From patchwork Tue Jul 7 02:26:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11647357 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1B96F17C7 for ; Tue, 7 Jul 2020 02:26:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0DA222070C for ; Tue, 7 Jul 2020 02:26:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726900AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:17918 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727777AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0671WWTd139051; Mon, 6 Jul 2020 22:26:43 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 32482kcetx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:43 -0400 Received: from m0098399.ppops.net (m0098399.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0672JdOE094892; Mon, 6 Jul 2020 22:26:43 -0400 Received: from ppma05fra.de.ibm.com (6c.4a.5195.ip4.static.sl-reverse.com [149.81.74.108]) by mx0a-001b2d01.pphosted.com with ESMTP id 32482kceta-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:43 -0400 Received: from pps.filterd (ppma05fra.de.ibm.com [127.0.0.1]) by ppma05fra.de.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0672Qeml008989; Tue, 7 Jul 2020 02:26:40 GMT Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by ppma05fra.de.ibm.com with ESMTP id 322hd81eym-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2020 02:26:40 +0000 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0672Qc5Z59965570 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2020 02:26:38 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 47C3C4C040; Tue, 7 Jul 2020 02:26:38 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 662224C044; Tue, 7 Jul 2020 02:26:37 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.174.194]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2020 02:26:37 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Bruno Meneguele , Vitaly Chikunov Subject: [PATCH 1/6] ima-evm-utils: fix PCRAggr error message Date: Mon, 6 Jul 2020 22:26:26 -0400 Message-Id: <1594088791-27370-2-git-send-email-zohar@linux.ibm.com> X-Mailer: git-send-email 2.7.5 In-Reply-To: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> References: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235,18.0.687 definitions=2020-07-06_20:2020-07-06,2020-07-06 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 spamscore=0 clxscore=1015 phishscore=0 suspectscore=1 cotscore=-2147483648 mlxlogscore=999 adultscore=0 malwarescore=0 bulkscore=0 priorityscore=1501 mlxscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007070010 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Display the correct TPM PCR value. Signed-off-by: Mimi Zohar --- src/evmctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index 46b7092b469d..1a5f3545d844 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1635,7 +1635,7 @@ static int compare_tpm_banks(int num_banks, struct tpm_bank_info *bank, bank[i].algo_name, j); else log_info("%s: PCRAgg %d does not match TPM PCR-%d\n", - bank[i].algo_name, i, i); + bank[i].algo_name, j, j); } } return ret; From patchwork Tue Jul 7 02:26:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11647355 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CAA5A739 for ; Tue, 7 Jul 2020 02:26:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BC674206F6 for ; Tue, 7 Jul 2020 02:26:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728056AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:25772 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726900AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from pps.filterd (m0098413.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06721M9x178608; Mon, 6 Jul 2020 22:26:44 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-001b2d01.pphosted.com with ESMTP id 324fdgs35g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:44 -0400 Received: from m0098413.ppops.net (m0098413.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 06724Hcs189575; Mon, 6 Jul 2020 22:26:43 -0400 Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0b-001b2d01.pphosted.com with ESMTP id 324fdgs352-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:43 -0400 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0672QGkc025185; Tue, 7 Jul 2020 02:26:42 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma02fra.de.ibm.com with ESMTP id 322hd82wrt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2020 02:26:42 +0000 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0672QdUx56164680 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2020 02:26:39 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7E2094C04E; Tue, 7 Jul 2020 02:26:39 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8488E4C040; Tue, 7 Jul 2020 02:26:38 