[GIT,PULL] integrity subsystem updates for v5.8
mbox series

Message ID 1591376548.5816.14.camel@linux.ibm.com
State New
Headers show
Series
  • [GIT,PULL] integrity subsystem updates for v5.8
Related show

Pull-request

git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git tags/integrity-v5.8

Message

Mimi Zohar June 5, 2020, 5:02 p.m. UTC
Hi Linus,

The main changes are extending the TPM 2.0 PCR banks with bank
specific file hashes, calculating the "boot_aggregate" based on other
TPM PCR banks, using the default IMA hash algorithm, instead of SHA1,
as the basis for the cache hash table key, and preventing the mprotect
syscall to circumvent an IMA mmap appraise policy rule.

- In preparation for extending TPM 2.0 PCR banks with bank specific
digests, commit 0b6cf6b97b7e ("tpm: pass an array of tpm_extend_digest
structures to tpm_pcr_extend()") modified tpm_pcr_extend().  The
original SHA1 file digests were padded/truncated, before being
extended into the other TPM PCR banks.  This pull request calculates
and extends the TPM PCR banks with bank specific file hashes
completing the above change.

- The "boot_aggregate", the first IMA measurement list record, is the
"trusted boot" link between the pre-boot environment and the running
OS.  With TPM 2.0, the "boot_aggregate" record is not limited to being
based on the SHA1 TPM PCR bank, but can be calculated based on any
enabled bank, assuming the hash algorithm is also enabled in the
kernel.

Other changes include the following and five other bug fixes/code
clean up:
- supporting both a SHA1 and a larger "boot_aggregate" digest in a
custom template format containing both the the SHA1 ('d') and larger
digests ('d-ng') fields.
- Initial hash table key fix, but additional changes would be good.

thanks,

Mimi

The following changes since commit ae83d0b416db002fe95601e7f97f64b59514d936:

  Linux 5.7-rc2 (2020-04-19 14:35:30 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git tags/integrity-v5.8

for you to fetch changes up to 42413b49804b250ced70dac8815388af2d4ad872:

  ima: Directly free *entry in ima_alloc_init_template() if digests is NULL (2020-06-05 06:04:11 -0400)

----------------------------------------------------------------
integrity-v5.8

----------------------------------------------------------------
Krzysztof Struczynski (3):
      ima: Fix ima digest hash table key calculation
      ima: Remove redundant policy rule set in add_rules()
      ima: Set again build_ima_appraise variable

Mimi Zohar (1):
      ima: verify mprotect change is consistent with mmap policy

Roberto Sassu (11):
      ima: Switch to ima_hash_algo for boot aggregate
      ima: Evaluate error in init_ima()
      ima: Store template digest directly in ima_template_entry
      ima: Switch to dynamically allocated buffer for template digests
      ima: Allocate and initialize tfm for each PCR bank
      ima: Calculate and extend PCR with digests in ima_template_entry
      ima: Use ima_hash_algo for collision detection in the measurement list
      evm: Fix possible memory leak in evm_calc_hmac_or_hash()
      ima: Directly assign the ima_default_policy pointer to ima_rules
      ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()
      ima: Directly free *entry in ima_alloc_init_template() if digests is NULL

 include/linux/ima.h                       |   7 +
 security/integrity/evm/evm_crypto.c       |   2 +-
 security/integrity/ima/ima.h              |  20 ++-
 security/integrity/ima/ima_api.c          |  23 +--
 security/integrity/ima/ima_crypto.c       | 252 +++++++++++++++++++++++++-----
 security/integrity/ima/ima_fs.c           |   4 +-
 security/integrity/ima/ima_init.c         |  24 ++-
 security/integrity/ima/ima_main.c         |  54 +++++++
 security/integrity/ima/ima_policy.c       |  12 +-
 security/integrity/ima/ima_queue.c        |  36 +++--
 security/integrity/ima/ima_template.c     |  25 ++-
 security/integrity/ima/ima_template_lib.c |  18 +++
 security/security.c                       |   7 +-
 13 files changed, 397 insertions(+), 87 deletions(-)

Comments

pr-tracker-bot@kernel.org June 6, 2020, 5:15 p.m. UTC | #1
The pull request you sent on Fri, 05 Jun 2020 13:02:28 -0400:

> git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git tags/integrity-v5.8

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/3c0ad98c2eda5ff30d23777e30744be6f7b8f097

Thank you!
Linus Torvalds June 7, 2020, 7:59 p.m. UTC | #2
On Fri, Jun 5, 2020 at 10:03 AM Mimi Zohar <zohar@linux.ibm.com> wrote:
>
> The main changes are extending the TPM 2.0 PCR banks with bank
> specific file hashes, calculating the "boot_aggregate" based on other
> TPM PCR banks, using the default IMA hash algorithm, instead of SHA1,
> as the basis for the cache hash table key, and preventing the mprotect
> syscall to circumvent an IMA mmap appraise policy rule.

I'm not sure why I didn't notice this during my test builds, but this
results in a new warning:

  WARNING: modpost: vmlinux.o(.text+0x496264): Section mismatch in
reference from the function ima_calc_boot_aggregate() to the function
.init.text:ima_pcrread()
  The function ima_calc_boot_aggregate() references
  the function __init ima_pcrread().
  This is often because ima_calc_boot_aggregate lacks a __init
  annotation or the annotation of ima_pcrread is wrong.

and I think the warning is real - and the problem is real, not just a
missing annotation.

It looks like ima_calc_boot_aggregate() may be called not only at init
time (ima_eventdigest_init() is referenced from "struct
ima_template_field supported_fields[]", for example)

So calling an __init function would be very wrong, because it might be
gone by that time.

Hmm?

                Linus
Roberto Sassu June 7, 2020, 8:14 p.m. UTC | #3
> From: linux-integrity-owner@vger.kernel.org [mailto:linux-integrity-
> owner@vger.kernel.org] On Behalf Of Linus Torvalds
> Sent: Sunday, June 7, 2020 9:59 PM
> On Fri, Jun 5, 2020 at 10:03 AM Mimi Zohar <zohar@linux.ibm.com> wrote:
> >
> > The main changes are extending the TPM 2.0 PCR banks with bank
> > specific file hashes, calculating the "boot_aggregate" based on other
> > TPM PCR banks, using the default IMA hash algorithm, instead of SHA1,
> > as the basis for the cache hash table key, and preventing the mprotect
> > syscall to circumvent an IMA mmap appraise policy rule.
> 
> I'm not sure why I didn't notice this during my test builds, but this
> results in a new warning:
> 
>   WARNING: modpost: vmlinux.o(.text+0x496264): Section mismatch in
> reference from the function ima_calc_boot_aggregate() to the function
> .init.text:ima_pcrread()
>   The function ima_calc_boot_aggregate() references
>   the function __init ima_pcrread().
>   This is often because ima_calc_boot_aggregate lacks a __init
>   annotation or the annotation of ima_pcrread is wrong.
> 
> and I think the warning is real - and the problem is real, not just a
> missing annotation.
> 
> It looks like ima_calc_boot_aggregate() may be called not only at init
> time (ima_eventdigest_init() is referenced from "struct
> ima_template_field supported_fields[]", for example)
> 
> So calling an __init function would be very wrong, because it might be
> gone by that time.
> 
> Hmm?

Right, I also missed it. Will send a patch soon.

Roberto

HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Li Jian, Shi Yanli