Commit b13f40bc authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'integrity-v5.8-fix-2' of...

Merge tag 'integrity-v5.8-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull integrity updates from Mimi Zohar:
 "Include PCRs 8 & 9 in per TPM 2.0 bank boot_aggregate calculation.

  Prior to Linux 5.8 the SHA1 "boot_aggregate" value was padded with 0's
  and extended into the other TPM 2.0 banks.

  Included in the Linux 5.8 open window, TPM 2.0 PCR bank specific
  "boot_aggregate" values (PCRs 0  - 7) are calculated and extended into the TPM banks.

  Distro releases are now shipping grub2 with TPM support, which extend
  PCRs 8 & 9. I'd like for PCRs 8 & 9 to be included in the new
  "boot_aggregate" calculations.

  For backwards compatibility, if the hash is SHA1, these new PCRs are
  not included in the boot aggregate"

* tag 'integrity-v5.8-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: extend boot_aggregate with kernel measurements
parents 7c30b859 20c59ce0
...@@ -30,7 +30,7 @@ ...@@ -30,7 +30,7 @@
enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };
/* digest size for IMA, fits SHA1 or MD5 */ /* digest size for IMA, fits SHA1 or MD5 */
#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
......
...@@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, ...@@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
if (rc != 0) if (rc != 0)
return rc; return rc;
/* cumulative sha1 over tpm registers 0-7 */ /* cumulative digest over TPM registers 0-7 */
for (i = TPM_PCR0; i < TPM_PCR8; i++) { for (i = TPM_PCR0; i < TPM_PCR8; i++) {
ima_pcrread(i, &d); ima_pcrread(i, &d);
/* now accumulate with current aggregate */ /* now accumulate with current aggregate */
rc = crypto_shash_update(shash, d.digest, rc = crypto_shash_update(shash, d.digest,
crypto_shash_digestsize(tfm)); crypto_shash_digestsize(tfm));
} }
/*
* Extend cumulative digest over TPM registers 8-9, which contain
* measurement for the kernel command line (reg. 8) and image (reg. 9)
* in a typical PCR allocation. Registers 8-9 are only included in
* non-SHA1 boot_aggregate digests to avoid ambiguity.
*/
if (alg_id != TPM_ALG_SHA1) {
for (i = TPM_PCR8; i < TPM_PCR10; i++) {
ima_pcrread(i, &d);
rc = crypto_shash_update(shash, d.digest,
crypto_shash_digestsize(tfm));
}
}
if (!rc) if (!rc)
crypto_shash_final(shash, digest); crypto_shash_final(shash, digest);
return rc; return rc;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment