Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Maurizio Drocco <maurizio.drocco@ibm.com>, roberto.sassu@huawei.com
Cc: Silviu.Vlasceanu@huawei.com, dmitry.kasatkin@gmail.com,
	jejb@linux.ibm.com, jmorris@namei.org,
	linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org, serge@hallyn.com,
	mdrocco@linux.vnet.ibm.com
Subject: Re: [PATCH] ima_evm_utils: extended calc_bootaggr to PCRs 8 - 9
Date: Mon, 22 Jun 2020 16:14:31 -0400
Message-ID: <1592856871.4987.21.camel@linux.ibm.com> (raw)
In-Reply-To: <20200618201126.2081-2-maurizio.drocco@ibm.com>

On Thu, 2020-06-18 at 16:11 -0400, Maurizio Drocco wrote:
> From: Maurizio <maurizio.drocco@ibm.com>
> 
> If PCRs 8 - 9 are set (i.e. not all-zeros), cal_bootaggr should include
> them into the digest.
> 
> Signed-off-by: Maurizio Drocco <maurizio.drocco@ibm.com>
> ---
>  src/evmctl.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/src/evmctl.c b/src/evmctl.c
> index 1d065ce..554571e 100644
> --- a/src/evmctl.c
> +++ b/src/evmctl.c
> @@ -1930,6 +1930,18 @@ static void calc_bootaggr(struct tpm_bank_info *bank)
>  		}
>  	}
>  
> +	if (strcmp(bank->algo_name, "sha1") != 0) {
> +		for (i = 8; i < 10; i++) {
> +			if (memcmp(bank->pcr[i], zero, bank->digest_size) != 0) {
> +				err = EVP_DigestUpdate(pctx, bank->pcr[i], bank->digest_size);
> +				if (!err) {
> +					log_err("EVP_DigestUpdate() failed\n");
> +					return;
> +				}
> +			}
> +		}
> +	}

Roberto, now that we're only including the PCRs 8 & 9 in the non-sha1
"boot_aggregate", they can always be included.

Please reflect this change in the patch description and, here, in the
code.

thanks,

Mimi

  reply index

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-11 19:54 [PATCH] extend IMA boot_aggregate with kernel measurements Maurizio Drocco
2020-06-12  0:29 ` Mimi Zohar
2020-06-12 14:38   ` Maurizio Drocco
2020-06-12 15:11     ` Roberto Sassu
2020-06-12 17:14       ` James Bottomley
2020-06-16 17:29         ` Roberto Sassu
2020-06-16 18:11           ` Mimi Zohar
2020-06-18 12:38             ` Roberto Sassu
2020-06-18 20:11               ` Maurizio Drocco
2020-06-18 20:11                 ` [PATCH] ima_evm_utils: extended calc_bootaggr to PCRs 8 - 9 Maurizio Drocco
2020-06-22 20:14                   ` Mimi Zohar [this message]
2020-06-22  4:50                     ` [PATCH] ima: extend boot_aggregate with kernel measurements Maurizio Drocco
2020-06-23 14:03                       ` Mimi Zohar
2020-06-23 15:57                         ` [PATCH v4] " Maurizio Drocco
2020-06-23 18:53                           ` Bruno Meneguele
2020-06-23 18:01                     ` [PATCH v2] ima_evm_utils: extended calc_bootaggr to PCRs 8 - 9 Maurizio Drocco
2020-06-23 18:13                       ` Bruno Meneguele
2020-06-24 21:17                         ` Stefan Berger
2020-06-24 21:33                           ` [PATCH] " Maurizio Drocco
2020-06-24 21:33                           ` [PATCH v2] " Bruno Meneguele
2020-06-24 21:35                             ` [PATCH v3] " Maurizio Drocco
2020-06-24 21:50                               ` Bruno Meneguele
2020-06-16 12:02 [PATCH] " Maurizio Drocco
2020-06-16 17:19 ` Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1592856871.4987.21.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=Silviu.Vlasceanu@huawei.com \
    --cc=dmitry.kasatkin@gmail.com \
    --cc=jejb@linux.ibm.com \
    --cc=jmorris@namei.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=maurizio.drocco@ibm.com \
    --cc=mdrocco@linux.vnet.ibm.com \
    --cc=roberto.sassu@huawei.com \
    --cc=serge@hallyn.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org
	public-inbox-index linux-integrity

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git