> -----Original Message----- > From: Mimi Zohar [mailto:zohar@xxxxxxxxxxxxx] > Sent: Tuesday, January 28, 2020 4:41 PM > To: Roberto Sassu <roberto.sassu@xxxxxxxxxx>; linux- > integrity@xxxxxxxxxxxxxxx > Cc: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>; James Bottomley > <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>; linux- > kernel@xxxxxxxxxxxxxxx; Silviu Vlasceanu <Silviu.Vlasceanu@xxxxxxxxxx> > Subject: Re: [PATCH 2/2] ima: support calculating the boot_aggregate based > on different TPM banks > > On Tue, 2020-01-28 at 14:19 +0000, Roberto Sassu wrote: > > > -----Original Message----- > > > From: linux-integrity-owner@xxxxxxxxxxxxxxx [mailto:linux-integrity- > > > owner@xxxxxxxxxxxxxxx] On Behalf Of Mimi Zohar > > > Sent: Monday, January 27, 2020 5:02 PM > > > To: linux-integrity@xxxxxxxxxxxxxxx > > > Cc: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>; James Bottomley > > > <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>; linux- > > > kernel@xxxxxxxxxxxxxxx; Mimi Zohar <zohar@xxxxxxxxxxxxx> > > > Subject: [PATCH 2/2] ima: support calculating the boot_aggregate based > on > > > different TPM banks > > > > > > Calculating the boot_aggregate attempts to read the TPM SHA1 bank, > > > assuming it is always enabled. With TPM 2.0 hash agility, TPM chips > > > could support multiple TPM PCR banks, allowing firmware to configure > and > > > enable different banks. > > > > > > Instead of hard coding the TPM 2.0 bank hash algorithm used for > calculating > > > the boot-aggregate, see if the configured IMA_DEFAULT_HASH > algorithm is > > > an allocated TPM bank, otherwise use the first allocated TPM bank. > > > > > > For TPM 1.2 SHA1 is the only supported hash algorithm. > > > > > > Reported-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx> > > > Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxx> > > > --- > > > security/integrity/ima/ima_crypto.c | 37 > > > ++++++++++++++++++++++++++++++++++++- > > > 1 file changed, 36 insertions(+), 1 deletion(-) > > > > > > diff --git a/security/integrity/ima/ima_crypto.c > > > b/security/integrity/ima/ima_crypto.c > > > index 7967a6904851..b1b26d61f174 100644 > > > --- a/security/integrity/ima/ima_crypto.c > > > +++ b/security/integrity/ima/ima_crypto.c > > > @@ -656,8 +656,25 @@ static void __init ima_pcrread(u32 idx, struct > > > tpm_digest *d) > > > pr_err("Error Communicating to TPM chip\n"); > > > } > > > > > > +/* tpm2_hash_map is the same as defined in tpm2-cmd.c and > > > trusted_tpm2.c */ > > > +static struct tpm2_hash tpm2_hash_map[] = { > > > + {HASH_ALGO_SHA1, TPM_ALG_SHA1}, > > > + {HASH_ALGO_SHA256, TPM_ALG_SHA256}, > > > + {HASH_ALGO_SHA384, TPM_ALG_SHA384}, > > > + {HASH_ALGO_SHA512, TPM_ALG_SHA512}, > > > + {HASH_ALGO_SM3_256, TPM_ALG_SM3_256}, > > > +}; > > > + > > > /* > > > - * Calculate the boot aggregate hash > > > + * The boot_aggregate is a cumulative hash over TPM registers 0 - 7. > With > > > + * TPM 2.0 hash agility, TPM chips could support multiple TPM PCR > banks, > > > + * allowing firmware to configure and enable different banks. > > > + * > > > + * Instead of hard coding the TPM bank hash algorithm used for > calculating > > > + * the boot-aggregate, see if the configured IMA_DEFAULT_HASH > > > algorithm is > > > + * an allocated TPM bank, otherwise use the first allocated TPM bank. > > > + * > > > + * For TPM 1.2 SHA1 is the only hash algorithm. > > > */ > > > static int __init ima_calc_boot_aggregate_tfm(char *digest, > > > struct crypto_shash *tfm) > > > @@ -673,6 +690,24 @@ static int __init > ima_calc_boot_aggregate_tfm(char > > > *digest, > > > if (rc != 0) > > > return rc; > > > > > > + for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) { > > > + if (tpm2_hash_map[i].crypto_id == ima_hash_algo) { > > > > It is not necessary to define a new map. ima_tpm_chip->allocated_banks > > has a crypto_id field. > > Ok, thanks. When you send the new version, please include patch 1/8 of my patch set, that sets crypto_id to HASH_ALGO__LAST if there is no mapping between TPM ID and crypto ID. Thanks Roberto HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli
