[RFC][PATCH v2 00/13] integrity: Introduce a digest cache
Roberto Sassu
roberto.sassu at huaweicloud.com
Tue Sep 5 15:46:25 UTC 2023
On Sat, 2023-08-12 at 12:46 +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu at huawei.com>
>
> Introduction
> ============
>
> The main goal of Integrity Measurement Architecture (IMA) is to perform a
> measurement of the file content and use it for remote attestation, to
> report a possibly compromised system, using the TPM as a root of trust. It
> can also prevent a system compromise from happening by checking the
> calculated file digest against a known-good reference value and by denying
> the current operation if there is a mismatch.
Small update, I build openSUSE Tumbleweed packages with the patches I
sent (I added an rpm plugin). After the following steps, openSUSE
Tumbleweed will:
- Provide a predictable measurement list and PCR (11)
- Enforce an IMA Appraisal policy for executable code (excluding tmpfs)
- Support the above after package installation and removal
1) Add the following repository to YaST:
https://download.opensuse.org/repositories/home:/roberto.sassu:/integrity-digest-cache/standard/
2) Install the necessary packages (in a testing VM):
# zypper in gpg2-2.3.8-316.2.x86_64 kernel-kvmsmall kernel-tools-digest-lists
3) Generate the initial set of digest lists from installed packages:
# manage_digest_lists -d /etc/digest_lists -o gen -i rpmdb -f rpm
4) Add security.digest_list xattr to every file, to point to the
respective digest list:
# manage_digest_lists -i /etc/digest_lists -o add-xattr
5) Create /etc/ima/ima-policy with the content:
dont_measure fsmagic=0x01021994
measure func=DIGEST_LIST_CHECK template=ima-modsig pcr=11
measure func=BPRM_CHECK digest_cache=content pcr=11
measure func=MMAP_CHECK digest_cache=content pcr=11
dont_appraise fsmagic=0x01021994
appraise func=BPRM_CHECK digest_cache=content
appraise func=MMAP_CHECK digest_cache=content
appraise func=DIGEST_LIST_CHECK appraise_type=imasig|modsig
6) Add the following lines to /etc/apparmor.d/abstractions/base, to
allow all processes to read /etc/digest_lists
@{etc_ro}/digest_lists/** r,
7) Reboot
That's it. Only openSUSE-distributed files are allowed to run (plus the
ones I built). If there is any problem, please reboot with
ima_appraise=log in the kernel command line, and delete the IMA policy.
I hope to receive more reviews, and to make the necessary changes to
have this new feature accepted in the kernel. This is a requirement for
Linux distributions to pick the feature up.
Thanks
Roberto
> Motivation
> ==========
>
> This patch set aims to address two important shortcomings: predictability
> of the Platform Configuration Registers (PCRs), and the provisioning of
> reference values to compare the calculated file digest against.
>
> Remote attestation, according to Trusted Computing Group (TCG)
> specifications, is done by replicating the PCR extend operation in
> software with the digests in the event log (in this case the IMA
> measurement list), and by comparing the obtained value with the PCR value
> signed by the TPM with the quote operation.
>
> Due to how the extend operation is performed, if measurements are done in
> a different order, the final PCR value will be different. That means that
> if measurements are done in parallel, there is no way to predict what the
> final PCR value will be, making impossible to seal data to a PCR value. If
> the PCR value was predictable, a system could for example prove its
> integrity by unsealing and using its private key, without sending every
> time the full list of measurements.
>
> Provisioning reference values for file digests is also a difficult task.
> The solution so far was to add file signatures to RPM packages, and
> possibly to DEB packages, so that IMA can verify them. While this undoubtly
> works, it also requires Linux distribution vendors to support the feature
> by rebuilding all their packages, and eventually extending their PKI to
> perform the additional signatures. It could also require developers extra
> work to deal with the additional data.
>
> On the other hand, since often packages carry the file digests themselves,
> it won't be actually needed to add file signatures. If the kernel was able
> to extract the file digests by itself, all the tasks mentioned above for
> the Linux distribution vendors won't be needed too. All current and past
> Linux distributions can be easily retrofitted to enable IMA appraisal with
> the file digests from the packages.
>
> Narrowing down the scope of a package parser to only extract specific
> information makes it small enough to accurately verify that it cannot harm
> the kernel. An additional mitigation consists in verifying the signature of
> the package first, before attempting to extract the file digests.
