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Fri, 12 Jun 2020 11:49:44 -0400
|
||||
Subject: [PATCH] Rename /var/run/ to /run/
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/macros.pesign | 12 ++++++------
|
||||
src/tmpfiles.conf | 2 +-
|
||||
2 files changed, 7 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/src/macros.pesign b/src/macros.pesign
|
||||
index 7c5cba1..21bf391 100644
|
||||
--- a/src/macros.pesign
|
||||
+++ b/src/macros.pesign
|
||||
@@ -45,14 +45,14 @@
|
||||
rm -rf ${sattrs} ${sattrs}.sig ${nss} \
|
||||
elif [ "$(id -un)" == "kojibuilder" -a \\\
|
||||
grep -q ID=fedora /etc/os-release -a \\\
|
||||
- ! -S /var/run/pesign/socket ]; then \
|
||||
+ ! -S /run/pesign/socket ]; then \
|
||||
echo "No socket even though this is kojibuilder" 1>&2 \
|
||||
- ls -ld /var/run/pesign 1>&2 \
|
||||
- ls -l /var/run/pesign/socket 1>&2 \
|
||||
- getfacl /var/run/pesign 1>&2 \
|
||||
- getfacl /var/run/pesign/socket 1>&2 \
|
||||
+ ls -ld /run/pesign 1>&2 \
|
||||
+ ls -l /run/pesign/socket 1>&2 \
|
||||
+ getfacl /run/pesign 1>&2 \
|
||||
+ getfacl /run/pesign/socket 1>&2 \
|
||||
exit 1 \
|
||||
- elif [ -S /var/run/pesign/socket ]; then \
|
||||
+ elif [ -S /run/pesign/socket ]; then \
|
||||
%{_pesign_client} -t %{__pesign_client_token} \\\
|
||||
-c %{__pesign_client_cert} \\\
|
||||
%{-i} %{-o} %{-e} %{-s} %{-C} \
|
||||
diff --git a/src/tmpfiles.conf b/src/tmpfiles.conf
|
||||
index c1cf355..3375ad5 100644
|
||||
--- a/src/tmpfiles.conf
|
||||
+++ b/src/tmpfiles.conf
|
||||
@@ -1 +1 @@
|
||||
-D /var/run/pesign 0770 pesign pesign -
|
||||
+D /run/pesign 0770 pesign pesign -
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
From 616ec5f25adbde1a4bd78cdcacd6dcd7ecfa5a5c Mon Sep 17 00:00:00 2001
|
||||
From: Gary Lin <glin@suse.com>
|
||||
Date: Thu, 22 Dec 2022 13:49:34 +0800
|
||||
Subject: [PATCH] cms_common: skip authentication on the 'Friendly' slot
|
||||
|
||||
When finding a certificate in a 'Friendly' slot without the need of the
|
||||
private key, it is not necessary to authenticate the slot.
|
||||
|
||||
For example, when the signed attributes and the raw signature are
|
||||
created in a server and the user has the certificate, signkey.x509, and
|
||||
tries to import them into myapp.efi:
|
||||
|
||||
$ certutil -N -d nssdb -f passwd
|
||||
$ certutil -A -d nssdb -f passwd -n signkey -t CT,CT,CT \
|
||||
-i signkey.x509
|
||||
$ pesign -n nssdb -c signkey -i myapp.efi -o myapp.efi.signed \
|
||||
-d sha256 -I myapp.sattr -R myapp.sig
|
||||
|
||||
Since the "signkey" is 'Friendly', i.e. publicly readable, and the
|
||||
private key is not needed, we can just skip the authentication and find
|
||||
"signkey" in the slot.
|
||||
|
||||
Signed-off-by: Gary Lin <glin@suse.com>
|
||||
---
|
||||
src/cms_common.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/cms_common.c b/src/cms_common.c
|
||||
index cf572ca..44e5cca 100644
|
||||
--- a/src/cms_common.c
|
||||
+++ b/src/cms_common.c
|
||||
@@ -628,7 +628,8 @@ find_certificate(cms_context *cms, int needs_private_key)
|
||||
|
||||
int errnum;
|
||||
SECStatus status;
|
||||
- if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms)) {
|
||||
+ if ((needs_private_key || !PK11_IsFriendly(psle->slot)) &&
|
||||
+ (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms))) {
|
||||
status = PK11_Authenticate(psle->slot, PR_TRUE, cms);
|
||||
if (status != SECSuccess) {
|
||||
save_port_err() {
|
||||
25
0005-Add-const-qualifier-to-variable.patch
Normal file
25
0005-Add-const-qualifier-to-variable.patch
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Nicolas Frayer <nfrayer@redhat.com>
|
||||
Date: Mon, 22 Jun 2026 20:58:03 +0200
|
||||
Subject: [PATCH] Add const qualifier to variable
|
||||
|
||||
Add const to a variable initialized with using strrchr.
|
||||
|
||||
Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
|
||||
---
|
||||
src/pesum.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/pesum.c b/src/pesum.c
|
||||
index e4ddaf86d7fa..5d7dcb929eec 100644
|
||||
--- a/src/pesum.c
|
||||
+++ b/src/pesum.c
|
||||
@@ -141,7 +141,7 @@ main(int argc, char *argv[])
|
||||
while ((infile = poptGetArg(optCon)) != NULL) {
|
||||
pesign_context *ctxp = NULL;
|
||||
|
||||
- char *ext = strrchr(infile, '.');
|
||||
+ const char *ext = strrchr(infile, '.');
|
||||
if (ext && strcmp(ext, ".ko") == 0)
|
||||
fmt = FORMAT_KERNEL_MODULE;
|
||||
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Cline <jcline@redhat.com>
|
||||
Date: Tue, 18 Feb 2020 16:37:53 -0500
|
||||
Subject: [PATCH] Apparently opensc got updated and the token name changed
|
||||
|
||||
All the kernel builds started failing yesterday because the signing
|
||||
token could not be found. Update the token name in the macro shipped by
|
||||
pesign.
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/macros.pesign | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/macros.pesign b/src/macros.pesign
|
||||
index 21bf391..5a6da1c 100644
|
||||
--- a/src/macros.pesign
|
||||
+++ b/src/macros.pesign
|
||||
@@ -9,7 +9,7 @@
|
||||
%__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"}
|
||||
%__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"}
|
||||
|
||||
-%__pesign_client_token %{!?pe_signing_token:"Fedora Signer (OpenSC Card)"}%{?pe_signing_token:"%{pe_signing_token}"}
|
||||
+%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"}
|
||||
%__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"}
|
||||
|
||||
%_pesign /usr/bin/pesign
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Mon, 6 Jul 2020 16:13:09 -0400
|
||||
Subject: [PATCH] client: try /run and /var/run for the socket path.
