From: Danny Hu <dannyhu@arista.com>
To: keyrings@vger.kernel.org
Cc: dhowells@redhat.com, dwmw2@infradead.org, Danny Hu <dannyhu@arista.com>
Subject: [PATCH] sign-file: Add option to include certificate in sign-file tool
Date: Mon, 29 Sep 2025 15:28:52 -0700 [thread overview]
Message-ID: <20250929222852.116986-1-dannyhu@arista.com> (raw)
The sign-file tool currently generates a signature that does not include
the signing certificate. This requires that the public key used for
verification be loaded directly into the `.ima` keyring.
This approach prevents the use of certificate hierarchies, where a file
is signed by an intermediate key that chains up to a trusted root key in
the keyring.
This patch adds a `-i` flag to the sign-file tool to embed the signing
certificate directly into the signature file. This allows the kernel's
Integrity Measurement Architecture (IMA) to perform a full path
validation on the certificate chain, enabling more flexible and scalable
key management for IMA appraisal.
Signed-off-by: Danny Hu <dannyhu@arista.com>
---
scripts/sign-file.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 7070245edfc1..59a76bca6683 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -80,7 +80,7 @@ static __attribute__((noreturn))
void format(void)
{
fprintf(stderr,
- "Usage: scripts/sign-file [-dp] <hash algo> <key> <x509> <module> [<dest>]\n");
+ "Usage: scripts/sign-file [-dpi] <hash algo> <key> <x509> <module> [<dest>]\n");
fprintf(stderr,
" scripts/sign-file -s <raw sig> <hash algo> <x509> <module> [<dest>]\n");
exit(2);
@@ -228,14 +228,16 @@ int main(int argc, char **argv)
bool raw_sig = false;
unsigned char buf[4096];
unsigned long module_size, sig_size;
- unsigned int use_signed_attrs;
+ unsigned int use_signed_attrs, include_cert;
const EVP_MD *digest_algo;
EVP_PKEY *private_key;
#ifndef USE_PKCS7
CMS_ContentInfo *cms = NULL;
unsigned int use_keyid = 0;
+ include_cert = CMS_NOCERTS;
#else
PKCS7 *pkcs7 = NULL;
+ include_cert = PKCS7_NOCERTS;
#endif
X509 *x509;
BIO *bd, *bm;
@@ -253,11 +255,12 @@ int main(int argc, char **argv)
#endif
do {
- opt = getopt(argc, argv, "sdpk");
+ opt = getopt(argc, argv, "sdpki");
switch (opt) {
case 's': raw_sig = true; break;
case 'p': save_sig = true; break;
case 'd': sign_only = true; save_sig = true; break;
+ case 'i': include_cert = 0; break;
#ifndef USE_PKCS7
case 'k': use_keyid = CMS_USE_KEYID; break;
#endif
@@ -317,21 +320,21 @@ int main(int argc, char **argv)
#ifndef USE_PKCS7
/* Load the signature message from the digest buffer. */
cms = CMS_sign(NULL, NULL, NULL, NULL,
- CMS_NOCERTS | CMS_PARTIAL | CMS_BINARY |
+ include_cert | CMS_PARTIAL | CMS_BINARY |
CMS_DETACHED | CMS_STREAM);
ERR(!cms, "CMS_sign");
ERR(!CMS_add1_signer(cms, x509, private_key, digest_algo,
- CMS_NOCERTS | CMS_BINARY |
+ include_cert | CMS_BINARY |
CMS_NOSMIMECAP | use_keyid |
use_signed_attrs),
"CMS_add1_signer");
- ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) != 1,
+ ERR(CMS_final(cms, bm, NULL, include_cert | CMS_BINARY) != 1,
"CMS_final");
#else
pkcs7 = PKCS7_sign(x509, private_key, NULL, bm,
- PKCS7_NOCERTS | PKCS7_BINARY |
+ include_cert | PKCS7_BINARY |
PKCS7_DETACHED | use_signed_attrs);
ERR(!pkcs7, "PKCS7_sign");
#endif
--
2.47.0
reply other threads:[~2025-09-29 22:28 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250929222852.116986-1-dannyhu@arista.com \
--to=dannyhu@arista.com \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=keyrings@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).