mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-07 19:49:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'integrity-v5.8-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Browse Source 
Pull integrity updates from Mimi Zohar:
 "Include PCRs 8 & 9 in per TPM 2.0 bank boot_aggregate calculation.

  Prior to Linux 5.8 the SHA1 "boot_aggregate" value was padded with 0's
  and extended into the other TPM 2.0 banks.

  Included in the Linux 5.8 open window, TPM 2.0 PCR bank specific
  "boot_aggregate" values (PCRs 0  - 7) are calculated and extended into the TPM banks.

  Distro releases are now shipping grub2 with TPM support, which extend
  PCRs 8 & 9. I'd like for PCRs 8 & 9 to be included in the new
  "boot_aggregate" calculations.

  For backwards compatibility, if the hash is SHA1, these new PCRs are
  not included in the boot aggregate"

* tag 'integrity-v5.8-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: extend boot_aggregate with kernel measurements
This commit is contained in:
Linus Torvalds
2020-06-30 12:17:21 -07:00
parent 7c30b859a9 20c59ce010
commit b13f40bc69
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
security/integrity/ima/ima.h
View File

@@ -30,7 +30,7 @@
enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };
/* digest size for IMA, fits SHA1 or MD5 */
#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE

15
security/integrity/ima/ima_crypto.c
View File

@@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
if (rc != 0)
return rc;
/* cumulative sha1 over tpm registers 0-7 */
/* cumulative digest over TPM registers 0-7 */
for (i = TPM_PCR0; i < TPM_PCR8; i++) {
ima_pcrread(i, &d);
/* now accumulate with current aggregate */
rc = crypto_shash_update(shash, d.digest,
crypto_shash_digestsize(tfm));
}
/*
* Extend cumulative digest over TPM registers 8-9, which contain
* measurement for the kernel command line (reg. 8) and image (reg. 9)
* in a typical PCR allocation. Registers 8-9 are only included in
* non-SHA1 boot_aggregate digests to avoid ambiguity.
*/
if (alg_id != TPM_ALG_SHA1) {
for (i = TPM_PCR8; i < TPM_PCR10; i++) {
ima_pcrread(i, &d);
rc = crypto_shash_update(shash, d.digest,
crypto_shash_digestsize(tfm));
}
}
if (!rc)
crypto_shash_final(shash, digest);
return rc;