diff --git a/backport-add-detailed-log-of-file-opening-failures.patch b/backport-add-detailed-log-of-file-opening-failures.patch new file mode 100644 index 0000000000000000000000000000000000000000..a2242e44872cbfda5cf24ceabe9b0dcdd04200d7 --- /dev/null +++ b/backport-add-detailed-log-of-file-opening-failures.patch @@ -0,0 +1,73 @@ +From 9c04006b8f5281bd5b436f81ec855f78a719dff7 Mon Sep 17 00:00:00 2001 +From: houmingyong +Date: Wed, 18 Dec 2024 09:34:57 +0800 +Subject: [PATCH] add detailed log of file opening failures + +--- + .../attestation-service/verifier/src/virtcca/ima.rs | 7 ++++--- + .../attestation-service/verifier/src/virtcca/mod.rs | 9 ++++++--- + 2 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/service/attestation/attestation-service/verifier/src/virtcca/ima.rs b/service/attestation/attestation-service/verifier/src/virtcca/ima.rs +index 220a52d..4d26bbe 100644 +--- a/service/attestation/attestation-service/verifier/src/virtcca/ima.rs ++++ b/service/attestation/attestation-service/verifier/src/virtcca/ima.rs +@@ -9,7 +9,7 @@ + * PURPOSE. + * See the Mulan PSL v2 for more details. + */ +-use anyhow::{bail, Result}; ++use anyhow::{anyhow, Result, bail}; + use fallible_iterator::FallibleIterator; + use ima_measurements::{Event, EventData, Parser}; + use serde_json::{json, Map, Value}; +@@ -52,7 +52,8 @@ impl ImaVerify { + bail!("ima log hash verify failed"); + } + +- let ima_refs: Vec<_> = file_reader(IMA_REFERENCE_FILE)? ++ let ima_refs: Vec<_> = file_reader(IMA_REFERENCE_FILE) ++ .map_err(|_err| anyhow!("{} is not found", IMA_REFERENCE_FILE))? + .into_iter() + .map(String::from) + .collect(); +@@ -88,7 +89,7 @@ impl ImaVerify { + use std::io::BufRead; + use std::io::BufReader; + fn file_reader(file_path: &str) -> ::std::io::Result> { +- let file = std::fs::File::open(file_path).expect("open ima reference file failed"); ++ let file = std::fs::File::open(file_path)?; + let mut strings = Vec::::new(); + let mut reader = BufReader::new(file); + let mut buf = String::new(); +diff --git a/service/attestation/attestation-service/verifier/src/virtcca/mod.rs b/service/attestation/attestation-service/verifier/src/virtcca/mod.rs +index ff72f77..d62cc38 100644 +--- a/service/attestation/attestation-service/verifier/src/virtcca/mod.rs ++++ b/service/attestation/attestation-service/verifier/src/virtcca/mod.rs +@@ -176,9 +176,11 @@ impl Evidence { + // todo verify cert chain, now only verify signature + fn verify_dev_cert_chain(dev_cert: &[u8]) -> Result<()> { + let dev_cert = x509::X509::from_der(dev_cert)?; +- let sub_cert_file = std::fs::read(VIRTCCA_SUB_CERT)?; ++ let sub_cert_file = std::fs::read(VIRTCCA_SUB_CERT) ++ .map_err(|_err| anyhow!("{} is not found", VIRTCCA_SUB_CERT))?; + let sub_cert = x509::X509::from_pem(&sub_cert_file)?; +- let root_cert_file = std::fs::read(VIRTCCA_ROOT_CERT)?; ++ let root_cert_file = std::fs::read(VIRTCCA_ROOT_CERT) ++ .map_err(|_err| anyhow!("{} is not found", VIRTCCA_ROOT_CERT))?; + let root_cert = x509::X509::from_pem(&root_cert_file)?; + + // verify dev_cert by sub_cert +@@ -244,7 +246,8 @@ impl Evidence { + } + #[cfg(feature = "no_as")] + fn compare_with_ref(&mut self) -> Result<()> { +- let ref_file = std::fs::read(VIRTCCA_REF_VALUE_FILE)?; ++ let ref_file = std::fs::read(VIRTCCA_REF_VALUE_FILE) ++ .map_err(|_err| anyhow!("{} is not found", VIRTCCA_REF_VALUE_FILE))?; + let js_ref = serde_json::from_slice(&ref_file)?; + match js_ref { + serde_json::Value::Object(obj) => { +-- +2.43.0 + diff --git a/secGear.spec b/secGear.spec index 4273f4050f2b4aaa8faef1eb302a5ed18d3bd917..b62a02d5b87fc8bebb96003b6ff2f42d035134e4 100644 --- a/secGear.spec +++ b/secGear.spec @@ -1,6 +1,6 @@ Name: secGear Version: 0.1.0 -Release: 56 +Release: 57 Summary: secGear is an SDK to develop confidential computing apps based on hardware enclave features @@ -112,6 +112,7 @@ Patch98: 0099-fix-permit-dots-in-the-resource-policy-id.patch Patch99: 0100-challenge-may-generate-by-requester-so-aa-and-as-may.patch Patch100: 0101-generate-random-by-ra_tls-itself.patch Patch101: 0102-Add-support-for-UEFI-measured-boot-attestation.patch +Patch102: backport-add-detailed-log-of-file-opening-failures.patch BuildRequires: gcc python automake autoconf libtool BUildRequires: glibc glibc-devel cmake ocaml-dune rpm gcc-c++ compat-openssl11-libs compat-openssl11-devel @@ -354,6 +355,9 @@ popd systemctl restart rsyslog %changelog +* Tue May 20 2025 huyubiao - 0.1.0-57 +- add backport-add-detailed-log-of-file-opening-failures.patch + * Wed May 14 2025 SPYFAMILY - 0.1.0-56 - Add support for UEFI measured boot attestation