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/client.c | 40 +++++++++++++++++++++++++++++-----------
|
||||
1 file changed, 29 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/src/client.c b/src/client.c
|
||||
index a4f1d1d..0082be1 100644
|
||||
--- a/src/client.c
|
||||
+++ b/src/client.c
|
||||
@@ -61,24 +61,24 @@ print_flag_name(FILE *f, int flag)
|
||||
}
|
||||
|
||||
static int
|
||||
-connect_to_server(void)
|
||||
+connect_to_server_helper(const char * const sockpath)
|
||||
{
|
||||
- int rc = access(SOCKPATH, R_OK);
|
||||
+ int rc = access(sockpath, R_OK);
|
||||
if (rc != 0) {
|
||||
- fprintf(stderr, "pesign-client: could not connect to server: "
|
||||
- "%m\n");
|
||||
- exit(1);
|
||||
+ warn("could not access socket \"%s\"", sockpath);
|
||||
+ return rc;
|
||||
}
|
||||
|
||||
struct sockaddr_un addr_un = {
|
||||
.sun_family = AF_UNIX,
|
||||
- .sun_path = SOCKPATH,
|
||||
};
|
||||
+ strncpy(addr_un.sun_path, sockpath, sizeof(addr_un.sun_path));
|
||||
+ addr_un.sun_path[sizeof(addr_un.sun_path)-1] = '\0';
|
||||
|
||||
int sd = socket(AF_UNIX, SOCK_STREAM, 0);
|
||||
if (sd < 0) {
|
||||
- fprintf(stderr, "pesign-client: could not open socket: %m\n");
|
||||
- exit(1);
|
||||
+ warn("could not open socket \"%s\"", sockpath);
|
||||
+ return sd;
|
||||
}
|
||||
|
||||
socklen_t len = strlen(addr_un.sun_path) +
|
||||
@@ -86,14 +86,32 @@ connect_to_server(void)
|
||||
|
||||
rc = connect(sd, (struct sockaddr *)&addr_un, len);
|
||||
if (rc < 0) {
|
||||
- fprintf(stderr, "pesign-client: could not connect to daemon: "
|
||||
- "%m\n");
|
||||
- exit(1);
|
||||
+ warn("could not connect to daemon");
|
||||
+ return sd;
|
||||
}
|
||||
|
||||
return sd;
|
||||
}
|
||||
|
||||
+static int
|
||||
+connect_to_server(void)
|
||||
+{
|
||||
+ int rc, i;
|
||||
+ const char * const sockets[] = {
|
||||
+ "/run/pesign/socket",
|
||||
+ "/var/run/pesign/socket",
|
||||
+ NULL
|
||||
+ };
|
||||
+
|
||||
+ for (i = 0; sockets[i] != NULL; i++) {
|
||||
+ rc = connect_to_server_helper(sockets[i]);
|
||||
+ if (rc >= 0)
|
||||
+ return rc;
|
||||
+ }
|
||||
+
|
||||
+ exit(1);
|
||||
+}
|
||||
+
|
||||
static int32_t
|
||||
check_response(int sd, char **srvmsg);
|
||||
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Tue, 14 Jul 2020 16:44:09 -0400
|
||||
Subject: [PATCH] client: remove an extra debug print
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/client.c | 1 -
|
||||
1 file changed, 1 deletion(-)
|
||||
|
||||
diff --git a/src/client.c b/src/client.c
|
||||
index 0082be1..c996629 100644
|
||||
--- a/src/client.c
|
||||
+++ b/src/client.c
|
||||
@@ -536,7 +536,6 @@ oom:
|
||||
0, true);
|
||||
}
|
||||
|
||||
- printf("add_file_type:%d\n", add_file_type);
|
||||
pm->version = PESIGND_VERSION;
|
||||
pm->command = attached ? (add_file_type ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE
|
||||
: CMD_SIGN_ATTACHED)
|
||||
|
|
@ -1,376 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Mon, 6 Jul 2020 13:54:35 -0400
|
||||
Subject: [PATCH] Move most of macros.pesign to pesign-rpmbuild-helper
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
Make.defaults | 1 +
|
||||
src/Makefile | 8 +-
|
||||
src/macros.pesign | 74 +++++---------
|
||||
src/pesign-rpmbuild-helper.in | 222 ++++++++++++++++++++++++++++++++++++++++++
|
||||
4 files changed, 252 insertions(+), 53 deletions(-)
|
||||
create mode 100644 src/pesign-rpmbuild-helper.in
|
||||
|
||||
diff --git a/Make.defaults b/Make.defaults
|
||||
index 0bacafe..d4cd626 100644
|
||||
--- a/Make.defaults
|
||||
+++ b/Make.defaults
|
||||
@@ -16,6 +16,7 @@ INSTALLROOT = $(DESTDIR)
|
||||
|
||||
INSTALL ?= install
|
||||
CROSS_COMPILE ?=
|
||||
+EFI_ARCHES ?= aa64 ia32 x64
|
||||
|
||||
PKG_CONFIG = $(CROSS_COMPILE)pkg-config
|
||||
CC := $(if $(filter default,$(origin CC)),$(CROSS_COMPILE)gcc,$(CC))
|
||||
diff --git a/src/Makefile b/src/Makefile
|
||||
index 74327ba..a7ca891 100644
|
||||
--- a/src/Makefile
|
||||
+++ b/src/Makefile
|
||||
@@ -5,7 +5,7 @@ include $(TOPDIR)/Make.version
|
||||
include $(TOPDIR)/Make.rules
|
||||
include $(TOPDIR)/Make.defaults
|
||||
|
||||
-BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign
|
||||
+BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign pesign-rpmbuild-helper
|
||||
SVCTARGETS=pesign.sysvinit pesign.service
|
||||
TARGETS=$(BINTARGETS) $(SVCTARGETS)
|
||||
|
||||
@@ -49,6 +49,11 @@ pesign : $(call objects-of,$(PESIGN_SOURCES) $(COMMON_SOURCES) $(COMMON_PE_SOURC
|
||||
pesign : LDLIBS+=$(TOPDIR)/libdpe/libdpe.a
|
||||
pesign : PKGS=efivar nss nspr popt
|
||||
|
||||
+pesign-rpmbuild-helper: pesign-rpmbuild-helper.in
|
||||
+ sed \
|
||||
+ -e "s/@@EFI_ARCHES@@/$(EFI_ARCHES)/g" \
|
||||
+ $^ > $@
|
||||
+
|
||||
deps : PKGS=efivar nss nspr popt uuid
|
||||
deps : $(ALL_SOURCES)
|
||||
$(MAKE) -f $(TOPDIR)/Make.deps \
|
||||
@@ -94,6 +99,7 @@ install :
