From: Mimi Zohar <zohar@linux.ibm.com>
To: Tushar Sugandhi <tusharsu@linux.microsoft.com>,
dm-devel@redhat.com, agk@redhat.com, snitzer@redhat.com
Cc: nramas@linux.microsoft.com, linux-integrity@vger.kernel.org
Subject: Re: [dm-devel] [PATCH 7/7] dm: add documentation for IMA measurement support
Date: Tue, 20 Jul 2021 22:33:52 -0400 [thread overview]
Message-ID: <205b5336d60aee6b3f33ad67b2d0250e104d6779.camel@linux.ibm.com> (raw)
In-Reply-To: <20210713004904.8808-8-tusharsu@linux.microsoft.com>
Hi Tushar, Mike,
On Mon, 2021-07-12 at 17:49 -0700, Tushar Sugandhi wrote:
> +Then IMA ASCII measurement log has the following format:
> +PCR TEMPLATE_DIGEST TEMPLATE ALG:EVENT_DIGEST EVENT_NAME EVENT_DATA
> +
> +PCR := Platform Configuration Register, in which the values are registered.
> + This is applicable if TPM chip is in use.
> +TEMPLATE_DIGEST := Template digest of the IMA record.
^TEMPLATE_DATA_DIGEST
> +TEMPLATE := Template that registered the integrity value (e.g. ima-buf).
^TEMPLATE_NAME
The template data format consists of:
> +ALG:EVENT_DIGEST = Algorithm to compute event digest, followed by digest of event data
> +EVENT_NAME := Description of the event (e.g. 'table_load').
> +EVENT_DATA := The event data to be measured.
Missing from the document is a way of validating the template data.
For example, in the original case of file measurements, the template
data contains the file hash, which can be recalculated or verified
against an allow list.
Other than re-calculating the template data digest based on the
template data, and verifying it against the template data digest in the
measurement list, would an attestation server be able to verify the
template data itself?
thanks,
Mimi
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
next prev parent reply other threads:[~2021-07-21 2:34 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-13 0:48 [dm-devel] [PATCH 0/7] device mapper target measurements using IMA Tushar Sugandhi
2021-07-13 0:48 ` [dm-devel] [PATCH 1/7] dm: measure data on table load Tushar Sugandhi
2021-07-21 2:12 ` Mimi Zohar
2021-07-21 15:42 ` Mike Snitzer
2021-07-21 16:07 ` Mimi Zohar
2021-07-21 21:17 ` Mimi Zohar
2021-07-29 19:58 ` Tushar Sugandhi
2021-07-13 0:48 ` [dm-devel] [PATCH 2/7] dm: measure data on device resume Tushar Sugandhi
2021-07-13 0:49 ` [dm-devel] [PATCH 3/7] dm: measure data on device remove Tushar Sugandhi
2021-07-13 0:49 ` [dm-devel] [PATCH 4/7] dm: measure data on table clear Tushar Sugandhi
2021-07-13 0:49 ` [dm-devel] [PATCH 5/7] dm: measure data on device rename Tushar Sugandhi
2021-07-13 0:49 ` [dm-devel] [PATCH 6/7] dm: update target specific status functions to measure data Tushar Sugandhi
2021-07-13 1:06 ` Alasdair G Kergon
2021-07-14 20:23 ` Tushar Sugandhi
2021-07-13 0:49 ` [dm-devel] [PATCH 7/7] dm: add documentation for IMA measurement support Tushar Sugandhi
2021-07-21 2:33 ` Mimi Zohar [this message]
2021-07-24 7:25 ` Tushar Sugandhi
2021-07-26 16:33 ` Mimi Zohar
2021-07-26 18:28 ` Tushar Sugandhi
2021-07-14 11:32 ` [dm-devel] [PATCH 0/7] device mapper target measurements using IMA Thore Sommer
2021-07-14 20:20 ` Tushar Sugandhi
2021-07-27 10:18 ` Thore Sommer
2021-07-27 20:33 ` Alasdair G Kergon
2021-07-28 3:10 ` Tushar Sugandhi
2021-07-28 17:14 ` Thore Sommer
2021-07-29 17:32 ` Tushar Sugandhi
2021-07-28 17:34 ` Thore Sommer
2021-07-28 21:33 ` Alasdair G Kergon
2021-08-02 10:45 ` Thore Sommer
2021-07-29 19:24 ` Tushar Sugandhi
2021-08-02 10:38 ` Thore Sommer
2021-07-20 21:27 ` Mike Snitzer
2021-07-24 6:57 ` Tushar Sugandhi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=205b5336d60aee6b3f33ad67b2d0250e104d6779.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=agk@redhat.com \
--cc=dm-devel@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=nramas@linux.microsoft.com \
--cc=snitzer@redhat.com \
--cc=tusharsu@linux.microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).