From cc44bbfb2eaa90284a67ad6d42706e6433abd7ff Mon Sep 17 00:00:00 2001 From: Patrick Ohly Date: Thu, 3 Nov 2016 11:47:53 +0100 Subject: [PATCH 1/3] verify_file: ignore xattrs when verifying Manifest files When IMA or Smack are active on the client, the downloaded Manifest files will be assigned certain xattrs (security.ima resp. security.SMACK64). Those xattrs did not exist on the server side (because it is most likely not having those kernel features enabled) and besides, the swupd-server code wouldn't include them in the Manifest hashes even if they existed (see write_manifest_plain() in src/manifest.c). Therefore the client must ignore xattrs when verifying Manifest files. Upstream-Status: Backported [https://github.com/clearlinux/swupd-client/commit/09c26658d346cdd80ea54188d991db3493983176] Signed-off-by: Patrick Ohly --- src/hash.c | 9 ++++++++- diff --git a/src/hash.c b/src/hash.c index 1e61454..9553644 100644 --- a/src/hash.c +++ b/src/hash.c @@ -236,7 +236,14 @@ bool verify_file(struct file *file, char *filename) } local->filename = file->filename; - local->use_xattrs = true; + /* + * xattrs are currently not supported for manifest files. + * They are data files produced by the swupd-server and + * therefore do not have any of the xattrs normally + * set for the actual system files (like security.ima + * when using IMA or security.SMACK64 when using Smack). + */ + local->use_xattrs = !file->is_manifest; populate_file_struct(local, filename); if (compute_hash(local, filename) != 0) { -- 2.1.4