Received: by 2002:a05:6902:102b:0:0:0:0 with SMTP id x11csp664651ybt; Wed, 8 Jul 2020 08:46:17 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyID3PgJdQmLBAXZ2zz3QQ1+wgjcxEQswtMWuMqhaLFWnq/ajYiNdsTWW4cuzw8eyu6+yGB X-Received: by 2002:a17:906:c452:: with SMTP id ck18mr55021825ejb.415.1594223177599; Wed, 08 Jul 2020 08:46:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1594223177; cv=none; d=google.com; s=arc-20160816; b=P4fMKQRo9DUfG+b4AV0NZYFybGqvEWPSjxpgEU5MrIIaqwMcHonDqYB6huzfhlN/2I IcmUSbrTsN32YzofEIwHCZg5pair9G0MZOGVw6GjuWl+8gum5oLojC39nUq7XJQ8ZKVy jC7Oa2KA6I/u9E7t+01OYUsAZz9tXVmprr/PKJPCGdyJwk9ztuvdZlVBtnkd4BMiYXYX 05SqT+tNY0fKVg/+rx0TglF8tYMtPN3VAZHCyXOc3zrCEFRWw1H7nWjfOXIH7Zuqwk6P dta9oP0QWgk8jbfzxPrr9z+7Pl2E7Co8j9k7D+GdvDobF5ipBaM4Z1RJJhFpKjnKYT3x YM3Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=VhVt1a79JGop6YPKoog+Nc+oOvBByYeIypPLEetJyuE=; b=QaqQTbhKYt8xCsm/PDlvQQpeGvLvaP6mNUI/zft+56tS0OVHqlxXYVcPsKx3m3zJCS 1239kYpANXbqVb+6117D3NU7HSEqy88I4AukHwbSCdWbjk9tsWpTsZeGFbndkgaa834E vzBEaVUKDBlAHkhL4KsvEB/L5vWKTVfuMzlr7L7Jbv08jgmqGqHHI77Dr6UC3xUurXBL s+XtO14wfV/Jvr7aT95mSHphfdWpxh50qtxaYRk4pCzIBeTUCMnjIxbYXLPhw7CeJkIS evJ9hheklEPbMl/oHZpTY3t33P+ZMCGghlVeG5xvgtmK0iwUmJW921rRH071n7Rtv85c bFPg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Lc7kTyVU; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id y19si153730eje.56.2020.07.08.08.45.54; Wed, 08 Jul 2020 08:46:17 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Lc7kTyVU; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730424AbgGHPod (ORCPT + 99 others); Wed, 8 Jul 2020 11:44:33 -0400 Received: from mail.kernel.org ([198.145.29.99]:47720 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730366AbgGHPlW (ORCPT ); Wed, 8 Jul 2020 11:41:22 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AEF03207C4; Wed, 8 Jul 2020 15:41:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1594222881; bh=ma9ZvKZoF5WtM7bB9wnNI5b3TrDkNcZs7yoCrAsR6v8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Lc7kTyVUhaabkaPq0cp3rdRFkukxeEiq5qTfWRlwgPg2v7XZeltCtzNA94MgIpjjj 0tVX2x6tj14cO4chyViHQkWT1ZgIlnOE5dEnH3ICeLwy65SZoBT7EwEhN7siK2PsXd aYZy5LnT3KyhdjmQ7rOyMBGiShdWTli0gqdoPSRo= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Maurizio Drocco , Bruno Meneguele , Mimi Zohar , Sasha Levin , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH AUTOSEL 5.7 03/30] ima: extend boot_aggregate with kernel measurements Date: Wed, 8 Jul 2020 11:40:49 -0400 Message-Id: <20200708154116.3199728-3-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200708154116.3199728-1-sashal@kernel.org> References: <20200708154116.3199728-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Maurizio Drocco [ Upstream commit 20c59ce010f84300f6c655d32db2610d3433f85c ] Registers 8-9 are used to store measurements of the kernel and its command line (e.g., grub2 bootloader with tpm module enabled). IMA should include them in the boot aggregate. Registers 8-9 should be only included in non-SHA1 digests to avoid ambiguity. Signed-off-by: Maurizio Drocco Reviewed-by: Bruno Meneguele Tested-by: Bruno Meneguele (TPM 1.2, TPM 2.0) Signed-off-by: Mimi Zohar Signed-off-by: Sasha Levin --- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_crypto.c | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 495e28bd488e6..844a55225ede0 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -30,7 +30,7 @@ enum ima_show_type { IMA_SHOW_BINARY, IMA_SHOW_BINARY_NO_FIELD_LEN, IMA_SHOW_BINARY_OLD_STRING_FMT, IMA_SHOW_ASCII }; -enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; +enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8, TPM_PCR10 = 10 }; /* digest size for IMA, fits SHA1 or MD5 */ #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c index fb27174806ba4..e0738d1d143d7 100644 --- a/security/integrity/ima/ima_crypto.c +++ b/security/integrity/ima/ima_crypto.c @@ -682,13 +682,26 @@ static int ima_calc_boot_aggregate_tfm(char *digest, u16 alg_id, if (rc != 0) return rc; - /* cumulative sha1 over tpm registers 0-7 */ + /* cumulative digest over TPM registers 0-7 */ for (i = TPM_PCR0; i < TPM_PCR8; i++) { ima_pcrread(i, &d); /* now accumulate with current aggregate */ rc = crypto_shash_update(shash, d.digest, crypto_shash_digestsize(tfm)); } + /* + * Extend cumulative digest over TPM registers 8-9, which contain + * measurement for the kernel command line (reg. 8) and image (reg. 9) + * in a typical PCR allocation. Registers 8-9 are only included in + * non-SHA1 boot_aggregate digests to avoid ambiguity. + */ + if (alg_id != TPM_ALG_SHA1) { + for (i = TPM_PCR8; i < TPM_PCR10; i++) { + ima_pcrread(i, &d); + rc = crypto_shash_update(shash, d.digest, + crypto_shash_digestsize(tfm)); + } + } if (!rc) crypto_shash_final(shash, digest); return rc; -- 2.25.1