Commit 6cc7c266 authored by Roberto Sassu's avatar Roberto Sassu Committed by Mimi Zohar

ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()

If the template field 'd' is chosen and the digest to be added to the
measurement entry was not calculated with SHA1 or MD5, it is
recalculated with SHA1, by using the passed file descriptor. However, this
cannot be done for boot_aggregate, because there is no file descriptor.

This patch adds a call to ima_calc_boot_aggregate() in
ima_eventdigest_init(), so that the digest can be recalculated also for the
boot_aggregate entry.

Cc: stable@vger.kernel.org # 3.13.x
Fixes: 3ce1217d ("ima: define template fields library and new helpers")
Reported-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 067a436b
...@@ -57,6 +57,7 @@ extern int ima_hash_algo_idx __ro_after_init; ...@@ -57,6 +57,7 @@ extern int ima_hash_algo_idx __ro_after_init;
extern int ima_extra_slots __ro_after_init; extern int ima_extra_slots __ro_after_init;
extern int ima_appraise; extern int ima_appraise;
extern struct tpm_chip *ima_tpm_chip; extern struct tpm_chip *ima_tpm_chip;
extern const char boot_aggregate_name[];
/* IMA event related data */ /* IMA event related data */
struct ima_event_data { struct ima_event_data {
...@@ -144,7 +145,7 @@ int ima_calc_buffer_hash(const void *buf, loff_t len, ...@@ -144,7 +145,7 @@ int ima_calc_buffer_hash(const void *buf, loff_t len,
struct ima_digest_data *hash); struct ima_digest_data *hash);
int ima_calc_field_array_hash(struct ima_field_data *field_data, int ima_calc_field_array_hash(struct ima_field_data *field_data,
struct ima_template_entry *entry); struct ima_template_entry *entry);
int __init ima_calc_boot_aggregate(struct ima_digest_data *hash); int ima_calc_boot_aggregate(struct ima_digest_data *hash);
void ima_add_violation(struct file *file, const unsigned char *filename, void ima_add_violation(struct file *file, const unsigned char *filename,
struct integrity_iint_cache *iint, struct integrity_iint_cache *iint,
const char *op, const char *cause); const char *op, const char *cause);
......
...@@ -806,8 +806,8 @@ static void __init ima_pcrread(u32 idx, struct tpm_digest *d) ...@@ -806,8 +806,8 @@ static void __init ima_pcrread(u32 idx, struct tpm_digest *d)
* hash algorithm for reading the TPM PCRs as for calculating the boot * hash algorithm for reading the TPM PCRs as for calculating the boot
* aggregate digest as stored in the measurement list. * aggregate digest as stored in the measurement list.
*/ */
static int __init ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
struct crypto_shash *tfm) struct crypto_shash *tfm)
{ {
struct tpm_digest d = { .alg_id = alg_id, .digest = {0} }; struct tpm_digest d = { .alg_id = alg_id, .digest = {0} };
int rc; int rc;
...@@ -835,7 +835,7 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, ...@@ -835,7 +835,7 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
return rc; return rc;
} }
int __init ima_calc_boot_aggregate(struct ima_digest_data *hash) int ima_calc_boot_aggregate(struct ima_digest_data *hash)
{ {
struct crypto_shash *tfm; struct crypto_shash *tfm;
u16 crypto_id, alg_id; u16 crypto_id, alg_id;
......
...@@ -19,7 +19,7 @@ ...@@ -19,7 +19,7 @@
#include "ima.h" #include "ima.h"
/* name for boot aggregate entry */ /* name for boot aggregate entry */
static const char boot_aggregate_name[] = "boot_aggregate"; const char boot_aggregate_name[] = "boot_aggregate";
struct tpm_chip *ima_tpm_chip; struct tpm_chip *ima_tpm_chip;
/* Add the boot aggregate to the IMA measurement list and extend /* Add the boot aggregate to the IMA measurement list and extend
......
...@@ -286,6 +286,24 @@ int ima_eventdigest_init(struct ima_event_data *event_data, ...@@ -286,6 +286,24 @@ int ima_eventdigest_init(struct ima_event_data *event_data,
goto out; goto out;
} }
if ((const char *)event_data->filename == boot_aggregate_name) {
if (ima_tpm_chip) {
hash.hdr.algo = HASH_ALGO_SHA1;
result = ima_calc_boot_aggregate(&hash.hdr);
/* algo can change depending on available PCR banks */
if (!result && hash.hdr.algo != HASH_ALGO_SHA1)
result = -EINVAL;
if (result < 0)
memset(&hash, 0, sizeof(hash));
}
cur_digest = hash.hdr.digest;
cur_digestsize = hash_digest_size[HASH_ALGO_SHA1];
goto out;
}
if (!event_data->file) /* missing info to re-calculate the digest */ if (!event_data->file) /* missing info to re-calculate the digest */
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment