All linux capabilities cannot be parsed for digest list in openEuler-22.03

Issue:
After openEuler-22.03 enables full IMA measurement and appraising, all files with capability are prohibited from executing, even if the digest list is normally generated and signed.

I check the code and find that there are some problems in lib/cap.c:

1. The internal structure _cap_struct of libcap is redefined in digest-list-tools. And as libcap is upgraded to 2.61, the fields of the structure are changed, resulting in digest-list-tools cannot parse the capabilities normally. When the digest list file is generated, all capability information is lost.

2. In the definition of _cap_struct, the length of the array member variable u is _LINUX_CAPABILITY_U32S, while the length in libcap is _LIBCAP_CAPABILITY_U32S (not exported). In linux/capability.h, _LINUX_CAPABILITY_U32S is set to the earliest version (_LINUX_CAPABILITY_VERSION_1) to ensure backward compatibility. While in libcap, _LINUX_CAPABILITY_U32S_3 is set to _LINUX_CAPABILITY_U32S_3 in preference, which results in a potential problem.

问题：
openEuler-22.03开启IMA全量度量后，所有具有capability的文件被禁止执行，即使摘要列表正常生成并签名。

定位分析：
在lib/cap.c文件中存在一些问题：
1. 代码重定义了_cap_struct结构体，而该结构体是libcap的内部定义。在libcap升级到2.61版本后，该结构体的字段发生了变化，导致digest-list-tools无法正常解析capability，在生成摘要列表文件时，文件的capability信息会丢失。

2. 另外，在重定义了_cap_struct结构体时，数组成员变量u的长度选择的_LINUX_CAPABILITY_U32S，而在libcap中的长度是_LIBCAP_CAPABILITY_U32S（未导出），其实两者并不一致。在linux/capability.h中，为了保证代码的向后兼容，_LINUX_CAPABILITY_U32S定义为最早版本的_LINUX_CAPABILITY_VERSION_1，而在libcap中，_LIBCAP_CAPABILITY_U32S会被优先定义为_LINUX_CAPABILITY_U32S_3。

src-openEuler/digest-list-tools

内容风险标识

评论 (2)

src-openEuler/digest-list-tools .gitee-modal { width: 500px !important; }

内容风险标识