>
>
> Solution
> ========
>
> To avoid a PCR is extended in a non-deterministic way, the proposed
> solution is to replace individual file measurements with the measurement of
> a file (the digest list) containing a set of file digests. If the
> calculated digest of a file being measured/appraised matches one digest in
> the set, its measurement is skipped. If otherwise there is no match, the
> file digest is added to the measurement list.
>
> The resulting measurement list, which cannot be done on the default IMA PCR
> to avoid ambiguity with the default-style measurement, has the following
> meaning: none/some/all files represented with the measurement of the digest
> lists COULD have been accessed, without knowing IF and WHEN. Any other
> measurement (other than boot_aggregate) is of a file whose digest was not
> included in the digest list.
>
> File signatures have a coarser granularity, it is per-signing key and not
> per-package. A measurement list containing just the measurement of the
> signing keys and the files without/invalid signature (those with valid
> signature would be skipped) would be even less accurate.
>
> To ensure a rapid and smooth deployment of IMA appraisal, the kernel has
> been provided with the ability to extract file digests from the RPM
> package headers, and add them to the kernel memory on demand (only when a
> file from a given package is accessed). This ensures that the memory
> consumption for this new feature is directly proportional to the usage of
> the system.
>
>
> Scope
> =====
>
> The integrity digest cache enables IMA to extend a PCR (not the default
> one) in a deterministic fashion, and to appraise immutable files with file
> digests from the packages, when no other appraisal method is available. It
> does not yet support metadata verification with Extended Verification
> Module (EVM), for which a separate patch set will be provided.
>
>
> Design
> ======
>
> The digest cache is a hash table of file digests, attached to the inode of
> the digest list from which file digests are extracted. It is accessible,
> when a given file is being measured/appraised, from the new xattr
> security.digest_list, containing the path of the digest list itself.
>
> If the calculated file digest is found in the digest cache, its measurement
> is avoided, or read-only access is granted if appraisal is in enforcing
> mode. Read-write access is prevented to avoid updating an unverified HMAC
> of file metadata.
>
> The digest cache can be used only if the following conditions are met:
>
> - The 'digest_cache=content' keyword is added to the desired IMA policy
> rules;
> - If the rule action is 'measure', a PCR different from the default one
> is specified;
> - If the rule action is 'appraise', 'digest_cache=content' and
> 'appraise_type' don't appear at the same time;
> - The same action for which the digest cache is used was done also on the
> digest list;
> - The digest cache is not (currently) used for measurement/appraisal of
> other digest lists.
>
> For performance reasons, the digest cache is attached to every inode using
> it, since multiple hooks can be invoked on it before the
> measurement/appraisal result is cached. A reference count indicates how
> many inodes use it, and only when it reaches zero, the digest cache can be
> freed (for example when inodes are evicted from memory).
>
> Two digest cache pointers have been added to the iint to distinguish for
> which purpose they should be used: dig_owner points to the digest cache
> created from the same inode the iint refers to, and should be used for
> measurement/appraisal of other inodes; dig_user points to the digest
> cache created from a different inode, and requested for
> measurement/appraisal. One digest cache pointer would be confusing, as
> for digest lists the digest cache was created from them, but IMA would
> try to use that digest cache for measurement/appraisal of itself.
>
> Finally, at the first digest list measurement, an iterator is executed to
> sequentially read (not parse) all the digest lists in the same directory,
> so that the PCR is extended in a deterministic fashion. The other
> concurrent users of the digest cache have to wait until the iterator
> finishes.
>
>
> API
> ===
>
> digest_cache_alloc(), digest_cache_parse_digest_list() and
> digest_cache_new() are internal functions used during the creation and
> initialization of the digest cache.
>
> digest_cache_get() and digest_cache_free() are called by the user of the
> digest cache (e.g. IMA), to obtain and free a digest cache.
>
> digest_cache_init_htable(), digest_cache_add() and digest_cache_lookup()
> are called by the digest list parsers to populate and search in a digest
> cache.
>
>
> Digest List Formats
> ===================
>
> tlv
> ~~~
>
> The Type-Length-Value (TLV) format was chosen for its extensibility.
> Additional fields can be added without breaking compatibility with old
> versions of the parser.
>
> The layout of a tlv digest list is the following:
>
> [header: DIGEST_LIST_FILE, num fields, total len]
> [field: DIGEST_LIST_ALGO, length, value]
> [field: DIGEST_LIST_ENTRY#1, length, value (below)]
> |- [header: DIGEST_LIST_FILE, num fields, total len]
> |- [ENTRY#1_DIGEST, length, file digest]
> |- [ENTRY#1_PATH, length, file path]
> [field: DIGEST_LIST_ENTRY#N, length, value (below)]
> |- [header: DIGEST_LIST_FILE, num fields, total len]
> |- [ENTRY#N_DIGEST, length, file digest]
> |- [ENTRY#N_PATH, length, file path]
>
> DIGEST_LIST_ALGO is a field to specify the algorithm of the file digest.
> DIGEST_LIST_ENTRY is a nested TLV structure with the following fields:
> ENTRY_DIGEST contains the file digest; ENTRY_PATH contains the file path.
>
>
> rpm
> ~~~
>
> The rpm digest list is basically a subset of the RPM package header.
> Its format is:
>
> [RPM magic number]
> [RPMTAG_IMMUTABLE]
>
> RPMTAG_IMMUTABLE is a section of the full RPM header containing the part
> of the header that was signed, and whose signature is stored in the
> RPMTAG_RSAHEADER section.
>
>
> Appended Signature
> ~~~~~~~~~~~~~~~~~~
>
> Digest lists can have a module-style appended signature, that can be used
> for appraisal with IMA. The signature type can be PKCS#7, as for kernel
> modules, or the new user asymmetric key signature.
>
>
> History
> =======
>
> The original name of this work was IMA Digest Lists, which was somehow
> considered too invasive. The code was moved to a separate component named
> DIGLIM (DIGest Lists Integrity Module), with the purpose of removing the
> complexity away of IMA, and also add the possibility of using it with other
> kernel components (e.g. Integrity Policy Enforcement, or IPE).
>
> Since it was originally proposed, in 2017, this work grew up a lot thanks
> to various comments/suggestions. It became integrally part of the openEuler
> distribution since end of 2020.
>
> There are significant differences between this and the previous versions.
> The most important one is moving from a centralized repository of file
> digests to a per-package repository. This significantly reduces the memory
> pressure, since digest lists are loaded into kernel memory only when they
> are actually needed. Also, file digests are automatically unloaded from
> kernel memory at the same time inodes are evicted from memory during
> reclamation.
>
>
> Performance
> ===========
>
> The tests have been performed on a Fedora 38 virtual machine, with 8 cores
> (AMD EPYC-Rome), 4GB of RAM, TPM passthrough. The signing key is an ECDSA
> NIST P-384.
>
> IMA measurement policy: no cache
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> dont_measure fsmagic=0x01021994
> measure func=BPRM_CHECK
> measure func=MMAP_CHECK
>
>
> IMA measurement policy: cache
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> dont_measure fsmagic=0x01021994
> measure func=DIGEST_LIST_CHECK template=ima-modsig pcr=11
> measure func=BPRM_CHECK digest_cache=content pcr=11
> measure func=MMAP_CHECK digest_cache=content pcr=11
>
>
> IMA Measurement Results
> ~~~~~~~~~~~~~~~~~~~~~~~
>
> +-----------+-----------+-----------+
> | # measur. | boot time | slab |
> +-----------------------------+-----------+-----------+-----------+
> | measure (no cache) | 389 | 12.682s | 231453 KB |
> +-----------------------------+-----------+-----------+-----------+
> | measure (cache, no iter) | 175 | 12.283s | 234224 KB |
> +-----------------------------+-----------+-----------+-----------+
> | measure (cache, iter) | 853 | 16.430s | 238491 KB |
> +-----------------------------+-----------+-----------+-----------+
>
> With the iterator enabled, all 852 packages are measured. Consequently, the
> boot time is longer. One possible optimization would be to exclude the
> packages that don't include measured files. By disabling the iterator, it
> can be seen that the packages actually used are 174 (one measurement is for
> boot_aggregate).
