Instead of reading the TPM 1.2 PCRs one at a time, opening and closing
the securityfs file each time, read all of PCRs at once.
Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxx>
---
src/evmctl.c | 39 ++++++++++++++++++---------------------
1 file changed, 18 insertions(+), 21 deletions(-)
diff --git a/src/evmctl.c b/src/evmctl.c
index 21809b3229e9..0e489e2c7ba6 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -152,6 +152,14 @@ static void print_usage(struct command *cmd);
static const char *xattr_ima = "security.ima";
static const char *xattr_evm = "security.evm";
+struct tpm_bank_info {
+ int digest_size;
+ int supported;
+ const char *algo_name;
+ uint8_t digest[MAX_DIGEST_SIZE];
+ uint8_t pcr[NUM_PCRS][MAX_DIGEST_SIZE];
+};
+
static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)
{
FILE *fp;
@@ -1366,13 +1374,13 @@ static int cmd_ima_clear(struct command *cmd)
static char *pcrs = "/sys/class/tpm/tpm0/device/pcrs"; /* Kernels >= 4.0 */
static char *misc_pcrs = "/sys/class/misc/tpm0/device/pcrs";
-static int tpm_pcr_read(int idx, uint8_t *pcr, int len)
+/* Read all of the TPM 1.2 PCRs */
+static int tpm_pcr_read(struct tpm_bank_info *tpm_banks, int len)
{
FILE *fp;
char *p, pcr_str[7], buf[70]; /* length of the TPM string */
int result = -1;
-
- sprintf(pcr_str, "PCR-%2.2d", idx);
+ int i = 0;
fp = fopen(pcrs, "r");
if (!fp)
@@ -1385,11 +1393,10 @@ static int tpm_pcr_read(int idx, uint8_t *pcr, int len)
p = fgets(buf, sizeof(buf), fp);
if (!p)
break;
- if (!strncmp(p, pcr_str, 6)) {
- hex2bin(pcr, p + 7, len);
- result = 0;
- break;
- }
+ sprintf(pcr_str, "PCR-%2.2d", i);
+ if (!strncmp(p, pcr_str, 6))
+ hex2bin(tpm_banks[0].pcr[i++], p + 7, len);
+ result = 0;
}
fclose(fp);
return result;
@@ -1571,14 +1578,6 @@ void ima_ng_show(struct template_entry *entry)
}
}
-struct tpm_bank_info {
- int digest_size;
- int supported;
- const char *algo_name;
- uint8_t digest[MAX_DIGEST_SIZE];
- uint8_t pcr[NUM_PCRS][MAX_DIGEST_SIZE];
-};
-
static void set_bank_info(struct tpm_bank_info *bank, const char *algo_name)
{
const EVP_MD *md;
@@ -1771,11 +1770,9 @@ static int read_tpm_pcrs(int num_banks, struct tpm_bank_info *tpm_banks)
{
int i;
- for (i = 0; i < NUM_PCRS; i++) {
- if (tpm_pcr_read(i, tpm_banks[0].pcr[i], SHA_DIGEST_LENGTH)) {
- log_debug("Failed to read TPM 1.2 PCRs.\n");
- return -1;
- }
+ if (tpm_pcr_read(tpm_banks, SHA_DIGEST_LENGTH)) {
+ log_debug("Failed to read TPM 1.2 PCRs.\n");
+ return -1;
}
tpm_banks[0].supported = 1;
--
2.7.5
