Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <1593444433.5085.15.camel@linux.ibm.com>
Subject: [GIT PULL] integrity additional change v5.8 (#2)
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     linux-integrity <linux-integrity@vger.kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        Maurizio Drocco <maurizio.drocco@ibm.com>,
        James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Mon, 29 Jun 2020 11:27:13 -0400
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Linus,

Prior to Linux 5.8 the SHA1 "boot_aggregate" value was padded with 0's
and extended into the other TPM 2.0 banks.  Included in the Linux 5.8
open window, TPM 2.0 PCR bank specific "boot_aggregate" values (PCRs 0
- 7) are calculated and extended into the TPM banks.

Distro releases are now shipping grub2 with TPM support, which extend
PCRs 8 & 9.  I'd like for PCRs 8 & 9 to be included in the new
"boot_aggregate" calculations.  For backwards compatibility, PCRs 8 &
9 are not included in the SHA1 TPM bank "boot_aggregate" calculation.

I'd appreciate your merging this additional change.

thanks,

Mimi

The following changes since commit 48778464bb7d346b47157d21ffde2af6b2d39110:

  Linux 5.8-rc2 (2020-06-21 15:45:29 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git tags/integrity-v5.8-fix-2

for you to fetch changes up to 20c59ce010f84300f6c655d32db2610d3433f85c:

  ima: extend boot_aggregate with kernel measurements (2020-06-24 20:47:24 -0400)

----------------------------------------------------------------
Include PCRs 8 & 9 in per TPM 2.0 bank boot_aggregate calculation

----------------------------------------------------------------
Maurizio Drocco (1):
      ima: extend boot_aggregate with kernel measurements

 security/integrity/ima/ima.h        |  2 +-
 security/integrity/ima/ima_crypto.c | 15 ++++++++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)