ima: extend boot_aggregate with kernel measurements (20c59ce0) · Commits · 戴 / test

security/integrity/ima/ima.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -30,7 +30,7 @@

		enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
		IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
		enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
		enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };

		/* digest size for IMA, fits SHA1 or MD5 */
		#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE

+14 −1

Original line number	Diff line number	Diff line
		@@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
		if (rc != 0)
		return rc;

		/* cumulative sha1 over tpm registers 0-7 */
		/* cumulative digest over TPM registers 0-7 */
		for (i = TPM_PCR0; i < TPM_PCR8; i++) {
		ima_pcrread(i, &d);
		/* now accumulate with current aggregate */
		rc = crypto_shash_update(shash, d.digest,
		crypto_shash_digestsize(tfm));
		}
		/*
		* Extend cumulative digest over TPM registers 8-9, which contain
		* measurement for the kernel command line (reg. 8) and image (reg. 9)
		* in a typical PCR allocation. Registers 8-9 are only included in
		* non-SHA1 boot_aggregate digests to avoid ambiguity.
		*/
		if (alg_id != TPM_ALG_SHA1) {
		for (i = TPM_PCR8; i < TPM_PCR10; i++) {
		ima_pcrread(i, &d);
		rc = crypto_shash_update(shash, d.digest,
		crypto_shash_digestsize(tfm));
		}
		}
		if (!rc)
		crypto_shash_final(shash, digest);
		return rc;