|
||||
$(INSTALL) -m 644 macros.pesign $(INSTALLROOT)/etc/rpm/
|
||||
$(INSTALL) -d -m 755 $(INSTALLROOT)$(libexecdir)/pesign/
|
||||
$(INSTALL) -m 750 pesign-authorize $(INSTALLROOT)$(libexecdir)/pesign/
|
||||
+ $(INSTALL) -m 755 pesign-rpmbuild-helper $(INSTALLROOT)$(libexecdir)/pesign/
|
||||
$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pesign
|
||||
$(INSTALL) -m 600 pesign-users $(INSTALLROOT)/etc/pesign/users
|
||||
$(INSTALL) -m 600 pesign-groups $(INSTALLROOT)/etc/pesign/groups
|
||||
diff --git a/src/macros.pesign b/src/macros.pesign
|
||||
index 5a6da1c..34af57c 100644
|
||||
--- a/src/macros.pesign
|
||||
+++ b/src/macros.pesign
|
||||
@@ -6,7 +6,7 @@
|
||||
# %pesign -s -i shim.orig -o shim.efi
|
||||
# And magically get the right thing.
|
||||
|
||||
-%__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"}
|
||||
+%__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"}
|
||||
%__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"}
|
||||
|
||||
%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"}
|
||||
@@ -24,54 +24,24 @@
|
||||
# -a <input ca cert filename> # rhel only
|
||||
# -s # perform signing
|
||||
%pesign(i:o:C:e:c:n:a:s) \
|
||||
- _pesign_nssdir=/etc/pki/pesign \
|
||||
- if [ %{__pesign_cert} = "Red Hat Test Certificate" ]; then \
|
||||
- _pesign_nssdir=/etc/pki/pesign-rh-test \
|
||||
- fi \
|
||||
- if [ -x %{_pesign} ] && \\\
|
||||
- [ "%{_target_cpu}" == "x86_64" -o \\\
|
||||
- "%{_target_cpu}" == "aarch64" ]; then \
|
||||
- if [ "0%{?rhel}" -ge "7" -a -f /usr/bin/rpm-sign ]; then \
|
||||
- nss=$(mktemp -p $PWD -d) \
|
||||
- echo > ${nss}/pwfile \
|
||||
- certutil -N -d ${nss} -f ${nss}/pwfile \
|
||||
- certutil -A -n "ca" -t "CT,C," -i %{-a*} -d ${nss} \
|
||||
- certutil -A -n "signer" -t ",c," -i %{-c*} -d ${nss} \
|
||||
- sattrs=$(mktemp -p $PWD --suffix=.der) \
|
||||
- %{_pesign} %{-i} -E ${sattrs} --certdir ${nss} --force \
|
||||
- rpm-sign --key "%{-n*}" --rsadgstsign ${sattrs} \
|
||||
- %{_pesign} -R ${sattrs}.sig -I ${sattrs} %{-i} \\\
|
||||
- --certdir ${nss} -c signer %{-o} \
|
||||
- rm -rf ${sattrs} ${sattrs}.sig ${nss} \
|
||||
- elif [ "$(id -un)" == "kojibuilder" -a \\\
|
||||
- grep -q ID=fedora /etc/os-release -a \\\
|
||||
- ! -S /run/pesign/socket ]; then \
|
||||
- echo "No socket even though this is kojibuilder" 1>&2 \
|
||||
- ls -ld /run/pesign 1>&2 \
|
||||
- ls -l /run/pesign/socket 1>&2 \
|
||||
- getfacl /run/pesign 1>&2 \
|
||||
- getfacl /run/pesign/socket 1>&2 \
|
||||
- exit 1 \
|
||||
- elif [ -S /run/pesign/socket ]; then \
|
||||
- %{_pesign_client} -t %{__pesign_client_token} \\\
|
||||
- -c %{__pesign_client_cert} \\\
|
||||
- %{-i} %{-o} %{-e} %{-s} %{-C} \
|
||||
- else \
|
||||
- %{_pesign} %{__pesign_token} -c %{__pesign_cert} \\\
|
||||
- --certdir ${_pesign_nssdir} \\\
|
||||
- %{-i} %{-o} %{-e} %{-s} %{-C} \
|
||||
- fi \
|
||||
- else \
|
||||
- if [ -n "%{-i*}" -a -n "%{-o*}" ]; then \
|
||||
- mv %{-i*} %{-o*} \
|
||||
- elif [ -n "%{-i*}" -a -n "%{-e*}" ]; then \
|
||||
- touch %{-e*} \
|
||||
- fi \
|
||||
- fi \
|
||||
- if [ ! -s %{-o} ]; then \
|
||||
- if [ -e "%{-o*}" ]; then \
|
||||
- rm -f %{-o*} \
|
||||
- fi \
|
||||
- exit 1 \
|
||||
- fi ;
|
||||
-
|
||||
+ %{_libexecdir}/pesign/pesign-rpmbuild-helper \\\
|
||||
+ "%{_target_cpu}" \\\
|
||||
+ "%{_pesign}" \\\
|
||||
+ "%{_pesign_client}" \\\
|
||||
+ %{?__pesign_client_token:--client-token %{__pesign_client_token}} \\\
|
||||
+ %{?__pesign_client_cert:--client-cert %{__pesign_client_cert}} \\\
|
||||
+ %{?__pesign_token:%{__pesign_token}} \\\
|
||||
+ %{?__pesign_cert:--cert %{__pesign_cert}} \\\
|
||||
+ %{?_buildhost:--hostname "%{_buildhost}"} \\\
|
||||
+ %{?vendor:--vendor "%{vendor}"} \\\
|
||||
+ %{?_rhel:--rhelver "%{_rhel}"} \\\
|
||||
+ %{?-n:--rhelcert %{-n*}}%{?!-n:--rhelcert %{__pesign_cert}} \\\
|
||||
+ %{?-a:--rhelcafile "%{-a*}"} \\\
|
||||
+ %{?-c:--rhelcertfile "%{-c*}"} \\\
|
||||
+ %{?-C:--certout "%{-C*}"} \\\
|
||||
+ %{?-e:--sattrout "%{-e*}"} \\\
|
||||
+ %{?-i:--in "%{-i*}"} \\\
|
||||
+ %{?-o:--out "%{-o*}"} \\\
|
||||
+ %{?-s:--sign} \\\
|
||||
+ ; \
|
||||
+%{nil}
|
||||
diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in
|
||||
new file mode 100644
|
||||
index 0000000..c5287c2
|
||||
--- /dev/null
|
||||
+++ b/src/pesign-rpmbuild-helper.in
|
||||
@@ -0,0 +1,222 @@
|
||||
+#!/bin/bash
|
||||
+# shellcheck shell=bash
|
||||
+
|
||||
+set -eu
|
||||
+set -x
|
||||
+
|
||||
+usage() {
|
||||
+ local status="${1}" && shift
|
||||
+ local out
|
||||
+ if [[ "${status}" -eq 0 ]] ; then
|
||||
+ out=/dev/stdout
|
||||
+ else
|
||||
+ out=/dev/stderr
|
||||
+ fi
|
||||
+
|
||||
+ if [[ $# -gt 0 ]] ; then
|
||||
+ echo "${0}: error: $*" >>"${out}"
|
||||
+ fi
|
||||
+ echo "usage: ${0} TARGET_CPU PESIGN_BINARY PESIGN_CLIENT_BINARY [OPTIONS]" >>"${out}"
|
||||
+ exit "${status}"
|
||||
+}
|
||||
+
|
||||
+is_efi_arch() {
|
||||
+ local arch="${1}"
|
||||
+ local arches=(@@EFI_ARCHES@@)
|
||||
+ local x
|
||||
+ for x in "${arches[@]}" ; do
|
||||
+ if [[ "${arch}" = "${x}" ]] ; then
|
||||
+ return 0
|
||||
+ fi
|
||||
+ done
|
||||
+ return 1
|
||||
+}
|
||||
+
|
||||
+error_on_empty() {
|
||||
+ local f="${1}"
|
||||
+ if [[ ! -s "${f}" ]] ; then
|
||||
+ if [[ -e "${f}" ]] ; then
|
||||
+ rm -f "${f}"
|
||||
+ fi
|
||||
+ echo "${0}: error: empty result file \"${f}\"">>/dev/stderr
|
||||
+ exit 1
|
||||
+ fi
|
||||
+}
|
||||
+
|
||||
+main() {
|
||||
+ if [[ $# -lt 3 ]] ; then
|
||||
+ usage 1 not enough arguments
|
||||
+ fi
|
||||
+ local target_cpu="${1}" && shift
|
||||
+ local bin="${1}" && shift
|
||||
+ local client="${1}" && shift
|
||||
+
|
||||
+ local rhelcafile="" || :
|
||||
+ local rhelcertfile="" || :
|
||||
+
|
||||
+ local certout=() || :
|
||||
+ local sattrout=() || :
|
||||
+ local input=() || :
|
||||
+ local output=() || :
|
||||
+ local client_token=() || :
|
||||
+ local client_cert=() || :
|
||||
+ local token=() || :
|
||||
+ local cert=() || :
|
||||
+ local rhelcert=() || :
|
||||
+ local rhelver=0 || :
|
||||
+ local sign="" || :
|
||||
+ local arch="" || :
|
||||
+ local vendor="" || :
|
||||
+ local HOSTNAME="" || :
|
||||
+
|
||||
+ while [[ $# -ge 2 ]] ; do
|
||||
+ case " ${1} " in
|
||||
+ " --rhelcafile ")
|
||||
+ rhelcafile="${2}"
|
||||
+ ;;
|
||||
+ " --rhelcertfile ")
|
||||
+ rhelcertfile="${2}"
|
||||
+ ;;
|
||||
+ " --hostname ")
|
||||
+ HOSTNAME="${2}"
|
||||
+ ;;
|
||||
+ " --certout ")
|
||||
+ certout[0]=-C
|
||||
+ certout[1]="${2}"
|
||||
+ ;;
|
||||
+ " --sattrout ")
|
||||
+ sattrout[0]=-e
|
||||
+ sattrout[1]="${2}"
|
||||
+ ;;
|
||||
+ " --client-token ")
|
||||
+ client_token[0]=-t
|
||||
+ client_token[1]="${2}"
|
||||
+ ;;
|
||||
+ " --client-cert ")
|
||||
+ client_cert[0]=-c
|
||||
+ client_cert[1]="${2}"
|
||||
+ ;;
|
||||
+ " --token ")
|
||||
+ token[0]=-t
|
||||
+ token[1]="${2}"
|
||||
+ ;;
|
||||
+ " --cert ")
|
||||
+ cert[0]=-c
|
||||
+ cert[1]="${2}"
|
||||
+ ;;
|
||||
+ " --rhelcert ")
|
||||
+ rhelcert[0]=-c
|
||||
+ rhelcert[1]="${2}"
|
||||
+ ;;
|
||||
+ " --in ")
|
||||
+ input[0]=-i
|
||||
+ input[1]="${2}"
|
||||
+ ;;
|
||||
+ " --out ")
|
||||
+ output[0]=-o
|
||||
+ output[1]="${2}"
|
||||
+ ;;
|
||||
+ " --rhelver ")
|
||||
+ rhelver="${2}"
|
||||
+ ;;
|
||||
+ " --vendor ")
|
||||
+ vendor="${2}"
|
||||
+ ;;
|
||||
+ *)
|
||||
+ break
|
||||
+ ;;
|
||||
+ esac
|
||||
+ shift
|
||||
+ shift
|
||||
+ done
|
||||
+ if [[ $# -ge 1 ]] && [[ "${1}" = --sign ]] ; then
|
||||
+ sign=-s
|
||||
+ shift
|
||||
+ fi
|
||||
+
|
||||
+ if [[ -z "${target_cpu}" ]] ; then
|
||||
+ target_cpu="$(uname -m)"
|
||||
+ fi
|
||||
+
|
||||
+ target_cpu="${target_cpu/i?86/ia32}"
|
||||
+ target_cpu="${target_cpu/x86_64/x64}"
|
||||
+ target_cpu="${target_cpu/aarch64/aa64}"
|
||||
+ target_cpu="${target_cpu/arm*/arm/}"
|
||||
+
|
||||
+ local nssdir=/etc/pki/pesign
|
||||
+ if [[ "${#cert[@]}" -eq 2 ]] &&
|
||||
+ [[ "${cert[1]}" == "Red Hat Test Certificate" ]] ; then
|
||||
+ nssdir=/etc/pki/pesign-rh-test
|
||||
+ fi
|
||||
+
|
||||
+ # is_efi_arch is ultimately returning "is pesign configured to sign these
|
||||
+ # using the rpm macro", so if it isn't, we're just copying the input to
|
||||
+ # the output
|
||||
+ if [[ -x "${bin}" ]] && ! is_efi_arch "${target_cpu}" ; then
|
||||
+ if [[ -n "${input[*]}" ]] && [[ -n "${output[*]}" ]] ; then
|
||||
+ cp -v "${input[1]}" "${output[1]}"
|
||||
+ elif [[ -n "${input[*]}" ]] && [[ -n "${sattrout[*]}" ]] ; then
|
||||
+ touch "${sattrout[1]}"
|
||||
+ fi
|
||||
+
|
||||
+ # if there's a 0-sized output file, delete it and error out
|
||||
+ error_on_empty "${output[1]}"
|
||||
+ return 0
|
||||
+ fi
|
||||
+
|
||||
+ USERNAME="${USERNAME:-$(id -un)}"
|
||||
+
|
||||
+ local socket="" || :
|
||||
+ if grep -q ID=fedora /etc/os-release \
|
||||
+ && [[ "${rhelver}" -lt 7 ]] \
|
||||
+ && [[ "${USERNAME}" = "mockbuild" ]] \
|
||||
+ && [[ "${vendor}" = "Fedora Project" ]] \
|
||||
+ && [[ "${HOSTNAME}" =~ bkernel.* ]]
|
||||
+ then
|
||||
+ if [[ -S /run/pesign/socket ]] ; then
|
||||
+ socket=/run/pesign/socket
|
||||
+ elif [[ -S /var/run/pesign/socket ]]; then
|
||||
+ socket=/var/run/pesign/socket
|
||||
+ else
|
||||
+ echo "Warning: no pesign socket even though user is ${USERNAME}" 1>&2
|
||||
+ echo "Warning: if this is a non-scratch koji build, this is wrong" 1>&2
|
||||
+ ls -ld /run/pesign /var/run/pesign 1>&2 ||:
|
||||
+ ls -l /run/pesign/socket /var/run/pesign/socket 1>&2 ||:
|
||||
+ getfacl /run/pesign /run/pesign/socket /var/run/pesign /var/run/pesign/socket 1>&2 ||:
|
||||
+ getfacl -n /run/pesign /run/pesign/socket /var/run/pesign /var/run/pesign/socket 1>&2 ||:
|
||||
+ fi
|
||||
+ fi
|
||||
+
|
||||
+ if [[ "${rhelver}" -ge 7 ]] ; then
|
||||
+ nssdir="$(mktemp -p "${PWD}" -d)"
|
||||
+ echo > "${nssdir}/pwfile"
|
||||
+ certutil -N -d "${nssdir}" -f "${nssdir}/pwfile"
|
||||
+ certutil -A -n "ca" -t "CTu,CTu,CTu" -i "${rhelcafile}" -d "${nssdir}"
|
||||
+ certutil -A -n "signer" -t "CTu,CTu,CTu" -i "${rhelcertfile}" -d "${nssdir}"
|
||||
+ sattrs="$(mktemp -p "${PWD}" --suffix=.der)"
|
||||
+ "${bin}" -E "${sattrs}" --certdir "${nssdir}" \
|
||||
+ "${input[@]}" --force
|
||||
+ rpm-sign --key "${rhelcert[1]}" --rsadgstsign "${sattrs}"
|
||||
+ "${bin}" -R "${sattrs}.sig" -I "${sattrs}" \
|
||||
+ --certdir "${nssdir}" -c signer \
|
||||
+ "${input[@]}" "${output[@]}"
|
||||
+ rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}"
|
||||
+ elif [[ -n "${socket}" ]] ; then
|
||||
+ "${client}" "${client_token[@]}" "${client_cert[@]}" \
|
||||
+ "${sattrout[@]}" "${certout[@]}" \
|
||||
+ ${sign} "${input[@]}" "${output[@]}"
|
||||
+ else
|
||||
+ "${bin}" --certdir "${nssdir}" "${token[@]}" \
|
||||
+ "${cert[@]}" ${sign} "${sattrout[@]}" \
|
||||
+ "${certout[@]}" "${input[@]}" "${output[@]}"
|
||||
+ fi
|
||||
+
|
||||
+ # if there's a 0-sized output file, delete it and error out
|
||||
+ if [[ "${#output[@]}" -eq 2 ]] ; then
|
||||
+ error_on_empty "${output[1]}"
|
||||
+ fi
|
||||
+}
|
||||
+
|
||||
+main "${@}"
|
||||
+
|
||||
+# vim:filetype=sh:fenc=utf-8:tw=78:sts=4:sw=4
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Tue, 14 Jul 2020 15:07:32 -0400
|
||||
Subject: [PATCH] pesign-authorize: shellcheck
