Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v3 2/8] ima: Switch to ima_hash_algo for boot aggregate
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Roberto Sassu <roberto.sassu@huawei.com>,
        "James.Bottomley@HansenPartnership.com" 
        <James.Bottomley@HansenPartnership.com>,
        "jarkko.sakkinen@linux.intel.com" <jarkko.sakkinen@linux.intel.com>,
        Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc:     "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Silviu Vlasceanu <Silviu.Vlasceanu@huawei.com>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>
Date:   Mon, 02 Mar 2020 12:33:01 -0500
In-Reply-To: <a5e0cdc4839e478d926b90bd5ba0857c@huawei.com>
References: <20200210100048.21448-1-roberto.sassu@huawei.com>
         <20200210100048.21448-3-roberto.sassu@huawei.com>
         <1581373420.5585.920.camel@linux.ibm.com>
         <6955307747034265bd282bf68c368f34@huawei.com>
         <1583156506.8544.60.camel@linux.ibm.com>
         <8a6fb34e18b147fa811e82c78fb30d66@huawei.com>
         <1583160394.8544.89.camel@linux.ibm.com>
         <a5e0cdc4839e478d926b90bd5ba0857c@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <1583170381.8544.113.camel@linux.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, 2020-03-02 at 15:11 +0000, Roberto Sassu wrote:


> > Yes, preference is given to the IMA default algorithm, but it should
> > fall back to using SHA256 or SHA1, based on the TPM.
> 
> Ok. The patch already does it even if the TPM version is not checked.
> For TPM 1.2, if the default algorithm is not SHA1 the patch will select
> the first PCR bank (SHA1).
> 
> Should I send a new patch which explicitly checks the TPM version?

Checking the TPM version shouldn't be necessary.  The code currently
sets bank_idx to the HASH_ALGO_SHA256.  If instead of initializing
bank_idx to 0, initialize it to the nr_allocated_banks or -1.  As long
as the bank_idx value is the same as the initialized value, set the
bank_idx to HASH_ALGO_SHA1.

The subsequent bank_idx would then be limited to testing for the
initialized value.

Mimi