[lkml]   [2020]   [Mar]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v3 2/8] ima: Switch to ima_hash_algo for boot aggregate
On Mon, 2020-03-02 at 15:11 +0000, Roberto Sassu wrote:

> > Yes, preference is given to the IMA default algorithm, but it should
> > fall back to using SHA256 or SHA1, based on the TPM.
> Ok. The patch already does it even if the TPM version is not checked.
> For TPM 1.2, if the default algorithm is not SHA1 the patch will select
> the first PCR bank (SHA1).
> Should I send a new patch which explicitly checks the TPM version?

Checking the TPM version shouldn't be necessary.  The code currently
sets bank_idx to the HASH_ALGO_SHA256.  If instead of initializing
bank_idx to 0, initialize it to the nr_allocated_banks or -1.  As long
as the bank_idx value is the same as the initialized value, set the
bank_idx to HASH_ALGO_SHA1.

The subsequent bank_idx would then be limited to testing for the
initialized value.


 \ /
  Last update: 2020-03-02 18:33    [W:0.070 / U:7.940 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site