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/pesign-authorize | 16 ++++++++--------
|
||||
1 file changed, 8 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/src/pesign-authorize b/src/pesign-authorize
|
||||
index a496f60..55cd5c4 100755
|
||||
--- a/src/pesign-authorize
|
||||
+++ b/src/pesign-authorize
|
||||
@@ -12,21 +12,21 @@ set -u
|
||||
# License: GPLv2
|
||||
declare -a fileusers=()
|
||||
declare -a dirusers=()
|
||||
-for user in $(cat /etc/pesign/users); do
|
||||
+while read -r user ; do
|
||||
dirusers[${#dirusers[@]}]=-m
|
||||
dirusers[${#dirusers[@]}]="u:$user:rwx"
|
||||
fileusers[${#fileusers[@]}]=-m
|
||||
fileusers[${#fileusers[@]}]="u:$user:rw"
|
||||
-done
|
||||
+done </etc/pesign/users
|
||||
|
||||
declare -a filegroups=()
|
||||
declare -a dirgroups=()
|
||||
-for group in $(cat /etc/pesign/groups); do
|
||||
+while read -r group ; do
|
||||
dirgroups[${#dirgroups[@]}]=-m
|
||||
dirgroups[${#dirgroups[@]}]="g:$group:rwx"
|
||||
filegroups[${#filegroups[@]}]=-m
|
||||
filegroups[${#filegroups[@]}]="g:$group:rw"
|
||||
-done
|
||||
+done </etc/pesign/groups
|
||||
|
||||
update_subdir() {
|
||||
subdir=$1 && shift
|
||||
@@ -35,12 +35,12 @@ update_subdir() {
|
||||
setfacl "${dirusers[@]}" "${dirgroups[@]}" "${subdir}"
|
||||
for x in "${subdir}"* ; do
|
||||
if [ -d "${x}" ]; then
|
||||
- setfacl -bk ${x}
|
||||
- setfacl "${dirusers[@]}" "${dirgroups[@]}" ${x}
|
||||
+ setfacl -bk "${x}"
|
||||
+ setfacl "${dirusers[@]}" "${dirgroups[@]}" "${x}"
|
||||
update_subdir "${x}/"
|
||||
elif [ -e "${x}" ]; then
|
||||
- setfacl -bk ${x}
|
||||
- setfacl "${fileusers[@]}" "${filegroups[@]}" ${x}
|
||||
+ setfacl -bk "${x}"
|
||||
+ setfacl "${fileusers[@]}" "${filegroups[@]}" "${x}"
|
||||
else
|
||||
:;
|
||||
fi
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Tue, 14 Jul 2020 15:08:15 -0400
|
||||
Subject: [PATCH] pesign-authorize: don't setfacl /etc/pki/pesign-foo/
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/pesign-authorize | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/pesign-authorize b/src/pesign-authorize
|
||||
index 55cd5c4..c544832 100755
|
||||
--- a/src/pesign-authorize
|
||||
+++ b/src/pesign-authorize
|
||||
@@ -47,7 +47,7 @@ update_subdir() {
|
||||
done
|
||||
}
|
||||
|
||||
-for x in /var/run/pesign/ /etc/pki/pesign*/ ; do
|
||||
+for x in /var/run/pesign/ /etc/pki/pesign/ ; do
|
||||
if [ -d "${x}" ]; then
|
||||
update_subdir "${x}"
|
||||
else
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Tue, 14 Jul 2020 16:42:39 -0400
|
||||
Subject: [PATCH] kernel building hack
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/pesign-rpmbuild-helper.in | 17 +++++++++++++++++
|
||||
1 file changed, 17 insertions(+)
|
||||
|
||||
diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in
|
||||
index c5287c2..27b8261 100644
|
||||
--- a/src/pesign-rpmbuild-helper.in
|
||||
+++ b/src/pesign-rpmbuild-helper.in
|
||||
@@ -202,6 +202,23 @@ main() {
|
||||
"${input[@]}" "${output[@]}"
|
||||
rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}"
|
||||
elif [[ -n "${socket}" ]] ; then
|
||||
+ ### welcome haaaaack city
|
||||
+ if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then
|
||||
+ if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \
|
||||
+ || [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then
|
||||
+ if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \
|
||||
+ || [[ "${rhelcertfile}" =~ redhatsecureboot401.* ]] \
|
||||
+ || [[ "${rhelcertfile}" =~ centossecureboot201.* ]] ; then
|
||||
+ client_cert[1]=kernel-signer
|
||||
+ elif [[ "${rhelcertfile}" =~ redhatsecureboot502.* ]] \
|
||||
+ || [[ "${rhelcertfile}" =~ centossecureboot202.* ]] ; then
|
||||
+ client_cert[1]=grub2-signer
|
||||
+ elif [[ "${rhelcertfile}" =~ redhatsecureboot503.* ]] \
|
||||
+ || [[ "${rhelcertfile}" =~ centossecureboot203.* ]] ; then
|
||||
+ client_cert[1]=fwupd-signer
|
||||
+ fi
|
||||
+ fi
|
||||
+ fi
|
||||
"${client}" "${client_token[@]}" "${client_cert[@]}" \
|
||||
"${sattrout[@]}" "${certout[@]}" \
|
||||
${sign} "${input[@]}" "${output[@]}"
|
||||
|
|
@ -1,102 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Jones <pjones@redhat.com>
|
||||
Date: Thu, 16 Jul 2020 16:28:26 -0400
|
||||
Subject: [PATCH] Use /run not /var/run
|
||||
|
||||
Signed-off-by: Peter Jones <pjones@redhat.com>
|
||||
---
|
||||
src/Makefile | 2 +-
|
||||
src/daemon.h | 4 ++--
|
||||
src/pesign-authorize | 2 +-
|
||||
src/pesign.service.in | 2 +-
|
||||
src/pesign.sysvinit.in | 10 +++++-----
|
||||
5 files changed, 10 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/src/Makefile b/src/Makefile
|
||||
index a7ca891..f7fb5fc 100644
|
||||
--- a/src/Makefile
|
||||
+++ b/src/Makefile
|
||||
@@ -78,7 +78,7 @@ install_sysvinit: pesign.sysvinit
|
||||
install :
|
||||
$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/
|
||||
$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign-rh-test/
|
||||
- $(INSTALL) -d -m 770 $(INSTALLROOT)/var/run/pesign/
|
||||
+ $(INSTALL) -d -m 770 $(INSTALLROOT)/run/pesign/
|
||||
$(INSTALL) -d -m 755 $(INSTALLROOT)$(bindir)
|
||||
$(INSTALL) -m 755 authvar $(INSTALLROOT)$(bindir)
|
||||
$(INSTALL) -m 755 pesign $(INSTALLROOT)$(bindir)
|
||||
diff --git a/src/daemon.h b/src/daemon.h
|
||||
index 0368dc9..5fcd97e 100644
|
||||
--- a/src/daemon.h
|
||||
+++ b/src/daemon.h
|
||||
@@ -51,8 +51,8 @@ typedef enum {
|
||||
} pesignd_cmd;
|
||||
|
||||
#define PESIGND_VERSION 0x2a9edaf0
|
||||
-#define SOCKPATH "/var/run/pesign/socket"
|
||||
-#define PIDFILE "/var/run/pesign.pid"
|
||||
+#define SOCKPATH "/run/pesign/socket"
