| Message ID | 20200731141432.668318-4-zohar@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | evmctl option improvements | expand |
On 7/31/20 7:14 AM, Mimi Zohar wrote: > Add the missing "evmctl ima_boot_aggregate" info to the README. Update > the "help" to include the new "--pcrs" option. In addition, replace > the "file" option with "TPM 1.2 BIOS event log". The new format is: > > ima_boot_aggregate [--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log] > > Reminder: calculating the TPM PCRs based on the BIOS event log and > comparing them with the TPM PCRs should be done prior to calculating the > possible boot_aggregate value(s). > > For TPM 1.2, the TPM 1.2 BIOS event log may be provided as an option > when calculating the ima_boot_aggregate. For TPM 2.0, "tsseventextend > -sim -if <binary_bios_measurements> -ns -v", may be used to validate > the TPM 2.0 event log. > > (Note: some TPM 2.0's export the BIOS event log in the TPM 1.2 format.) > > Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> > --- > README | 1 + > src/evmctl.c | 2 +- > 2 files changed, 2 insertions(+), 1 deletion(-) > Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> > diff --git a/README b/README > index b37325f31802..321045d9d52b 100644 > --- a/README > +++ b/README > @@ -28,6 +28,7 @@ COMMANDS > import [--rsa] pubkey keyring > sign [-r] [--imahash | --imasig ] [--portable] [--key key] [--pass password] file > verify file > + ima_boot_aggregate [--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log] > ima_sign [--sigfile] [--key key] [--pass password] file > ima_verify file > ima_hash file > diff --git a/src/evmctl.c b/src/evmctl.c > index 7ad11507487f..de7299d41b2c 100644 > --- a/src/evmctl.c > +++ b/src/evmctl.c > @@ -2485,7 +2485,7 @@ struct command cmds[] = { > {"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"}, > {"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"}, > {"ima_measurement", cmd_ima_measurement, 0, "[--ignore-violations] [--verify-sig [--key key1, key2, ...]] [--pcrs [hash-algorithm,]file [--pcrs hash-algorithm,file] ...] file", "Verify measurement list (experimental).\n"}, > - {"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[file]", "Calculate per TPM bank boot_aggregate digests\n"}, > + {"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log]", "Calculate per TPM bank boot_aggregate digests\n"}, > {"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"}, > {"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"}, > {"sign_hash", cmd_sign_hash, 0, "[--key key] [--pass [password]", "Sign hashes from shaXsum output.\n"}, >
diff --git a/README b/README index b37325f31802..321045d9d52b 100644 --- a/README +++ b/README @@ -28,6 +28,7 @@ COMMANDS import [--rsa] pubkey keyring sign [-r] [--imahash | --imasig ] [--portable] [--key key] [--pass password] file verify file + ima_boot_aggregate [--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log] ima_sign [--sigfile] [--key key] [--pass password] file ima_verify file ima_hash file diff --git a/src/evmctl.c b/src/evmctl.c index 7ad11507487f..de7299d41b2c 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -2485,7 +2485,7 @@ struct command cmds[] = { {"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"}, {"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"}, {"ima_measurement", cmd_ima_measurement, 0, "[--ignore-violations] [--verify-sig [--key key1, key2, ...]] [--pcrs [hash-algorithm,]file [--pcrs hash-algorithm,file] ...] file", "Verify measurement list (experimental).\n"}, - {"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[file]", "Calculate per TPM bank boot_aggregate digests\n"}, + {"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log]", "Calculate per TPM bank boot_aggregate digests\n"}, {"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"}, {"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"}, {"sign_hash", cmd_sign_hash, 0, "[--key key] [--pass [password]", "Sign hashes from shaXsum output.\n"},
Add the missing "evmctl ima_boot_aggregate" info to the README. Update the "help" to include the new "--pcrs" option. In addition, replace the "file" option with "TPM 1.2 BIOS event log". The new format is: ima_boot_aggregate [--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log] Reminder: calculating the TPM PCRs based on the BIOS event log and comparing them with the TPM PCRs should be done prior to calculating the possible boot_aggregate value(s). For TPM 1.2, the TPM 1.2 BIOS event log may be provided as an option when calculating the ima_boot_aggregate. For TPM 2.0, "tsseventextend -sim -if <binary_bios_measurements> -ns -v", may be used to validate the TPM 2.0 event log. (Note: some TPM 2.0's export the BIOS event log in the TPM 1.2 format.) Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- README | 1 + src/evmctl.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)