From patchwork Mon Jan 22 14:54:05 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 10178687 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 122F8600F5 for ; Mon, 22 Jan 2018 14:54:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 06F5120246 for ; Mon, 22 Jan 2018 14:54:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EF87826E78; Mon, 22 Jan 2018 14:54:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7F8EF20246 for ; Mon, 22 Jan 2018 14:54:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751216AbeAVOyk (ORCPT ); Mon, 22 Jan 2018 09:54:40 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:53918 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751189AbeAVOyj (ORCPT ); Mon, 22 Jan 2018 09:54:39 -0500 Received: from pps.filterd (m0098396.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w0MEqrTQ088722 for ; Mon, 22 Jan 2018 09:54:38 -0500 Received: from e06smtp12.uk.ibm.com (e06smtp12.uk.ibm.com [195.75.94.108]) by mx0a-001b2d01.pphosted.com with ESMTP id 2fnfnqevrm-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 22 Jan 2018 09:54:38 -0500 Received: from localhost by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 22 Jan 2018 14:54:35 -0000 Received: from b06cxnps4075.portsmouth.uk.ibm.com (9.149.109.197) by e06smtp12.uk.ibm.com (192.168.101.142) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 22 Jan 2018 14:54:34 -0000 Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id w0MEsXLS5374110; Mon, 22 Jan 2018 14:54:33 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6DB3352041; Mon, 22 Jan 2018 13:46:58 +0000 (GMT) Received: from localhost.ibm.com (unknown [9.80.102.7]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id B315052043; Mon, 22 Jan 2018 13:46:57 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Dmitry Kasatkin , Roberto Sassu , "Bruno E . O . Meneguele" , Mimi Zohar Subject: [PATCH 10/10] ima-evm-utils: add support for validating multiple pcrs Date: Mon, 22 Jan 2018 09:54:05 -0500 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1516632845-7087-1-git-send-email-zohar@linux.vnet.ibm.com> References: <1516632845-7087-1-git-send-email-zohar@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 18012214-0008-0000-0000-000004C488E8 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18012214-0009-0000-0000-00001E5805EC Message-Id: <1516632845-7087-11-git-send-email-zohar@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2018-01-22_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1801220211 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The IMA measurement list may contain records for different PCRs. This patch walks the measurement list, calculating a PCR aggregate value for each PCR. Signed-off-by: Mimi Zohar --- src/evmctl.c | 44 +++++++++++++++++++++++++++----------------- src/imaevm.h | 3 +++ 2 files changed, 30 insertions(+), 17 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 9142ed4..5029235 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1417,13 +1417,16 @@ int ima_ng_show(struct template_entry *entry) static int ima_measurement(const char *file) { - uint8_t pcr[SHA_DIGEST_LENGTH] = {0,}; - uint8_t pcr10[SHA_DIGEST_LENGTH]; + uint8_t pcr[NUM_PCRS][SHA_DIGEST_LENGTH] = {{0}}; + uint8_t hwpcr[SHA_DIGEST_LENGTH]; struct template_entry entry = { .template = 0 }; FILE *fp; int err = -1; - int verify_sig_failed = 0; + bool verify_sig_failed[NUM_PCRS] = {0,}; + bool verify_failed = false; + int i; + memset(zero, 0, SHA_DIGEST_LENGTH); memset(fox, 0xff, SHA_DIGEST_LENGTH); log_debug("Initial PCR value: "); @@ -1440,7 +1443,8 @@ static int ima_measurement(const char *file) init_public_keys(params.keyfile); while (fread(&entry.header, sizeof(entry.header), 1, fp)) { - ima_extend_pcr(pcr, entry.header.digest, SHA_DIGEST_LENGTH); + ima_extend_pcr(pcr[entry.header.pcr], entry.header.digest, + SHA_DIGEST_LENGTH); if (!fread(entry.name, entry.header.name_len, 1, fp)) { log_err("Unable to read template name\n"); @@ -1472,29 +1476,35 @@ static int ima_measurement(const char *file) ima_show(&entry); } else { if (ima_ng_show(&entry) != 0) - verify_sig_failed = 1; + verify_sig_failed[entry.header.pcr] = true; } } - tpm_pcr_read(10, pcr10, sizeof(pcr10)); - log_info("PCRAgg: "); - log_dump(pcr, sizeof(pcr)); + for (i = 0; i < NUM_PCRS; i++) { + if (memcmp(pcr[i], zero, SHA_DIGEST_LENGTH) == 0) + continue; + + log_info("PCRAgg %.2d: ", i); + log_dump(pcr[i], SHA_DIGEST_LENGTH); - log_info("PCR-10: "); - log_dump(pcr10, sizeof(pcr10)); + tpm_pcr_read(i, hwpcr, sizeof(hwpcr)); + log_info("HW PCR-%d: ", i); + log_dump(hwpcr, sizeof(hwpcr)); - if (memcmp(pcr, pcr10, sizeof(pcr))) { - log_err("PCRAgg does not match PCR-10\n"); - goto out; - } else if (verify_sig_failed == 1) { - log_err("PCRAgg matches PCR-10, but list contains unknown keys or invalid signatures\n"); + if (memcmp(pcr[i], hwpcr, sizeof(SHA_DIGEST_LENGTH)) != 0) { + log_err("PCRAgg %d does not match HW PCR-%d\n", i, i); + + verify_failed = true; + } else if (verify_sig_failed[i] == true) { + log_err("PCRAgg %d matches PCR-%d, but list contains unknown keys or invalid signatures\n", i, i); + } } - err = 0; + if (!verify_failed) + err = 0; out: fclose(fp); - return err; } diff --git a/src/imaevm.h b/src/imaevm.h index d624571..0507947 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -188,6 +188,9 @@ struct RSA_ASN1_template { size_t size; }; +#define NUM_PCRS 20 +#define DEFAULT_PCR 10 + extern const struct RSA_ASN1_template RSA_ASN1_templates[PKEY_HASH__LAST]; extern struct libevm_params params;