>
>
> IMA appraisal policy: no cache
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> dont_appraise fsmagic=0x01021994
> appraise func=BPRM_CHECK appraise_type=imasig
> appraise func=MMAP_CHECK appraise_type=imasig
>
>
> IMA appraisal policy: cache
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> dont_appraise fsmagic=0x01021994
> appraise func=DIGEST_LIST_CHECK appraise_type=imasig|modsig
> appraise func=BPRM_CHECK digest_cache=content
> appraise func=MMAP_CHECK digest_cache=content
>
>
> IMA Appraisal Results
> ~~~~~~~~~~~~~~~~~~~~~
>
> +-----------+-----------+
> | boot time | slab |
> +-----------------------------+-----------+-----------+
> | appraise (no cache) | 11.995s | 231145 KB |
> +-----------------------------+-----------+-----------+
> | appraise (cache) | 11.879s | 233091 KB |
> +-----------------------------+-----------+-----------+
>
> In this test, it can be seen that the performance of the two solutions are
> comparable, with the digest cache slightly ahead. The difference could be
> more substantial with more file appraised.
>
>
> How to Test
> ===========
>
> First, it is necessary to copy the new kernel headers (tlv_parser.h,
> uasym_parser.h, tlv_digest_list.h) from usr/include/linux in the kernel
> source directory to /usr/include/linux.
>
> Then, gpg must be rebuilt with the additional patches to convert the PGP
> keys of the Linux distribution to the new user asymmetric key format:
>
> $ gpg --conv-kernel <path of PGP key> >> certs/uasym_keys.bin
>
> This embeds the converted keys in the kernel image. Then, the following
> kernel options must be enabled:
>
> CONFIG_INTEGRITY_DIGEST_CACHE=y
> CONFIG_UASYM_KEYS_SIGS=y
> CONFIG_UASYM_PRELOAD_PUBLIC_KEYS=y
>
> and the kernel must be rebuilt with the patches applied. After boot, it is
> necessary to build and install the digest list tool in tools/digest-lists,
> and to execute (as root):
>
> # manage_digest_lists -o gen -d /etc/digest_lists -i rpmdb -f rpm
>
> The new gpg must also be installed in the system, as it will be used to
> convert the PGP signatures of the RPM headers to the user asymmetric key
> format.
>
> It is recommended to create an additional digest list with the following
> files, by creating a file named 'list' with the content:
>
> /usr/bin/manage_digest_lists
> /usr/lib64/libgen-tlv-list.so
> /usr/lib64/libgen-rpm-list.so
> /usr/lib64/libparse-rpm-list.so
> /usr/lib64/libparse-tlv-list.so
>
> Then, to create the digest list, it is sufficient to execute:
>
> # manage_digest_lists -i list -L -d /etc/digest_lists -o gen -f tlv
>
> If appraisal is enabled and in enforcing mode, it is necessary to sign the
> new digest list, with the sign-file tool in the scripts/ directory of the
> kernel sources:
>
> # scripts/sign-file sha256 certs/signing_key.pem certs/signing_key.pem /etc/digest_lists/tlv-list
>
> The final step is to add security.digest_list to each file with:
>
> # manage_digest_lists -i /etc/digest_lists -o add-xattr
>
> After that, it is possible to test the integrity digest cache with the
> following policy written to /etc/ima/ima-policy:
>
> dont_measure fsmagic=0x01021994
> measure func=DIGEST_LIST_CHECK template=ima-modsig pcr=11
> measure func=BPRM_CHECK digest_cache=content pcr=11
> measure func=MMAP_CHECK digest_cache=content pcr=11
> dont_appraise fsmagic=0x01021994
> appraise func=BPRM_CHECK digest_cache=content
> appraise func=MMAP_CHECK digest_cache=content
> appraise func=DIGEST_LIST_CHECK appraise_type=imasig|modsig
>
> Tmpfs is excluded for now, until memfd is properly handled.
>
> Before loading the policy, it is possible to enable dynamic debug to see
> which operations are done by the integrity digest cache:
>
> # echo "file tlv* +p" > /sys/kernel/debug/dynamic_debug/control
> # echo "file rpm* +p" > /sys/kernel/debug/dynamic_debug/control
> # echo "file digest* +p" > /sys/kernel/debug/dynamic_debug/control
>
> Alternatively, the same strings can be set as value of the dyndbg= option
> in the kernel command line.
>
> A preliminary test, before booting the system with the new policy, is to
> supply the policy to IMA in the current system with:
>
> # cat /etc/ima/ima-policy > /sys/kernel/security/ima/policy
>
> If that worked, the system can be rebooted. Systemd will take care of
> loading the IMA policy at boot. The instructions have been tested on a
> Fedora 38 OS.