|
||||
+#define PIDFILE "/run/pesign.pid"
|
||||
|
||||
static inline uint32_t UNUSED
|
||||
pesignd_string_size(char *buffer)
|
||||
diff --git a/src/pesign-authorize b/src/pesign-authorize
|
||||
index c544832..2381302 100755
|
||||
--- a/src/pesign-authorize
|
||||
+++ b/src/pesign-authorize
|
||||
@@ -47,7 +47,7 @@ update_subdir() {
|
||||
done
|
||||
}
|
||||
|
||||
-for x in /var/run/pesign/ /etc/pki/pesign/ ; do
|
||||
+for x in /run/pesign/ /var/run/pesign/ /etc/pki/pesign/ ; do
|
||||
if [ -d "${x}" ]; then
|
||||
update_subdir "${x}"
|
||||
else
|
||||
diff --git a/src/pesign.service.in b/src/pesign.service.in
|
||||
index c75a000..4ac2199 100644
|
||||
--- a/src/pesign.service.in
|
||||
+++ b/src/pesign.service.in
|
||||
@@ -4,6 +4,6 @@ Description=Pesign signing daemon
|
||||
[Service]
|
||||
PrivateTmp=true
|
||||
Type=forking
|
||||
-PIDFile=/var/run/pesign.pid
|
||||
+PIDFile=/run/pesign.pid
|
||||
ExecStart=/usr/bin/pesign --daemonize
|
||||
ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize
|
||||
diff --git a/src/pesign.sysvinit.in b/src/pesign.sysvinit.in
|
||||
index b0e0f84..bf8edec 100644
|
||||
--- a/src/pesign.sysvinit.in
|
||||
+++ b/src/pesign.sysvinit.in
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# chkconfig: - 50 50
|
||||
# processname: /usr/bin/pesign
|
||||
-# pidfile: /var/run/pesign.pid
|
||||
+# pidfile: /run/pesign.pid
|
||||
### BEGIN INIT INFO
|
||||
# Provides: pesign
|
||||
# Default-Start:
|
||||
@@ -20,9 +20,9 @@ RETVAL=0
|
||||
|
||||
start(){
|
||||
echo -n "Starting pesign: "
|
||||
- mkdir /var/run/pesign 2>/dev/null &&
|
||||
- chown pesign:pesign /var/run/pesign &&
|
||||
- chmod 0770 /var/run/pesign
|
||||
+ mkdir /run/pesign 2>/dev/null &&
|
||||
+ chown pesign:pesign /run/pesign &&
|
||||
+ chmod 0770 /run/pesign
|
||||
daemon /usr/bin/pesign --daemonize
|
||||
RETVAL=$?
|
||||
echo
|
||||
@@ -32,7 +32,7 @@ start(){
|
||||
|
||||
stop(){
|
||||
echo -n "Stopping pesign: "
|
||||
- killproc -p /var/run/pesign.pid pesignd
|
||||
+ killproc -p /run/pesign.pid pesignd
|
||||
RETVAL=$?
|
||||
echo
|
||||
rm -f /var/lock/subsys/pesign
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Jeff Law <law@redhat.com>
|
||||
Date: Mon, 16 Nov 2020 12:07:59 -0700
|
||||
Subject: [PATCH] Turn off -Wfree-nonheap-object
|
||||
|
||||
authvar.c has a call to free (tokenname) where tokenname is set to a string constant
|
||||
and never changed. That triggers GCC to issue a diagnostic that the value should not
|
||||
be passed to free.
|
||||
|
||||
This is a false positive from GCC as the call is guarded by a suitable condition that
|
||||
always happens to be false. But pesign is being built without optimization and thus
|
||||
the condition and free call are not optimized away.
|
||||
|
||||
This patch just disables the warning. A better solution would be to fix the sources
|
||||
or build with the optimizer enabled.
|
||||
---
|
||||
Make.defaults | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Make.defaults b/Make.defaults
|
||||
index d4cd626..705cc3a 100644
|
||||
--- a/Make.defaults
|
||||
+++ b/Make.defaults
|
||||
@@ -40,7 +40,7 @@ gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches -flto
|
||||
cflags = $(CFLAGS) $(ARCH3264) \
|
||||
-Wall -Wextra -Wsign-compare -Wno-unused-result \
|
||||
-Wno-unused-function -Wno-missing-field-initializers \
|
||||
- -Werror -Wno-error=cpp \
|
||||
+ -Werror -Wno-error=cpp -Wno-free-nonheap-object \
|
||||
-std=gnu11 -fshort-wchar -fPIC -fno-strict-aliasing \
|
||||
-D_GNU_SOURCE -DCONFIG_$(ARCH) -I${TOPDIR}/include \
|
||||
$(if $(filter $(CC),clang),$(clang_cflags), ) \
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
From 59428daf4863f192419eee4afec15cd099e99c9b Mon Sep 17 00:00:00 2001
|
||||
From: Jeff Law <law@redhat.com>
|
||||
Date: Mon, 16 Nov 2020 12:07:59 -0700
|
||||
Subject: [PATCH] Turn off -Wfree-nonheap-object
|
||||
|
||||
authvar.c has a call to free (tokenname) where tokenname is set to a string constant
|
||||
and never changed. That triggers GCC to issue a diagnostic that the value should not
|
||||
be passed to free.
|
||||
|
||||
This is a false positive from GCC as the call is guarded by a suitable condition that
|
||||
always happens to be false. But pesign is being built without optimization and thus
|
||||
the condition and free call are not optimized away.
|
||||
|
||||
This patch just disables the warning. A better solution would be to fix the sources
|
||||
or build with the optimizer enabled.
|
||||
---
|
||||
Make.defaults | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Make.defaults b/Make.defaults
|
||||
index d4cd626..705cc3a 100644
|
||||
--- a/Make.defaults
|
||||
+++ b/Make.defaults
|
||||
@@ -40,7 +40,7 @@ gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches -flto
|
||||
cflags = $(CFLAGS) $(ARCH3264) \
|
||||
-Wall -Wextra -Wsign-compare -Wno-unused-result \
|
||||
-Wno-unused-function -Wno-missing-field-initializers \
|
||||
- -Werror -Wno-error=cpp \
|
||||
+ -Werror -Wno-error=cpp -Wno-free-nonheap-object \
|
||||
-std=gnu11 -fshort-wchar -fPIC -fno-strict-aliasing \
|
||||
-D_GNU_SOURCE -DCONFIG_$(ARCH) -I${TOPDIR}/include \
|
||||
$(if $(filter $(CC),clang),$(clang_cflags), ) \
|
||||
--
|
||||
2.28.0
|
||||
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Robbie Harwood <rharwood@redhat.com>
|
||||
Date: Thu, 3 Mar 2022 15:37:02 -0500
|
||||
Subject: [PATCH] Fix bad free of cms data (DoS only)
|
||||
|
||||
handle_unlock_token() set the CMS data to an offset of an allocated
|
||||
buffer, rather than something allocated in its own right.
