| Message ID | 20200622045019.1636-1-maurizio.drocco@ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | ima: extend boot_aggregate with kernel measurements | expand |
Hi Maurizio, When re-posting patches, please include the version number (e.g. [PATCH v4] ima: ... ). On Mon, 2020-06-22 at 00:50 -0400, Maurizio Drocco wrote: > IMA is not considering TPM registers 8-9 when calculating the boot > aggregate. This line is unnecessary with the following change. > When registers 8-9 are used to store measurements of the > kernel and its command line (e.g., grub2 bootloader with tpm module > enabled), IMA should include them in the boot aggregate. The "When" clause makes this sound like PCRs 8 & 9 are not always included. I would split this into two sentences. > Registers > 8-9 are only included in non-SHA1 boot_aggregate digests to avoid > ambiguity. > > Signed-off-by: Maurizio Drocco <maurizio.drocco@ibm.com> > --- Missing "Changelog:". Changelog: v2: - Limit including PCRs 8 & 9 to non-sha1 hashes v1: - Include non zero PCRs 8 & 9 in the boot_aggregate > security/integrity/ima/ima.h | 2 +- > security/integrity/ima/ima_crypto.c | 15 ++++++++++++++- > 2 files changed, 15 insertions(+), 2 deletions(-) > > diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h > index df93ac258e01..9d94080bdad8 100644 > --- a/security/integrity/ima/ima.h > +++ b/security/integrity/ima/ima.h > @@ -30,7 +30,7 @@ > > enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, > IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; > -enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; > +enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 }; > > /* digest size for IMA, fits SHA1 or MD5 */ > #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE > diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c > index 220b14920c37..d02917d85033 100644 > --- a/security/integrity/ima/ima_crypto.c > +++ b/security/integrity/ima/ima_crypto.c > @@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, > if (rc != 0) > return rc; > > - /* cumulative sha1 over tpm registers 0-7 */ > + /* cumulative digest over tpm registers 0-7 */ Please uppercase "tpm" here and below. > for (i = TPM_PCR0; i < TPM_PCR8; i++) { > ima_pcrread(i, &d); > /* now accumulate with current aggregate */ > rc = crypto_shash_update(shash, d.digest, > crypto_shash_digestsize(tfm)); > } > + /* > + * extend cumulative digest over tpm registers 8-9, which contain > + * measurement for the kernel command line (reg. 8) and image (reg. 9) > + * in a typical PCR allocation. Registers 8-9 are only included in > + * non-SHA1 boot_aggregate digests to avoid ambiguity. > + */ Comments that are full sentences should start with an uppercase letter and end with a period (e.g. Extend). thanks, Mimi > + if (alg_id != TPM_ALG_SHA1) { > + for (i = TPM_PCR8; i < TPM_PCR10; i++) { > + ima_pcrread(i, &d); > + rc = crypto_shash_update(shash, d.digest, > + crypto_shash_digestsize(tfm)); > + } > + } > if (!rc) > crypto_shash_final(shash, digest); > return rc;
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index df93ac258e01..9d94080bdad8 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -30,7 +30,7 @@ enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; -enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; +enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 }; /* digest size for IMA, fits SHA1 or MD5 */ #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c index 220b14920c37..d02917d85033 100644 --- a/security/integrity/ima/ima_crypto.c +++ b/security/integrity/ima/ima_crypto.c @@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, if (rc != 0) return rc; - /* cumulative sha1 over tpm registers 0-7 */ + /* cumulative digest over tpm registers 0-7 */ for (i = TPM_PCR0; i < TPM_PCR8; i++) { ima_pcrread(i, &d); /* now accumulate with current aggregate */ rc = crypto_shash_update(shash, d.digest, crypto_shash_digestsize(tfm)); } + /* + * extend cumulative digest over tpm registers 8-9, which contain + * measurement for the kernel command line (reg. 8) and image (reg. 9) + * in a typical PCR allocation. Registers 8-9 are only included in + * non-SHA1 boot_aggregate digests to avoid ambiguity. + */ + if (alg_id != TPM_ALG_SHA1) { + for (i = TPM_PCR8; i < TPM_PCR10; i++) { + ima_pcrread(i, &d); + rc = crypto_shash_update(shash, d.digest, + crypto_shash_digestsize(tfm)); + } + } if (!rc) crypto_shash_final(shash, digest); return rc;
IMA is not considering TPM registers 8-9 when calculating the boot aggregate. When registers 8-9 are used to store measurements of the kernel and its command line (e.g., grub2 bootloader with tpm module enabled), IMA should include them in the boot aggregate. Registers 8-9 are only included in non-SHA1 boot_aggregate digests to avoid ambiguity. Signed-off-by: Maurizio Drocco <maurizio.drocco@ibm.com> --- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_crypto.c | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-)