From: James Morris <jmorris@namei.org>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Petr Vorel <pvorel@suse.cz>,
linux-integrity@vger.kernel.org,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Subject: Re: [PATCH] ima: Avoid using not initialized IMA
Date: Mon, 19 Mar 2018 15:43:48 +1100 (AEDT) [thread overview]
Message-ID: <alpine.LRH.2.21.1803191542410.5791@namei.org> (raw)
In-Reply-To: <1521336476.3503.74.camel@linux.vnet.ibm.com>
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: multipart/mixed; boundary="1665246916-1899361713-1521434628=:5791", Size: 1268 bytes --]
On Sat, 17 Mar 2018, Mimi Zohar wrote:
> On Sat, 2018-03-17 at 00:28 +0100, Petr Vorel wrote:
> > IMA requires have it's hash algorithm to be compiled-in due it's early
> > use. Default IMA algorithm is protected by Kconfig to be compiled-in.
> >
> > ima_hash kernel parameter allows to choose hash algorithm. When
> > specified algorithm not available or available as module, IMA
> > initialization fails, but mknodat syscall expect it and calls
> > ima_post_path_mknod(). This leads to to kernel oops:
> >
> > $ grep CONFIG_CRYPTO_MD4 .config
> > CONFIG_CRYPTO_MD4=m
> >
> > [ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.12.14-2.3-default root=UUID=74ae8202-9ca7-4e39-813b-22287ec52f7a video=1024x768-16 plymouth.ignore-serial-consoles console=ttyS0 console=tty resume=/dev/disk/by-path/pci-0000:00:07.0-part3 splash=silent showopts ima_hash=md4
> > ...
> > [ 1.545190] ima: Can not allocate md4 (reason: -2)
>
> The hash algorithm specified on the boot command line needs to be
> builtin. For whatever reason it isn't builtin, rather than skipping
> measurements, a better solution I think would be to fallback to the
> builtin hash algorithm.
What if this falls back to a hash which is not secure enough?
--
James Morris
<jmorris@namei.org>
next prev parent reply other threads:[~2018-03-19 4:43 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-16 23:28 [PATCH] ima: Avoid using not initialized IMA Petr Vorel
2018-03-18 1:27 ` Mimi Zohar
2018-03-19 4:43 ` James Morris [this message]
2018-03-19 10:59 ` Mimi Zohar
2018-03-19 20:05 ` Petr Vorel
2018-03-19 20:20 ` Mimi Zohar
2018-03-20 8:40 ` Petr Vorel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LRH.2.21.1803191542410.5791@namei.org \
--to=jmorris@namei.org \
--cc=dmitry.kasatkin@gmail.com \
--cc=linux-integrity@vger.kernel.org \
--cc=pvorel@suse.cz \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.