|
||||
cms_set_pw_data() would then attempt to free this value. Additionally,
|
||||
should pesignd not take SIGABRT at that point, handle_unlock_token()
|
||||
would then also free buffer.
|
||||
|
||||
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
|
||||
(cherry picked from commit 7b78af412dc0ca5db54c426a13550cf35caa9516)
|
||||
---
|
||||
src/daemon.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/daemon.c b/src/daemon.c
|
||||
index 8522250..3ae3c8d 100644
|
||||
--- a/src/daemon.c
|
||||
+++ b/src/daemon.c
|
||||
@@ -166,6 +166,7 @@ handle_unlock_token(context *ctx, struct pollfd *pollfd, socklen_t size)
|
||||
struct msghdr msg;
|
||||
struct iovec iov;
|
||||
ssize_t n;
|
||||
+ char *pin = NULL;
|
||||
|
||||
int rc = cms_context_alloc(&ctx->cms);
|
||||
if (rc < 0) {
|
||||
@@ -233,7 +234,8 @@ malformed:
|
||||
if (!ctx->cms->tokenname)
|
||||
goto oom;
|
||||
|
||||
- char *pin = (char *)tp->value;
|
||||
+ if (!tp->value)
|
||||
+ pin = strndup((char *)tp->value, tp->size);
|
||||
if (!pin)
|
||||
goto oom;
|
||||
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Robbie Harwood <rharwood@redhat.com>
|
||||
Date: Tue, 8 Mar 2022 12:59:34 -0500
|
||||
Subject: [PATCH] daemon: remove always-true comparison
|
||||
|
||||
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
|
||||
(cherry picked from commit 500ee15d26630066baaa48dea1dbfd614d8ea225)
|
||||
---
|
||||
src/daemon.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/daemon.c b/src/daemon.c
|
||||
index 3ae3c8d..1179cb3 100644
|
||||
--- a/src/daemon.c
|
||||
+++ b/src/daemon.c
|
||||
@@ -234,8 +234,7 @@ malformed:
|
||||
if (!ctx->cms->tokenname)
|
||||
goto oom;
|
||||
|
||||
- if (!tp->value)
|
||||
- pin = strndup((char *)tp->value, tp->size);
|
||||
+ pin = strndup((char *)tp->value, tp->size);
|
||||
if (!pin)
|
||||
goto oom;
|
||||
|
||||
0
noautobuild
Normal file
0
noautobuild
Normal file
5
pesign.patches
Normal file
5
pesign.patches
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch
|
||||
Patch0002: 0002-Fix-reversed-calloc-arguments.patch
|
||||
Patch0003: 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch
|
||||
Patch0004: 0004-cms_common-skip-authentication-on-the-Friendly-slot.patch
|
||||
Patch0005: 0005-Add-const-qualifier-to-variable.patch
|
||||
140
pesign.spec
140
pesign.spec
|
|
@ -1,29 +1,33 @@
|
|||
%global macrosdir %(d=%{_rpmconfigdir}/macros.d; [ -d $d ] || d=%{_sysconfdir}/rpm; echo $d)
|
||||
|
||||
# No. I have enough trouble already.
|
||||
%undefine _auto_set_build_flags
|
||||
|
||||
Name: pesign
|
||||
Summary: Signing utility for UEFI binaries
|
||||
Version: 113
|
||||
Release: 18%{?dist}
|
||||
License: GPLv2
|
||||
URL: https://github.com/vathpela/pesign
|
||||
Version: 116
|
||||
Release: 9%{?dist}
|
||||
License: GPL-2.0-only
|
||||
URL: https://github.com/rhboot/pesign
|
||||
|
||||
Obsoletes: pesign-rh-test-certs <= 0.111-7
|
||||
BuildRequires: make
|
||||
BuildRequires: efivar-devel >= 38-1
|
||||
BuildRequires: gcc
|
||||
BuildRequires: git
|
||||
BuildRequires: libuuid-devel
|
||||
BuildRequires: make
|
||||
BuildRequires: mandoc
|
||||
BuildRequires: nspr
|
||||
BuildRequires: nspr-devel >= 4.9.2-1
|
||||
BuildRequires: nss
|
||||
BuildRequires: nss-devel >= 3.13.6-1
|
||||
BuildRequires: nss-tools
|
||||
BuildRequires: nss-util
|
||||
BuildRequires: popt-devel
|
||||
BuildRequires: nss-tools
|
||||
BuildRequires: nspr-devel >= 4.9.2-1
|
||||
BuildRequires: nss-devel >= 3.13.6-1
|
||||
BuildRequires: efivar-devel >= 31-1
|
||||
BuildRequires: libuuid-devel
|
||||
BuildRequires: python3
|
||||
BuildRequires: python3-rpm-macros
|
||||
BuildRequires: tar
|
||||
BuildRequires: xz
|
||||
BuildRequires: python3-rpm-macros
|
||||
BuildRequires: python3
|
||||
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
|
||||
BuildRequires: systemd-rpm-macros
|
||||
%endif
|
||||
|
|
@ -33,8 +37,7 @@ Requires: nss-tools >= 3.53
|
|||
Requires: nss-util
|
||||
Requires: popt
|
||||
Requires: rpm
|
||||
Requires(pre): shadow-utils
|
||||
ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm}
|
||||
ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64
|
||||
%if 0%{?rhel} == 7
|
||||
BuildRequires: rh-signing-tools >= 1.20-2
|
||||
%endif
|
||||
|
|
@ -42,22 +45,10 @@ BuildRequires: rh-signing-tools >= 1.20-2
|
|||
Source0: https://github.com/rhboot/pesign/releases/download/%{version}/pesign-%{version}.tar.bz2
|
||||
Source1: certs.tar.xz
|
||||
Source2: pesign.py
|
||||
Source3: pesign.patches
|
||||
|
||||
Patch0001: 0001-efikeygen-Fix-the-build-with-nss-3.44.patch
|
||||
Patch0002: 0002-pesigcheck-Fix-a-wrong-assignment.patch
|
||||
Patch0003: 0003-Make-0.112-client-and-server-work-with-the-113-proto.patch
|
||||
Patch0004: 0004-Rename-var-run-to-run.patch
|
||||
Patch0005: 0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch
|
||||
Patch0006: 0006-client-try-run-and-var-run-for-the-socket-path.patch
|
||||
Patch0007: 0007-client-remove-an-extra-debug-print.patch
|
||||
Patch0008: 0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch
|
||||
Patch0009: 0009-pesign-authorize-shellcheck.patch
|
||||
Patch0010: 0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch
|
||||
Patch0011: 0011-kernel-building-hack.patch
|
||||
Patch0012: 0012-Use-run-not-var-run.patch
|
||||
Patch0013: 0013-Turn-off-free-nonheap-object.patch
|
||||
Patch0014: 0014-Fix-bad-free-of-cms-data-DoS-only.patch
|
||||
Patch0015: 0015-daemon-remove-always-true-comparison.patch
|
||||
# generate with tool
|
||||
%include %{SOURCE3}
|
||||
|
||||
%description
|
||||
This package contains the pesign utility for signing UEFI binaries as
|
||||
|
|
@ -75,6 +66,11 @@ git am %{patches} </dev/null
|
|||
git config --unset user.email
|
||||
git config --unset user.name
|
||||
|
||||
# Create a sysusers.d config file
|
||||
cat >pesign.sysusers.conf <<EOF
