hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Include PCRs 8 & 9 in per TPM 2.0 bank boot_aggregate calculation 

-----BEGIN PGP SIGNATURE-----
 
 iQIcBAABAgAGBQJe8/sxAAoJEGt5JGawPnFabkEP/jtGMxuqbgWJQmTyIWBPAZFm
 3TM5q+PZDXxUkB9gNiEDsRiS3CW9ggDFyEsDhICxk1TgGmm1wHMK73m+X05TEXJX
 NJmWazT9mx8jAhno1ZY+rlNUBSrUq4o0H/qq9JHrxuRJgoXZyCP/2N+dwoRpWz4J
 JhFBQqUEuFP2TTwhdupjaTnbiIBs5WjLg7sr93A/ql8fL6Lwmucn8bwwIvWiKbn7
 HP5Q0+6nzo/xyT6JkZply++QSw21VHjmvbu/ViM46YVk3cOxOssWkE8qu1TRZ71x
 K950rr+YkivVv15XTWU/AijwwS1Lm4kCFQyAIWIeL/Liyr+OwXp2J0oX6aIk85xG
 ZzzAlk5mIsQ/rU2R6oTcqjFaegpCZ7X/DViK/wqtUU4l3LJQNSd5AiGkPLyDdpn0
 fPhUavq7lKFn9qfelRD6CcyaIc7QjeoAWWQ+K0F3zfZR3lrRbwA7TLDSmwZ7HMEL
 bj6kCXiQXG+4tmmNBu1Vjiytd3zD2t3ijdqqb8KByMTB2Ua3FRm6al6QtV/7y/d1
 v/hqk7fwiU04Y4WefdQfUnntBfuAMPxI8H+oECh7RJAPsqKVyk9pPkh5G1BCjStB
 bM5NTc13NvBPXO/9OW03jjVs2FSii0+qBeuOV/dUMUIgEgQgNp/BfE8Qb6dwe+I3
 KIFTLQVJf99AlreghyDi
 =oxsy
 -----END PGP SIGNATURE-----

Merge tag 'integrity-v5.8-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull integrity updates from Mimi Zohar:
 "Include PCRs 8 & 9 in per TPM 2.0 bank boot_aggregate calculation.

  Prior to Linux 5.8 the SHA1 "boot_aggregate" value was padded with 0's
  and extended into the other TPM 2.0 banks.

  Included in the Linux 5.8 open window, TPM 2.0 PCR bank specific
  "boot_aggregate" values (PCRs 0  - 7) are calculated and extended into the TPM banks.

  Distro releases are now shipping grub2 with TPM support, which extend
  PCRs 8 & 9. I'd like for PCRs 8 & 9 to be included in the new
  "boot_aggregate" calculations.

  For backwards compatibility, if the hash is SHA1, these new PCRs are
  not included in the boot aggregate"

* tag 'integrity-v5.8-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  ima: extend boot_aggregate with kernel measurements
This commit is contained in:
Linus Torvalds 2020-06-30 12:17:21 -07:00
parent 7c30b859a9 20c59ce010
commit b13f40bc69
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
security/integrity/ima/ima.h
View File

@ -30,7 +30,7 @@
enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN,
IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII };
enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 };
/* digest size for IMA, fits SHA1 or MD5 */
#define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE

15
security/integrity/ima/ima_crypto.c
View File

@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id,
if (rc != 0)
return rc;
/* cumulative sha1 over tpm registers 0-7 */
/* cumulative digest over TPM registers 0-7 */
for (i = TPM_PCR0; i < TPM_PCR8; i++) {
ima_pcrread(i, &d);
/* now accumulate with current aggregate */
rc = crypto_shash_update(shash, d.digest,
crypto_shash_digestsize(tfm));
}
/*
* Extend cumulative digest over TPM registers 8-9, which contain
* measurement for the kernel command line (reg. 8) and image (reg. 9)
* in a typical PCR allocation. Registers 8-9 are only included in
* non-SHA1 boot_aggregate digests to avoid ambiguity.
*/
if (alg_id != TPM_ALG_SHA1) {
for (i = TPM_PCR8; i < TPM_PCR10; i++) {
ima_pcrread(i, &d);
rc = crypto_shash_update(shash, d.digest,
crypto_shash_digestsize(tfm));
}
}
if (!rc)
crypto_shash_final(shash, digest);
return rc;