On Fri, 2020-02-21 at 16:11 -0800, Lakshmi Ramasubramanian wrote: > Hi Mimi, > > > IMA currently extends the different TPM banks by padding/truncating the > > SHA1 template digest. Although the IMA measurement list only includes > > the SHA1 template digest, the template digest could be re-calculated > > properly for each bank. Roberto Sassu's proposed "ima: support stronger > > algorithms for attestation" kernel patch set makes this change. > > > > In order to test the proposed kernel change, this patch set walks the > > IMA measurement list, re-calculating the per TPM bank template digest > > and extending the TPM bank PCR with the bank specific digest. The last > > step, after walking the measurement list, is comparing the the resulting > > TPM per bank PCR values with the actual TPM per bank PCR values. > > I have built the kernel with Roberto's patch set and also built evmctl > with your patch set. > > Could you please include an example for how evmctl can be used to test > Roberto's change? There are two aspects to Roberto's changes - extending the TPM banks with the bank specific template digest and verifying the boot aggregate. This patch set only addresses the first aspect. Assuming both the sha1 and sha256 TPM banks are enabled, # tssgetcapability -cap 5 2 PCR selections hash TPM_ALG_SHA1 TPMS _PCR_SELECTION length 3 ff ff ff hash TPM_ALG_SHA256 TPMS_PC R_SELECTION length 3 ff ff ff the output would look like: # evmctl ima_measurement -v --list /sys/kernel/security/integrity/ima/binary_runtime_measurements sha1: PCRAgg 10: 7723f6d980725507e5d0eb643dc179aae0efb719 sha1: TPM PCR-10: 7723f6d980725507e5d0eb643dc179aae0efb719 sha1 PCR-10: succeed sha256: PCRAgg 10: 5254d6dce62765f884dc67dac8d59a8721ae14495ae4a0cb73426d0c013a82b2 sha256: TPM PCR-10: 5254d6dce62765f884dc67dac8d59a8721ae14495ae4a0cb73426d0c013a82b2 sha256 PCR-10: succeed Mimi