|
||||
u pesign - 'Group for the pesign signing daemon' /run/pesign -
|
||||
EOF
|
||||
|
||||
%build
|
||||
make PREFIX=%{_prefix} LIBDIR=%{_libdir}
|
||||
|
||||
|
|
@ -109,12 +105,8 @@ cp -av libdpe/*.[ch] src/
|
|||
install -d -m 0755 %{buildroot}%{python3_sitelib}/mockbuild/plugins/
|
||||
install -m 0755 %{SOURCE2} %{buildroot}%{python3_sitelib}/mockbuild/plugins/
|
||||
|
||||
%pre
|
||||
getent group pesign >/dev/null || groupadd -r pesign
|
||||
getent passwd pesign >/dev/null || \
|
||||
useradd -r -g pesign -d /run/pesign -s /sbin/nologin \
|
||||
-c "Group for the pesign signing daemon" pesign
|
||||
exit 0
|
||||
install -m0644 -D pesign.sysusers.conf %{buildroot}%{_sysusersdir}/pesign.conf
|
||||
|
||||
|
||||
%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
|
||||
%post
|
||||
|
|
@ -140,13 +132,13 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null
|
|||
%files
|
||||
%{!?_licensedir:%global license %%doc}
|
||||
%license COPYING
|
||||
%doc README TODO
|
||||
%doc README.md TODO
|
||||
%{_bindir}/authvar
|
||||
%{_bindir}/efikeygen
|
||||
%{_bindir}/efisiglist
|
||||
%{_bindir}/pesigcheck
|
||||
%{_bindir}/pesign
|
||||
%{_bindir}/pesign-client
|
||||
%{_bindir}/pesum
|
||||
%dir %{_libexecdir}/pesign/
|
||||
%dir %attr(0770,pesign,pesign) %{_sysconfdir}/pki/pesign/
|
||||
%config(noreplace) %attr(0660,pesign,pesign) %{_sysconfdir}/pki/pesign/*
|
||||
|
|
@ -168,10 +160,80 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null
|
|||
%endif
|
||||
%{python3_sitelib}/mockbuild/plugins/*/pesign.*
|
||||
%{python3_sitelib}/mockbuild/plugins/pesign.*
|
||||
%{_sysusersdir}/pesign.conf
|
||||
|
||||
%changelog
|
||||
* Tue Mar 08 2022 Robbie Harwood <rharwood@redhat.com> - 113-18
|
||||
- Backport DoS fix from 115
|
||||
* Mon Jun 22 2026 Nicolas Frayer <nfrayer@redhat.com> - 116-9
|
||||
- Fix a FTBFS issue caused by a missing const qualifier
|
||||
- Resolves: #2491392
|
||||
|
||||
* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
|
||||
- Add sysusers.d config file to allow rpm to create users/groups automatically
|
||||
|
||||
* Wed Jan 29 2025 Nicolas Frayer <nfrayer@redhat.com> - 116-7
|
||||
- Backport patch to skip auth on friendly slot
|
||||
|
||||
* Thu Nov 21 2024 Peter Jones <pjones@redhat.com> - 116-6
|
||||
- Work around OpenSC token name changes
|
||||
|
||||
* Tue Nov 12 2024 Kevin Fenzi <kevin@scrye.com> - 116-5
|
||||
- Rebuild to pick up riscv64 change
|
||||
|
||||
* Tue Mar 05 2024 Liu Yang <Yang.Liu.sn@gmail.com> - 116-4
|
||||
- Add riscv64.
|
||||
|
||||
* Fri Feb 02 2024 Peter Jones <pjones@redhat.com> - 116-3
|
||||
- Fix incorrect calloc() invocations caught by -Wcalloc-transposed-args
|
||||
|
||||
* Mon Feb 20 2023 Nicolas Frayer <nfrayer@redhat.com> - 116-2
|
||||
- cms_common: Fixed Segmentation fault
|
||||
|
||||
* Tue Jan 31 2023 Robbie Harwood <rharwood@redhat.com> - 116-1
|
||||
- New upstream release (116)
|
||||
- Resolves: CVE-2022-3560
|
||||
|
||||
* Wed Aug 31 2022 Robbie Harwood <rharwood@redhat.com> - 115-9
|
||||
- Roll up to pjones's smartcard/cms fixes
|
||||
|
||||
* Tue Aug 02 2022 Robbie Harwood <rharwood@redhat.com> - 115-8
|
||||
- Rebuild for python bytecode change
|
||||
- See-also: #2107826
|
||||
|
||||
* Thu Jul 07 2022 Robbie Harwood <rharwood@redhat.com> - 115-6
|
||||
- Fix formatting of man pages
|
||||
- Resolves: #2104778
|
||||
|
||||
* Mon Apr 04 2022 Robbie Harwood <rharwood@redhat.com> - 115-5
|
||||
- Detect presence of rpm-sign when checking for rhel-ness
|
||||
|
||||
* Fri Apr 01 2022 Robbie Harwood <rharwood@redhat.com> - 115-4
|
||||
- Correctly handle rhel and centos macros
|
||||
|
||||
* Fri Mar 25 2022 Robbie Harwood <rharwood@redhat.com> - 115-3
|
||||
- Add -D_GLIBCXX_ASSERTIONS to CPPFLAGS
|
||||
|
||||
* Thu Mar 24 2022 Robbie Harwood <rharwood@redhat.com> - 115-2
|
||||
- Add support for non-koji signing in macros
|
||||
- Resolves: #1880858
|
||||
|
||||
* Tue Mar 08 2022 Robbie Harwood <rharwood@redhat.com> - 115-1
|
||||
- New upstream version (115)
|
||||
|
||||
* Mon Feb 14 2022 Robbie Harwood <rharwood@redhat.com> - 114-4
|
||||
- Disable -fanalyzer since it's broken and pragmas don't work
|
||||
- See-also: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104370
|
||||
|
||||
* Mon Feb 14 2022 Robbie Harwood <rharwood@redhat.com> - 114-3
|
||||
- Fix explicit NULL deref when daemonizing
|
||||
|
||||
* Wed Feb 02 2022 Robbie Harwood <rharwood@redhat.com> - 114-2
|
||||
- Attempt to fix signing parsing by dropping pesign_args
|
||||
|
||||
* Tue Feb 01 2022 Robbie Harwood <rharwood@redhat.com> - 114-1
|
||||
- New upstream version (114)
|
||||
|
||||
* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 113-18
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 113-17
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
|
|
|||
13
rpminspect.yaml
Normal file
13
rpminspect.yaml
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
inspections:
|
||||
# Not a Java package
|
||||
javabytecode: off
|
||||
|
||||
# These just flag when things change "too much"
|
||||
changedfiles: off
|
||||
filesize: off
|
||||
patches: off
|
||||
upstream: off
|
||||
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2010936
|
||||
annocheck: off
|
||||
2
sources
2
sources
|
|
@ -1,2 +1,2 @@
|
|||
SHA512 (certs.tar.xz) = ddac535c786d1a23074534323c4ce89f907d4f82b19c5d3a9c814b145fbac1599cd2386cf20c28d22aee7d5c4db441f052bab9ee655de756117a0a0bc99b525f
|
||||
SHA512 (pesign-113.tar.bz2) = 89c5e33bf6ac8f8dc4b65192e5fd4bf1fea285106d1de2a6ea02a8c5090f2ec5976b1d80c60e57f74fa56dc25b174a4dd5682292db44ab9aeab69ea992dfef36
|
||||
SHA512 (pesign-116.tar.bz2) = be3e1083f5e9f889cb8f7c50a8ebe723542fb2f6d1de8de9b04a9f21526ebaa8ab1efc7d4be11bcb0bc9862fa4bc6f78ee35e4d3496dd3b8927170b97795d25c
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue