Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Roberto Sassu <roberto.sassu@huawei.com>
To:     Mimi Zohar <zohar@linux.ibm.com>,
        "Guozihua (Scott)" <guozihua@huawei.com>,
        Jonathan Corbet <corbet@lwn.net>
CC:     "linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        wangweiyang <wangweiyang2@huawei.com>,
        Xiujianfeng <xiujianfeng@huawei.com>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>
Subject: RE: [RESEND][PATCH] Documentation: added order requirement for
 ima_hash=
Thread-Topic: [RESEND][PATCH] Documentation: added order requirement for
 ima_hash=
Thread-Index: AQHYEcpHUD88EJ3n70C3otG2igs7kax0bcMAgAAWmYCAACQEgIAAM52AgABVhoCAABLMsIAACyCAgAARgzA=
Date:   Wed, 26 Jan 2022 14:43:29 +0000
Message-ID: <220a8c9f3ab34f2183c0a88941c145d0@huawei.com>
References: <20220125090237.120357-1-guozihua@huawei.com>
         <36b6058f2cdf6bead917c06ecc6e8769bb88130c.camel@linux.ibm.com>
         <3933adf5-4e9d-6b22-2e46-55643c504f52@huawei.com>
         <71508a72b042da330d07a624cf499561c46195f0.camel@linux.ibm.com>
         <97142483-d7e7-e310-0cb0-30a81414cb57@huawei.com>
         <c1bfe53abaf24feacb676ce940edcb8899924ffc.camel@linux.ibm.com>
         <173fffb6cde54ae4ac7676d18a84c79f@huawei.com>
 <6f0890f135b61c41d81b03bf084ebab1b3e551e1.camel@linux.ibm.com>
In-Reply-To: <6f0890f135b61c41d81b03bf084ebab1b3e551e1.camel@linux.ibm.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
Precedence: bulk

> From: Mimi Zohar [mailto:zohar@linux.ibm.com]
> Sent: Wednesday, January 26, 2022 3:35 PM
> On Wed, 2022-01-26 at 13:24 +0000, Roberto Sassu wrote:
> > > From: Mimi Zohar [mailto:zohar@linux.ibm.com]
> > > Sent: Wednesday, January 26, 2022 1:48 PM
> > > On Wed, 2022-01-26 at 15:41 +0800, Guozihua (Scott) wrote:
> > > >
> > > >
> > > > The main issue lies in ima_template_desc_current called by hash_setup,
> > > > which does not just read ima_template global variable, but also tries to
> > > > set it if that hasn't been done already. Causing ima_template_setup to quit.
> > >
> > > Right, which calls ima_init_template_list().  So part of the solution
> > > could be to conditionally call ima_init_template_list()
> > > in ima_template_setup().
> > >
> > > -       if (ima_template)
> > > -               return 1;
> > > -
> > > -       ima_init_template_list();
> > > +       if (!ima_template
> > > +               ima_init_template_list();
> > >
> > > Roberto, what do you think?
> >
> > Hi Mimi
> >
> > I think we wanted to prevent to set a digest algorithm
> > incompatible with the chosen template.
> >
> > If we have in the kernel command line:
> >
> > ima_template=ima ima_hash=sha256
> >
> > ima_hash_algo would be set to HASH_ALGO_SHA1 despite
> > the user choice and the template would be set to 'ima'.
> >
> > In the opposite case:
> >
> > ima_hash=sha256 ima_template=ima
> >
> > if the default template is 'ima', then ima_hash_algo would be
> > set to HASH_ALGO_SHA1. Otherwise, it would be
> > HASH_ALGO_SHA256. If we allow the template to be set after
> > the digest algorithm is evaluated, the template selection will
> > be rejected if the algorithm is incompatible with the template.
> 
> The only time that would occur is in the unlikely case that the
> template is being set to "ima".   That sounds reasonable.  In fact we
> should consider preventing the template format being set to "ima".

Ok.

> > I'm trying to remember why we still have the digest recalculation
> > in ima_eventdigest_init(). Maybe the only possibility is if we
> > set the template from the policy?
> 
> The recalculation was relatively recently added in commit 6cc7c266e5b4
> ("ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()").

There is also recalculation for the file digest:

        hash.hdr.algo = ima_template_hash_algo_allowed(ima_hash_algo) ?
            ima_hash_algo : HASH_ALGO_SHA1;
        result = ima_calc_file_hash(event_data->file, &hash.hdr);

I understood that Jonathan already applied the patch. If it is possible
to make a new patch according to your suggestion, I would ask Zihua
to do that.

Jonathan, would it be fine for you to discard this patch?

Thanks

Roberto

HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Zhong Ronghua

> thanks,
> 
> Mimi