lkml.org 
[lkml]   [2020]   [Jul]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.7 03/30] ima: extend boot_aggregate with kernel measurements
    Date
    From: Maurizio Drocco <maurizio.drocco@ibm.com>

    [ Upstream commit 20c59ce010f84300f6c655d32db2610d3433f85c ]

    Registers 8-9 are used to store measurements of the kernel and its
    command line (e.g., grub2 bootloader with tpm module enabled). IMA
    should include them in the boot aggregate. Registers 8-9 should be
    only included in non-SHA1 digests to avoid ambiguity.

    Signed-off-by: Maurizio Drocco <maurizio.drocco@ibm.com>
    Reviewed-by: Bruno Meneguele <bmeneg@redhat.com>
    Tested-by: Bruno Meneguele <bmeneg@redhat.com> (TPM 1.2, TPM 2.0)
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/integrity/ima/ima.h | 2 +-
    security/integrity/ima/ima_crypto.c | 15 ++++++++++++++-
    2 files changed, 15 insertions(+), 2 deletions(-)

    diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
    index 495e28bd488e6..844a55225ede0 100644
    --- a/security/integrity/ima/ima.h
    +++ b/security/integrity/ima/ima.h
    @@ -30,7 +30,7 @@

    enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
    IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
    -enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
    +enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };

    /* digest size for IMA, fits SHA1 or MD5 */
    #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
    diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
    index fb27174806ba4..e0738d1d143d7 100644
    --- a/security/integrity/ima/ima_crypto.c
    +++ b/security/integrity/ima/ima_crypto.c
    @@ -682,13 +682,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
    if (rc != 0)
    return rc;

    - /* cumulative sha1 over tpm registers 0-7 */
    + /* cumulative digest over TPM registers 0-7 */
    for (i = TPM_PCR0; i < TPM_PCR8; i++) {
    ima_pcrread(i, &d);
    /* now accumulate with current aggregate */
    rc = crypto_shash_update(shash, d.digest,
    crypto_shash_digestsize(tfm));
    }
    + /*
    + * Extend cumulative digest over TPM registers 8-9, which contain
    + * measurement for the kernel command line (reg. 8) and image (reg. 9)
    + * in a typical PCR allocation. Registers 8-9 are only included in
    + * non-SHA1 boot_aggregate digests to avoid ambiguity.
    + */
    + if (alg_id != TPM_ALG_SHA1) {
    + for (i = TPM_PCR8; i < TPM_PCR10; i++) {
    + ima_pcrread(i, &d);
    + rc = crypto_shash_update(shash, d.digest,
    + crypto_shash_digestsize(tfm));
    + }
    + }
    if (!rc)
    crypto_shash_final(shash, digest);
    return rc;
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-07-08 17:44    [W:3.677 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site