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.174.194]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2020 02:26:38 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Bruno Meneguele , Vitaly Chikunov Subject: [PATCH 2/6] ima-evm-utils: fix measurement violation checking Date: Mon, 6 Jul 2020 22:26:27 -0400 Message-Id: <1594088791-27370-3-git-send-email-zohar@linux.ibm.com> X-Mailer: git-send-email 2.7.5 In-Reply-To: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> References: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235,18.0.687 definitions=2020-07-07_01:2020-07-06,2020-07-06 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 clxscore=1015 lowpriorityscore=0 priorityscore=1501 phishscore=0 cotscore=-2147483648 suspectscore=1 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007070010 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The template data digest for file measurement time of measure, time of use (ToMToU) violations is zero. Don't calculate the template data digest for the different banks. Signed-off-by: Mimi Zohar --- src/evmctl.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 1a5f3545d844..71712d91703a 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1736,10 +1736,19 @@ static void extend_tpm_banks(struct template_entry *entry, int num_banks, continue; } - err = calculate_template_digest(pctx, md, entry, &bank[i]); - if (!err) { - bank[i].supported = 0; - continue; + /* + * Measurement violations are 0x00 digests. No need to + * calculate the per TPM bank template digests. + */ + if (memcmp(entry->header.digest, zero, SHA_DIGEST_LENGTH) == 0) + memset(bank[i].digest, 0x00, bank[i].digest_size); + else { + err = calculate_template_digest(pctx, md, entry, + &bank[i]); + if (!err) { + bank[i].supported = 0; + continue; + } } /* extend TPM BANK with template digest */ From patchwork Tue Jul 7 02:26:28 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11647353 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9A9A0618 for ; Tue, 7 Jul 2020 02:26:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8A638206F6 for ; Tue, 7 Jul 2020 02:26:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728053AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:35018 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727120AbgGGC0u (ORCPT ); Mon, 6 Jul 2020 22:26:50 -0400 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06721uBZ186810; Mon, 6 Jul 2020 22:26:45 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 322nunhqnm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:45 -0400 Received: from m0098404.ppops.net (m0098404.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 06722YWS189963; Mon, 6 Jul 2020 22:26:45 -0400 Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0a-001b2d01.pphosted.com with ESMTP id 322nunhqmv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:45 -0400 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0672QgqA022428; Tue, 7 Jul 2020 02:26:42 GMT Received: from b06avi18626390.portsmouth.uk.ibm.com (b06avi18626390.portsmouth.uk.ibm.com [9.149.26.192]) by ppma06ams.nl.ibm.com with ESMTP id 322h1h2uju-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2020 02:26:42 +0000 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06avi18626390.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0672PJGm24707546 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2020 02:25:19 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5415D4C040; Tue, 7 Jul 2020 02:26:40 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A81FC4C04A; Tue, 7 Jul 2020 02:26:39 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.174.194]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2020 02:26:39 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Bruno Meneguele , Vitaly Chikunov Subject: [PATCH 3/6] ima-evm-utils: don't hardcode validating the IMA measurement list Date: Mon, 6 Jul 2020 22:26:28 -0400 Message-Id: <1594088791-27370-4-git-send-email-zohar@linux.ibm.com> X-Mailer: git-send-email 2.7.5 In-Reply-To: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> References: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235,18.0.687 definitions=2020-07-06_20:2020-07-06,2020-07-06 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 cotscore=-2147483648 lowpriorityscore=0 clxscore=1015 suspectscore=1 priorityscore=1501 impostorscore=0 mlxlogscore=999 bulkscore=0 malwarescore=0 phishscore=0 adultscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007070010 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org File time of measure, time of use (ToMToU) violations are annotated in the measurement list by including a template data digest of zeroes, but extending the TPM with 0xFF's. This causes validating the measurement against the TPM PCRs to fail. To validate the measurement list against the PCRs requires replacing the zero template data digest with OxFF's. The default behavior, unless specifically requested, should be to fail the measurement list verification. Support validating the measurement list based on a "--validate" option. Signed-off-by: Mimi Zohar --- src/evmctl.