From: Mimi Zohar <zohar@linux.ibm.com>
To: Roberto Sassu <roberto.sassu@huawei.com>,
James.Bottomley@HansenPartnership.com,
Jerry Snitselaar <jsnitsel@redhat.com>
Cc: linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, silviu.vlasceanu@huawei.com,
stable@vger.kernel.org
Subject: Re: [PATCH v4 1/7] ima: Switch to ima_hash_algo for boot aggregate
Date: Thu, 02 Apr 2020 19:53:37 -0400 [thread overview]
Message-ID: <1585871617.7311.5.camel@linux.ibm.com> (raw)
In-Reply-To: <20200325104712.25694-2-roberto.sassu@huawei.com>
Hi Roberto,
On Wed, 2020-03-25 at 11:47 +0100, Roberto Sassu wrote:
> boot_aggregate is the first entry of IMA measurement list. Its purpose is
> to link pre-boot measurements to IMA measurements. As IMA was designed to
> work with a TPM 1.2, the SHA1 PCR bank was always selected even if a
> TPM 2.0 with support for stronger hash algorithms is available.
>
> This patch first tries to find a PCR bank with the IMA default hash
> algorithm. If it does not find it, it selects the SHA256 PCR bank for
> TPM 2.0 and SHA1 for TPM 1.2. Ultimately, it selects SHA1 also for TPM 2.0
> if the SHA256 PCR bank is not found.
>
> If none of the PCR banks above can be found, boot_aggregate file digest is
> filled with zeros, as for TPM bypass, making it impossible to perform a
> remote attestation of the system.
>
> Cc: stable@vger.kernel.org # 5.1.x
> Fixes: 879b589210a9 ("tpm: retrieve digest size of unknown algorithms with PCR read")
> Reported-by: Jerry Snitselaar <jsnitsel@redhat.com>
> Suggested-by: James Bottomley <James.Bottomley@HansenPartnership.com>
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Thank you! This patch set is now queued in next-integrity-testing
during the open window. Jerry, I assume this works for you. Could we
get your tag?
thanks!
Mimi
next prev parent reply other threads:[~2020-04-02 23:53 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-25 10:47 [PATCH v4 0/7] ima: support stronger algorithms for attestation Roberto Sassu
2020-03-25 10:47 ` [PATCH v4 1/7] ima: Switch to ima_hash_algo for boot aggregate Roberto Sassu
2020-04-02 23:53 ` Mimi Zohar [this message]
2020-05-08 4:54 ` Jerry Snitselaar
2020-05-08 17:29 ` Mimi Zohar
2020-03-25 10:47 ` [PATCH v4 2/7] ima: Evaluate error in init_ima() Roberto Sassu
2020-03-27 0:07 ` James Morris
2020-03-25 10:47 ` [PATCH v4 3/7] ima: Store template digest directly in ima_template_entry Roberto Sassu
2020-03-25 10:47 ` [PATCH v4 4/7] ima: Switch to dynamically allocated buffer for template digests Roberto Sassu
2020-03-25 10:52 ` [PATCH v4 5/7] ima: Allocate and initialize tfm for each PCR bank Roberto Sassu
2020-03-25 10:53 ` [PATCH v4 6/7] ima: Calculate and extend PCR with digests in ima_template_entry Roberto Sassu
2020-03-25 10:54 ` [PATCH v4 7/7] ima: Use ima_hash_algo for collision detection in the measurement list Roberto Sassu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1585871617.7311.5.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=jsnitsel@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=roberto.sassu@huawei.com \
--cc=silviu.vlasceanu@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.