Merge tag 'integrity-v5.8-fix-2' of... (b13f40bc) · Commits · 戴 / test

Merge tag 'integrity-v5.8-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Include PCRs 8 & 9 in per TPM 2.0 bank boot_aggregate calculation. Prior to Linux 5.8 the SHA1 "boot_aggregate" value was padded with 0's and extended into the other TPM 2.0 banks. Included in the Linux 5.8 open window, TPM 2.0 PCR bank specific "boot_aggregate" values (PCRs 0 - 7) are calculated and extended into the TPM banks. Distro releases are now shipping grub2 with TPM support, which extend PCRs 8 & 9. I'd like for PCRs 8 & 9 to be included in the new "boot_aggregate" calculations. For backwards compatibility, if the hash is SHA1, these new PCRs are not included in the boot aggregate" * tag 'integrity-v5.8-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: extend boot_aggregate with kernel measurements

security/integrity/ima/ima.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -30,7 +30,7 @@

		enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
		IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
		enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
		enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };

		/* digest size for IMA, fits SHA1 or MD5 */
		#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE

security/integrity/ima/ima_crypto.c

+14 −1

Original line number	Diff line number	Diff line
		@@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
		if (rc != 0)
		return rc;

		/* cumulative sha1 over tpm registers 0-7 */
		/* cumulative digest over TPM registers 0-7 */
		for (i = TPM_PCR0; i < TPM_PCR8; i++) {
		ima_pcrread(i, &d);
		/* now accumulate with current aggregate */
		rc = crypto_shash_update(shash, d.digest,
		crypto_shash_digestsize(tfm));
		}
		/*
		* Extend cumulative digest over TPM registers 8-9, which contain
		* measurement for the kernel command line (reg. 8) and image (reg. 9)
		* in a typical PCR allocation. Registers 8-9 are only included in
		* non-SHA1 boot_aggregate digests to avoid ambiguity.
		*/
		if (alg_id != TPM_ALG_SHA1) {
		for (i = TPM_PCR8; i < TPM_PCR10; i++) {
		ima_pcrread(i, &d);
		rc = crypto_shash_update(shash, d.digest,
		crypto_shash_digestsize(tfm));
		}
		}
		if (!rc)
		crypto_shash_final(shash, digest);
		return rc;

Admin message