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 71712d91703a..3c4483ef2b0e 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1412,7 +1412,7 @@ struct template_entry { static uint8_t zero[MAX_DIGEST_SIZE]; static uint8_t fox[MAX_DIGEST_SIZE]; -int validate = 1; +static int validate = 0; static int ima_verify_template_hash(struct template_entry *entry) { @@ -2156,7 +2156,7 @@ struct command cmds[] = { {"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"}, {"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"}, {"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"}, - {"ima_measurement", cmd_ima_measurement, 0, "file", "Verify measurement list (experimental).\n"}, + {"ima_measurement", cmd_ima_measurement, 0, "[--validate] file", "Verify measurement list (experimental).\n"}, {"ima_boot_aggregate", cmd_ima_bootaggr, 0, "", "Calculate per TPM bank boot_aggregate digests\n"}, {"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"}, {"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"}, @@ -2195,6 +2195,7 @@ static struct option opts[] = { {"list", 0, 0, 138}, {"engine", 1, 0, 139}, {"xattr-user", 0, 0, 140}, + {"validate", 0, 0, 141}, {} }; @@ -2373,6 +2374,9 @@ int main(int argc, char *argv[]) xattr_ima = "user.ima"; xattr_evm = "user.evm"; break; + case 141: /* --validate */ + validate = 1; + break; case '?': exit(1); break; From patchwork Tue Jul 7 02:26:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11647363 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BA17C739 for ; Tue, 7 Jul 2020 02:26:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ABC6120708 for ; Tue, 7 Jul 2020 02:26:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727936AbgGGC0w (ORCPT ); Mon, 6 Jul 2020 22:26:52 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:54384 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727120AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06723jv6104351; Mon, 6 Jul 2020 22:26:47 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 324864can5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:47 -0400 Received: from m0098409.ppops.net (m0098409.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0672Lote164312; Mon, 6 Jul 2020 22:26:46 -0400 Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0a-001b2d01.pphosted.com with ESMTP id 324864camn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:45 -0400 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0672QTJW025220; Tue, 7 Jul 2020 02:26:43 GMT Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by ppma02fra.de.ibm.com with ESMTP id 322hd82wru-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2020 02:26:43 +0000 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0672QfMn7930292 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2020 02:26:41 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 288B74C046; Tue, 7 Jul 2020 02:26:41 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7CF8E4C040; Tue, 7 Jul 2020 02:26:40 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.174.194]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2020 02:26:40 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Bruno Meneguele , Vitaly Chikunov Subject: [PATCH 4/6] ima-evm-utils: calculate and verify the template data digest Date: Mon, 6 Jul 2020 22:26:29 -0400 Message-Id: <1594088791-27370-5-git-send-email-zohar@linux.ibm.com> X-Mailer: git-send-email 2.7.5 In-Reply-To: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> References: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235,18.0.687 definitions=2020-07-07_01:2020-07-06,2020-07-06 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 impostorscore=0 cotscore=-2147483648 mlxscore=0 suspectscore=1 bulkscore=0 mlxlogscore=999 adultscore=0 phishscore=0 spamscore=0 lowpriorityscore=0 clxscore=1015 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007070014 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Validating a TPM quote of PCR-10, the default IMA PCR, requires not only sending the quote to the verifier, but the IMA measurement list as well. The attestation server can verify the IMA measurement list simply by walking the measurement list and re-calculating the PCRs based on the template data digest. In addition, the attestation server could verify the template data digest based on the template data. The LTP and standalone "ima_measure" test optionally verify the template data digest. Similarly add "--verify" support to conditionally verify the template data digest against the template data. Signed-off-by: Mimi Zohar --- src/evmctl.