Hi Linus,
The main changes are extending the TPM 2.0 PCR banks with bank
specific file hashes, calculating the "boot_aggregate" based on other
TPM PCR banks, using the default IMA hash algorithm, instead of SHA1,
as the basis for the cache hash table key, and preventing the mprotect
syscall to circumvent an IMA mmap appraise policy rule.
- In preparation for extending TPM 2.0 PCR banks with bank specific
digests, commit 0b6cf6b97b7e ("tpm: pass an array of tpm_extend_digest
structures to tpm_pcr_extend()") modified tpm_pcr_extend(). The
original SHA1 file digests were padded/truncated, before being
extended into the other TPM PCR banks. This pull request calculates
and extends the TPM PCR banks with bank specific file hashes
completing the above change.
- The "boot_aggregate", the first IMA measurement list record, is the
"trusted boot" link between the pre-boot environment and the running
OS. With TPM 2.0, the "boot_aggregate" record is not limited to being
based on the SHA1 TPM PCR bank, but can be calculated based on any
enabled bank, assuming the hash algorithm is also enabled in the
kernel.
Other changes include the following and five other bug fixes/code
clean up:
- supporting both a SHA1 and a larger "boot_aggregate" digest in a
custom template format containing both the the SHA1 ('d') and larger
digests ('d-ng') fields.
- Initial hash table key fix, but additional changes would be good.
thanks,
Mimi
The following changes since commit ae83d0b416db002fe95601e7f97f64b59514d936:
Linux 5.7-rc2 (2020-04-19 14:35:30 -0700)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git tags/integrity-v5.8
for you to fetch changes up to 42413b49804b250ced70dac8815388af2d4ad872:
ima: Directly free *entry in ima_alloc_init_template() if digests is NULL (2020-06-05 06:04:11 -0400)
----------------------------------------------------------------
integrity-v5.8
----------------------------------------------------------------
Krzysztof Struczynski (3):
ima: Fix ima digest hash table key calculation
ima: Remove redundant policy rule set in add_rules()
ima: Set again build_ima_appraise variable
Mimi Zohar (1):
ima: verify mprotect change is consistent with mmap policy
Roberto Sassu (11):
ima: Switch to ima_hash_algo for boot aggregate
ima: Evaluate error in init_ima()
ima: Store template digest directly in ima_template_entry
ima: Switch to dynamically allocated buffer for template digests
ima: Allocate and initialize tfm for each PCR bank
ima: Calculate and extend PCR with digests in ima_template_entry
ima: Use ima_hash_algo for collision detection in the measurement list
evm: Fix possible memory leak in evm_calc_hmac_or_hash()
ima: Directly assign the ima_default_policy pointer to ima_rules
ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()
ima: Directly free *entry in ima_alloc_init_template() if digests is NULL
include/linux/ima.h | 7 +
security/integrity/evm/evm_crypto.c | 2 +-
security/integrity/ima/ima.h | 20 ++-
security/integrity/ima/ima_api.c | 23 +--
security/integrity/ima/ima_crypto.c | 252 +++++++++++++++++++++++++-----
security/integrity/ima/ima_fs.c | 4 +-
security/integrity/ima/ima_init.c | 24 ++-
security/integrity/ima/ima_main.c | 54 +++++++
security/integrity/ima/ima_policy.c | 12 +-
security/integrity/ima/ima_queue.c | 36 +++--
security/integrity/ima/ima_template.c | 25 ++-
security/integrity/ima/ima_template_lib.c | 18 +++
security/security.c | 7 +-
13 files changed, 397 insertions(+), 87 deletions(-)
