ipsec attest now deletes file hashes

diff --git a/src/libpts/plugins/imv_attestation/attest_db.c b/src/libpts/plugins/imv_attestation/attest_db.c
index ebd6606008d14fe22ec3983376e687b7021c1b96..55afcab58e34a2d6f27faf1adf5d3ac18c196662 100644 (file)
--- a/src/libpts/plugins/imv_attestation/attest_db.c
+++ b/src/libpts/plugins/imv_attestation/attest_db.c
@@ -1248,6 +1248,25 @@ METHOD(attest_db_t, delete, bool,
 {
        bool success;
 
+       /* delete a file measurement hash for a given product */
+       if (this->algo && this->pid && this->fid)
+       {
+               success = this->db->execute(this->db, NULL,
+                                                               "DELETE FROM file_hashes "
+                                                               "WHERE algo = ? AND product = ? "
+                                                               "AND file = ? AND directory = ?",
+                                                               DB_UINT, this->algo, DB_UINT, this->pid,
+                                                               DB_UINT, this->fid, DB_UINT, this->cid) > 0;
+
+               printf("%4d: %s%s%s\n", this->fid, this->dir, this->did ? "/":"",
+                                                               this->file);
+               printf("%N value for product '%s' %sdeleted from database\n",
+                               pts_meas_algorithm_names, this->algo, this->product,
+                               success ? "" : "could not be ");
+
+               return success;
+       }
+
        if (this->pid && (this->fid || this->did))
        {
                printf("deletion of product/file entries not supported yet\n");
@@ -1370,7 +1389,6 @@ attest_db_t *attest_db_create(char *uri)
                        .destroy = _destroy,
                },
                .dir = strdup(""),
-               .algo = PTS_MEAS_ALGO_SHA256,
                .db = lib->db->create(lib->db, uri),
        );
 

diff --git a/src/libpts/plugins/imv_attestation/build-database.sh b/src/libpts/plugins/imv_attestation/build-database.sh
old mode 100644 (file)
new mode 100755 (executable)
index 91c644c..b24ad02
--- a/src/libpts/plugins/imv_attestation/build-database.sh
+++ b/src/libpts/plugins/imv_attestation/build-database.sh
@@ -233,4 +233,9 @@ ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/xorg/mod
 ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/xorg/modules/extensions
 ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/xorg/modules/input
 ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/share/fonts/truetype/ubuntu-font-family
-
+ipsec attest --del --product "$p" --sha1                --file /lib/resolvconf/list-records
+ipsec attest --del --product "$p" --sha1-ima            --file /lib/resolvconf/list-records
+ipsec attest --del --product "$p" --sha1                --file /usr/bin/lsb_release
+ipsec attest --del --product "$p" --sha1-ima            --file /usr/bin/lsb_release
+ipsec attest --del --product "$p" --sha1                --file /usr/share/language-tools/language-options
+ipsec attest --del --product "$p" --sha1-ima            --file /usr/share/language-tools/language-options