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 3c4483ef2b0e..eda7dd845930 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1413,6 +1413,7 @@ static uint8_t zero[MAX_DIGEST_SIZE]; static uint8_t fox[MAX_DIGEST_SIZE]; static int validate = 0; +static int verify = 0; static int ima_verify_template_hash(struct template_entry *entry) { @@ -1875,7 +1876,7 @@ static int ima_measurement(const char *file) extend_tpm_banks(&entry, num_banks, pseudo_banks); - if (validate) + if (verify) ima_verify_template_hash(&entry); if (!strcmp(entry.name, "ima")) @@ -2156,7 +2157,7 @@ struct command cmds[] = { {"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"}, {"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"}, {"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"}, - {"ima_measurement", cmd_ima_measurement, 0, "[--validate] file", "Verify measurement list (experimental).\n"}, + {"ima_measurement", cmd_ima_measurement, 0, "[--validate] [--verify] file", "Verify measurement list (experimental).\n"}, {"ima_boot_aggregate", cmd_ima_bootaggr, 0, "", "Calculate per TPM bank boot_aggregate digests\n"}, {"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"}, {"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"}, @@ -2196,6 +2197,7 @@ static struct option opts[] = { {"engine", 1, 0, 139}, {"xattr-user", 0, 0, 140}, {"validate", 0, 0, 141}, + {"verify", 0, 0, 142}, {} }; @@ -2377,6 +2379,9 @@ int main(int argc, char *argv[]) case 141: /* --validate */ validate = 1; break; + case 142: /* --verify */ + verify = 1; + break; case '?': exit(1); break; From patchwork Tue Jul 7 02:26:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11647359 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4518614DD for ; Tue, 7 Jul 2020 02:26:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 36E2F20708 for ; Tue, 7 Jul 2020 02:26:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727777AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:52030 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727116AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from pps.filterd (m0098416.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06721FG9143161; Mon, 6 Jul 2020 22:26:47 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-001b2d01.pphosted.com with ESMTP id 324ffdh02q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:46 -0400 Received: from m0098416.ppops.net (m0098416.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 067280Pw168824; Mon, 6 Jul 2020 22:26:46 -0400 Received: from ppma04ams.nl.ibm.com (63.31.33a9.ip4.static.sl-reverse.com [169.51.49.99]) by mx0b-001b2d01.pphosted.com with ESMTP id 324ffdh027-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:46 -0400 Received: from pps.filterd (ppma04ams.nl.ibm.com [127.0.0.1]) by ppma04ams.nl.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0672Qijn014549; Tue, 7 Jul 2020 02:26:44 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma04ams.nl.ibm.com with ESMTP id 322hd7tv9p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2020 02:26:44 +0000 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0672QgGQ43778288 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2020 02:26:42 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 08E224C040; Tue, 7 Jul 2020 02:26:42 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 542824C046; Tue, 7 Jul 2020 02:26:41 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.174.194]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2020 02:26:41 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Bruno Meneguele , Vitaly Chikunov Subject: [PATCH 5/6] ima-evm-utils: use uint32_t for template length Date: Mon, 6 Jul 2020 22:26:30 -0400 Message-Id: <1594088791-27370-6-git-send-email-zohar@linux.ibm.com> X-Mailer: git-send-email 2.7.5 In-Reply-To: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> References: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235,18.0.687 definitions=2020-07-06_20:2020-07-06,2020-07-06 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=1 clxscore=1015 impostorscore=0 cotscore=-2147483648 malwarescore=0 mlxscore=0 adultscore=0 mlxlogscore=999 spamscore=0 priorityscore=1501 bulkscore=0 phishscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007070010 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The template length should never be less than zero. Replace "int" with "uint32_t". Signed-off-by: Mimi Zohar --- src/evmctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index eda7dd845930..9162de2a5aeb 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1404,9 +1404,9 @@ struct template_entry { uint32_t name_len; } header __packed; char