Received: by 2002:a05:6902:102b:0:0:0:0 with SMTP id x11csp3713753ybt; Tue, 23 Jun 2020 09:00:09 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzrZujo20quxiBZyP5Vyo7uG3Vv5+TBoow2INGdzZbxKgcbfM/XlVEIvlopJeFgRhzO31BE X-Received: by 2002:a17:907:1051:: with SMTP id oy17mr281522ejb.394.1592928009086; Tue, 23 Jun 2020 09:00:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1592928009; cv=none; d=google.com; s=arc-20160816; b=eSFb2pAmQ8g4k80zQdZ2x5BUHplKVUSutkP+C0VNtjTVJsWTmrtHdDqDshbPjX/a19 iNiTG2vbEGlfJR8nfqb1vwDkHFM5uSaQydETHtWg1Bc/umR3bCXqRVfuj/2WVxrBwATj 4c5hYgmcbIRxK8NZ04bHSgd6543Ms6g6hnJ1eHc9rtvKfxLDtufx1Xx95m+BO7YseDTS NhslQe9w3lJ3HZXu3+tlOeMy4QptiMAXoeCXfVytO8mcedl6tMRW1ZlXScdf1ybFAcIW DhUmqewI4q/K1ZsVv0Q/JB5njRfey6tMg8GmuYJ/X2FgnOiqxzQzf73pEXBpN6JXXrLR ICXg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from; bh=aY55nppWAwSuFGjZUT9Y01IugO1NxFosRlvEyTW8ElY=; b=wiizzRQ3zrXVlShBs3C4aVOy7SAi8Le6WmgozkhXFK2QjO+Hf8N0R8YrgDGZaaSGoV c0YfOvW9zuPDU+TPUCjLo9qzqKUAvRfEJuHpJpqaBB7KzcnwDG3ITAWbVIxmn1n1k8uv l1NtRqt5InTpwrNUCxP7uoRKVGEhZX8S0iBtckCRuWF7bsvCI5Mgbv3kh9V/p+AvdSUP +4y6HTGdozv9U83D7cEiF9hQGO9x1EqRhChf2mM5/R+xyN11zujSK//J1b9af/TG4tuH D+Ot6QiaONuaShEdZKxgX1UGrFYPwQSuHU/4OOLcin6+UMxclWeOqbuSVMMpcHe+ppKt /w4Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id n16si10745704edo.74.2020.06.23.08.59.46; Tue, 23 Jun 2020 09:00:09 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733012AbgFWP5u (ORCPT + 99 others); Tue, 23 Jun 2020 11:57:50 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:52904 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731616AbgFWP5t (ORCPT ); Tue, 23 Jun 2020 11:57:49 -0400 Received: from pps.filterd (m0098399.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 05NFX7DJ076972; Tue, 23 Jun 2020 11:57:41 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 31uk60uwnr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 23 Jun 2020 11:57:41 -0400 Received: from m0098399.ppops.net (m0098399.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 05NFXOUG078594; Tue, 23 Jun 2020 11:57:40 -0400 Received: from ppma02dal.us.ibm.com (a.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.10]) by mx0a-001b2d01.pphosted.com with ESMTP id 31uk60uwnb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 23 Jun 2020 11:57:40 -0400 Received: from pps.filterd (ppma02dal.us.ibm.com [127.0.0.1]) by ppma02dal.us.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 05NFdlNl004195; Tue, 23 Jun 2020 15:57:39 GMT Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by ppma02dal.us.ibm.com with ESMTP id 31uk480ve1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 23 Jun 2020 15:57:39 +0000 Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 05NFvcUh52887958 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 23 Jun 2020 15:57:38 GMT Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0229978066; Tue, 23 Jun 2020 15:57:38 +0000 (GMT) Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CB7187805C; Tue, 23 Jun 2020 15:57:36 +0000 (GMT) Received: from DESKTOP-AV6EVPG.localdomain (unknown [9.160.30.158]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTP; Tue, 23 Jun 2020 15:57:36 +0000 (GMT) From: Maurizio Drocco To: zohar@linux.ibm.com Cc: Silviu.Vlasceanu@huawei.com, dmitry.kasatkin@gmail.com, jejb@linux.ibm.com, jmorris@namei.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, maurizio.drocco@ibm.com, mdrocco@linux.vnet.ibm.com, roberto.sassu@huawei.com, serge@hallyn.com Subject: [PATCH v4] ima: extend boot_aggregate with kernel measurements Date: Tue, 23 Jun 2020 11:57:32 -0400 Message-Id: <20200623155732.105-1-maurizio.drocco@ibm.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <1592920990.5437.15.camel@linux.ibm.com> References: <1592920990.5437.15.camel@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.216,18.0.687 definitions=2020-06-23_07:2020-06-23,2020-06-23 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 spamscore=0 mlxscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 lowpriorityscore=0 priorityscore=1501 impostorscore=0 clxscore=1015 suspectscore=1 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006120000 definitions=main-2006230118 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Registers 8-9 are used to store measurements of the kernel and its command line (e.g., grub2 bootloader with tpm module enabled). IMA should include them in the boot aggregate. Registers 8-9 should be only included in non-SHA1 digests to avoid ambiguity. Signed-off-by: Maurizio Drocco --- Changelog: v4: - Reworded comments: PCRs 8 & 9 are always included in non-sha1 digests v3: - Limit including PCRs 8 & 9 to non-sha1 hashes v2: - Minor comment improvements v1: - Include non zero PCRs 8 & 9 in the boot_aggregate security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_crypto.c | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index df93ac258e01..9d94080bdad8 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -30,7 +30,7 @@ enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; -enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; +enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 }; /* digest size for IMA, fits SHA1 or MD5 */ #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c index 220b14920c37..011c3c76af86 100644 --- a/security/integrity/ima/ima_crypto.c +++ b/security/integrity/ima/ima_crypto.c @@ -823,13 +823,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, if (rc != 0) return rc; - /* cumulative sha1 over tpm registers 0-7 */ + /* cumulative digest over TPM registers 0-7 */ for (i = TPM_PCR0; i < TPM_PCR8; i++) { ima_pcrread(i, &d); /* now accumulate with current aggregate */ rc = crypto_shash_update(shash, d.digest, crypto_shash_digestsize(tfm)); } + /* + * Extend cumulative digest over TPM registers 8-9, which contain + * measurement for the kernel command line (reg. 8) and image (reg. 9) + * in a typical PCR allocation. Registers 8-9 are only included in + * non-SHA1 boot_aggregate digests to avoid ambiguity. + */ + if (alg_id != TPM_ALG_SHA1) { + for (i = TPM_PCR8; i < TPM_PCR10; i++) { + ima_pcrread(i, &d); + rc = crypto_shash_update(shash, d.digest, + crypto_shash_digestsize(tfm)); + } + } if (!rc) crypto_shash_final(shash, digest); return rc; -- 2.17.1