>
> After boot, it is possible to check the content of the measurement list:
>
> # cat /sys/kernel/security/ima/ascii_runtime_measurements
>
> If only the files shipped with Fedora 38 have been executed, the
> measurement list will contain only the digest lists, and not the individual
> files.
>
> Another test is to ensure that IMA prevents the execution of unknown files:
>
> # cp -a /bin/cat .
> # ./cat
>
> That will work. But not on the modified binary:
>
> # echo 1 >> cat
> # cat
> -bash: ./cat: Permission denied
>
> Execution will be denied, and a new entry in the measurement list will
> appear (it would be probably ok to not add that entry, as access to the
> file was denied):
>
> 11 50b5a68bea0776a84eef6725f17ce474756e51c0 ima-ng sha256:15e1efee080fe54f5d7404af7e913de01671e745ce55215d89f3d6521d3884f0 /root/cat
>
> Finally, it is possible to test the shrinking of the digest cache, by
> forcing the kernel to evict inodes from memory:
>
> # echo 3 > /proc/sys/vm/drop_caches
>
> The kernel log should have messages like:
>
> [ 313.032536] DIGEST CACHE: Remove digest sha256:102900208eef27b766380135906d431dba87edaa7ec6aa72e6ebd3dd67f3a97b from digest list /etc/digest_lists/rpm-libseccomp-2.5.3-4.fc38.x86_64
>
>
> Patch set dependencies
> ======================
>
> This patch set depends on:
>
> https://lore.kernel.org/linux-integrity/20230720153247.3755856-2-roberto.sassu@huaweicloud.com/
>
> which allows to appraise RPM package headers with the PGP keys of Linux
> distribution vendors.
>
>
> Patch set content
> =================
>
> Patch 1 introduces a new hook to identify the loading of digest lists and
> consequently appraise them.
>
> Patches 2-4 implement the digest cache, and an iterator to prefetch the
> digest lists to measure them in a deterministic way.
>
> Patches 5-6 implement the currently supported digest list formats: tlv and
> rpm. The tlv format relies on the TLV parser defined in the patch set
> mentioned above.
>
> Patches 7-9 enable the usage of the digest cache in IMA for measurement and
> appraisal.
>
> Patches 10-12 add a tool to manage digest lists.
>
> Patch 13 adds the documentation of the integrity digest cache.
>
>
> Changelog
> =========
>
> v1:
> - Add documentation in Documentation/security/integrity-digest-cache.rst
> - Pass the mask of IMA actions to digest_cache_alloc()
> - Add a reference count to the digest cache
> - Remove the path parameter from digest_cache_get(), and rely on the
> reference count to avoid the digest cache disappearing while being used
> - Rename the dentry_to_check parameter of digest_cache_get() to dentry
> - Rename digest_cache_get() to digest_cache_new() and add
> digest_cache_get() to set the digest cache in the iint of the inode for
> which the digest cache was requested
> - Add dig_owner and dig_user to the iint, to distinguish from which inode
> the digest cache was created from, and which is using it; consequently it
> makes the digest cache usable to measure/appraise other digest caches
> (support not yet enabled)
> - Add dig_owner_mutex and dig_user_mutex to serialize accesses to dig_owner
> and dig_user until they are initialized
> - Enforce strong synchronization and make the contenders wait until
> dig_owner and dig_user are assigned to the iint the first time
> - Move checking IMA actions on the digest list earlier, and fail if no
> action were performed (digest cache not usable)
> - Remove digest_cache_put(), not needed anymore with the introduction of
> the reference count
> - Fail immediately in digest_cache_lookup() if the digest algorithm is
> not set in the digest cache
> - Use 64 bit mask for IMA actions on the digest list instead of 8 bit
> - Return NULL in the inline version of digest_cache_get()
> - Use list_add_tail() instead of list_add() in the iterator
> - Copy the digest list path to a separate buffer in digest_cache_iter_dir()
> - Use digest list parsers verified with Frama-C
> - Explicitly disable (for now) the possibility in the IMA policy to use the
> digest cache to measure/appraise other digest lists
> - Replace exit(<value>) with return <value> in manage_digest_lists.c
>
> Roberto Sassu (13):
> ima: Introduce hook DIGEST_LIST_CHECK
> integrity: Introduce a digest cache
> integrity/digest_cache: Add functions to populate and search
> integrity/digest_cache: Prefetch digest lists in a directory
> integrity/digest_cache: Parse tlv digest lists
> integrity/digest_cache: Parse rpm digest lists
> ima: Add digest_cache policy keyword
> ima: Use digest cache for measurement
> ima: Use digest cache for appraisal
> tools: Add tool to manage digest lists
> tools/digest-lists: Add tlv digest list generator and parser
> tools/digest-lists: Add rpm digest list generator and parser
> docs: Add documentation of the integrity digest cache
>
> Documentation/ABI/testing/ima_policy | 6 +-
> Documentation/security/index.rst | 1 +
> .../security/integrity-digest-cache.rst | 484 ++++++++++++++++++
> MAINTAINERS | 2 +
> include/linux/kernel_read_file.h | 1 +
> include/uapi/linux/tlv_digest_list.h | 59 +++
> include/uapi/linux/xattr.h | 3 +
> security/integrity/Kconfig | 12 +
> security/integrity/Makefile | 4 +
> security/integrity/digest_cache.c | 454 ++++++++++++++++
> security/integrity/digest_cache.h | 110 ++++
> security/integrity/digest_cache_iter.c | 160 ++++++
> .../integrity/digest_list_parsers/parsers.h | 15 +
> security/integrity/digest_list_parsers/rpm.c | 215 ++++++++
> security/integrity/digest_list_parsers/tlv.c | 188 +++++++
> security/integrity/iint.c | 12 +
> security/integrity/ima/ima.h | 16 +-
> security/integrity/ima/ima_api.c | 22 +-
> security/integrity/ima/ima_appraise.c | 16 +-
> security/integrity/ima/ima_main.c | 40 +-
> security/integrity/ima/ima_policy.c | 59 ++-
> security/integrity/integrity.h | 8 +
> tools/Makefile | 16 +-
> tools/digest-lists/.gitignore | 7 +
> tools/digest-lists/Makefile | 72 +++
> tools/digest-lists/common.c | 163 ++++++
> tools/digest-lists/common.h | 90 ++++
> tools/digest-lists/generators/generators.h | 18 +
> tools/digest-lists/generators/rpm.c | 257 ++++++++++
> tools/digest-lists/generators/tlv.c | 168 ++++++
> tools/digest-lists/manage_digest_lists.c | 349 +++++++++++++
> tools/digest-lists/manage_digest_lists.txt | 82 +++
> tools/digest-lists/parsers/parsers.h | 16 +
> tools/digest-lists/parsers/rpm.c | 169 ++++++
> tools/digest-lists/parsers/tlv.c | 195 +++++++
> tools/digest-lists/parsers/tlv_parser.h | 38 ++
> 36 files changed, 3501 insertions(+), 26 deletions(-)
> create mode 100644 Documentation/security/integrity-digest-cache.rst
> create mode 100644 include/uapi/linux/tlv_digest_list.h
> create mode 100644 security/integrity/digest_cache.c
> create mode 100644 security/integrity/digest_cache.h
> create mode 100644 security/integrity/digest_cache_iter.c
> create mode 100644 security/integrity/digest_list_parsers/parsers.h
> create mode 100644 security/integrity/digest_list_parsers/rpm.c
> create mode 100644 security/integrity/digest_list_parsers/tlv.c
> create mode 100644 tools/digest-lists/.gitignore
> create mode 100644 tools/digest-lists/Makefile
> create mode 100644 tools/digest-lists/common.c
> create mode 100644 tools/digest-lists/common.h
> create mode 100644 tools/digest-lists/generators/generators.h
> create mode 100644 tools/digest-lists/generators/rpm.c
> create mode 100644 tools/digest-lists/generators/tlv.c
> create mode 100644 tools/digest-lists/manage_digest_lists.c
> create mode 100644 tools/digest-lists/manage_digest_lists.txt
> create mode 100644 tools/digest-lists/parsers/parsers.h
> create mode 100644 tools/digest-lists/parsers/rpm.c
> create mode 100644 tools/digest-lists/parsers/tlv.c
> create mode 100644 tools/digest-lists/parsers/tlv_parser.h
>
More information about the Linux-security-module-archive
mailing list