name[TCG_EVENT_NAME_LEN_MAX + 1]; - int template_len; + uint32_t template_buf_len; + uint32_t template_len; uint8_t *template; - int template_buf_len; }; static uint8_t zero[MAX_DIGEST_SIZE]; From patchwork Tue Jul 7 02:26:31 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11647361 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9087217DF for ; Tue, 7 Jul 2020 02:26:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 80E5020708 for ; Tue, 7 Jul 2020 02:26:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727116AbgGGC0w (ORCPT ); Mon, 6 Jul 2020 22:26:52 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:28404 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727936AbgGGC0v (ORCPT ); Mon, 6 Jul 2020 22:26:51 -0400 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06726UPw142085; Mon, 6 Jul 2020 22:26:47 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-001b2d01.pphosted.com with ESMTP id 3248nrhwvt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:47 -0400 Received: from m0098414.ppops.net (m0098414.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0672ACLH150396; Mon, 6 Jul 2020 22:26:47 -0400 Received: from ppma06fra.de.ibm.com (48.49.7a9f.ip4.static.sl-reverse.com [159.122.73.72]) by mx0b-001b2d01.pphosted.com with ESMTP id 3248nrhwv9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Jul 2020 22:26:47 -0400 Received: from pps.filterd (ppma06fra.de.ibm.com [127.0.0.1]) by ppma06fra.de.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0672Lw2U007563; Tue, 7 Jul 2020 02:26:45 GMT Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by ppma06fra.de.ibm.com with ESMTP id 322h1g9dux-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2020 02:26:45 +0000 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0672Qg5e64159960 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2020 02:26:43 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D76894C04A; Tue, 7 Jul 2020 02:26:42 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 315FD4C046; Tue, 7 Jul 2020 02:26:42 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.174.194]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2020 02:26:42 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Mimi Zohar , Petr Vorel , Bruno Meneguele , Vitaly Chikunov Subject: [PATCH 6/6] ima-evm-utils: define a basic hash_info.h file Date: Mon, 6 Jul 2020 22:26:31 -0400 Message-Id: <1594088791-27370-7-git-send-email-zohar@linux.ibm.com> X-Mailer: git-send-email 2.7.5 In-Reply-To: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> References: <1594088791-27370-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235,18.0.687 definitions=2020-07-07_01:2020-07-06,2020-07-06 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 lowpriorityscore=0 mlxlogscore=892 spamscore=0 phishscore=0 suspectscore=1 adultscore=0 clxscore=1015 bulkscore=0 priorityscore=1501 cotscore=-2147483648 mlxscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2007070010 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Some older system kernel header packages don't necessarily include hash_info.h. Signed-off-by: Mimi Zohar --- src/Makefile.am | 2 +- src/hash_info.gen | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 36652427a8ec..9bbff5034ef4 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -34,5 +34,5 @@ endif AM_CPPFLAGS = -I$(top_srcdir) -include config.h -CLEANFILES = hash_info.h +CLEANFILES = hash_info.h tmp_hash_info.h DISTCLEANFILES = @DISTCLEANFILES@ diff --git a/src/hash_info.gen b/src/hash_info.gen index 54532ca5b847..5f7a97fb3117 100755 --- a/src/hash_info.gen +++ b/src/hash_info.gen @@ -18,11 +18,54 @@ KERNEL_HEADERS=$1 HASH_INFO_H=uapi/linux/hash_info.h HASH_INFO=$KERNEL_HEADERS/include/$HASH_INFO_H +TMPHASHINFO="./tmp_hash_info.h" +gen_hashinfo() { +cat << __EOF__ >$TMPHASHINFO +/* SPDX-License-Identifier: GPL-2.0+ WITH Linux-syscall-note */ +/* + * Hash Info: Hash algorithms information + * + * Copyright (c) 2013 Dmitry Kasatkin + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the Free + * Software Foundation; either version 2 of the License, or (at your option) + * any later version. + * + */ + +enum hash_algo { + HASH_ALGO_MD4, + HASH_ALGO_MD5, + HASH_ALGO_SHA1, + HASH_ALGO_RIPE_MD_160, + HASH_ALGO_SHA256, + HASH_ALGO_SHA384, + HASH_ALGO_SHA512, + HASH_ALGO_SHA224, + HASH_ALGO_RIPE_MD_128, + HASH_ALGO_RIPE_MD_256, + HASH_ALGO_RIPE_MD_320, + HASH_ALGO_WP_256, + HASH_ALGO_WP_384, + HASH_ALGO_WP_512, + HASH_ALGO_TGR_128, + HASH_ALGO_TGR_160, + HASH_ALGO_TGR_192, + HASH_ALGO_SM3_256, + HASH_ALGO__LAST +}; +__EOF__ +} + # Allow to specify kernel-headers past include/ if [ ! -e $HASH_INFO ]; then HASH_INFO2=$KERNEL_HEADERS/$HASH_INFO_H if [ -e $HASH_INFO2 ]; then HASH_INFO=$HASH_INFO2 + else + gen_hashinfo + HASH_INFO="$TMPHASHINFO" fi fi