signature=ab09e433311bc487fc2ccf7433b42269,EVM signature mismatch return-EKEYREJECTED|Linux 中国◆开源社区...

本帖最后由 ertou 于 2017-10-11 09:07 编辑

我采用centos 7操作系统，并且开启了ima和evm安全功能模块。配置ima策略只是对可执行文件进行校验。下面是我具体操作步骤：

[root@localhost ~]# evmctl sign --imahash a.out

[root@localhost ~]# getfattr -d -m . -e hex a.out

# file: a.out

security.evm=0x030202ab51ae3a00800672bc78b356025b4a44762180cfcdbd8ab74c2410c2b862ad245c4787f61043091a7998bc2fcf8c2448cde522a55e316010b7e59ccf29f366191737aa0623af991c859c591634b6dc1e0fdccb5be66c0280fc2f56225dee728fc8ed37520ff44f1e47f52fa30ab2303fcf6b34f7a4d3f05ab2cddc729bd5aee1d8c9cf0c1442

security.ima=0x01f2a729d7d51cc3487b3f2756847801b635333133

[root@localhost ~]# ./a.out

bash: ./a.out: Permission denied (这就是在内核中进行evm签名比对时出现了错误)

在内核中执行到RSA_verify()这个函数时，返回了 -EKEYREJECTED错误码。我只定位到问题在这里产生的，不断尝试了生成masterkey and encrypted key的方法，还是没有找到解决方法。

In function RSA_verify ：

if (memcmp(H, EM + T_offset + asn1_size, hash_size) != 0) {

kleave(" = -EKEYREJECTED [EM[T] hash mismatch]");

return -EKEYREJECTED;

下面是我的系统配置：

1 Generate EVM encrypted keys

下面这几条命令必须在root账户登陆才可以操作。

keyctl add user kmk-user "`dd if=/dev/urandom bs=1 count=32 2>/dev/null`" @u

keyctl pipe `keyctl search @u user kmk-user` > /etc/keys/kmk-user.blob

keyctl add encrypted evm-key "new user:kmk-user 32" @u

keyctl pipe `keyctl search @u encrypted evm-key` >/etc/keys/evm-user.blob

2  Generate signing and verification keys

执行ima-evm-utils-v1.0源代码中的ima-genkey-self.sh脚本。

3 Initialize IMA/EVM at early boot

mount -n -t securityfs securityfs /sys/kernel/security

IMA_POLICY=/sys/kernel/security/ima/policy

LSM_POLICY=/etc/sysconfig/ima-policy

grep -v "^#" $LSM_POLICY >$IMA_POLICY

cat /etc/keys/kmk-user.blob | keyctl padd user kmk-user @u

keyctl add encrypted evm-key "load `cat /etc/keys/evm-user.blob`" @u

# import IMA public key

ima_id=`keyctl newring _ima @u`

evmctl  import /etc/keys/x509_evm.der $ima_id

# import EVM public key

evm_id=`keyctl newring _evm @u`

evmctl  import /etc/keys/x509_evm.der $evm_id

echo "1" > /sys/kernel/security/evm

大家帮帮忙，为什么我用的evm签名的key到内核里就验证不通过了，谁有好方法定位问题，再这里谢谢了