Hi Mimi,
On 11/29/2021 9:00 AM, Mimi Zohar wrote:
Instead of calculating a file hash and verifying the signature stored
in the security.ima xattr against the calculated file hash, verify the
signature of the fs-verity's file digest. The fs-verity file digest is
a hash that includes the Merkle tree root hash.
This patch is reading the fs-verity signature for the given file using
the new function fsverity_measure() that was defined in [Patch 1/4]. Is
it also verifying the fs-verity signature here?
Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxx>
---
security/integrity/ima/ima_api.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 179c7f0364c2..ee1701f8c0f3 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -16,6 +16,7 @@
#include <linux/xattr.h>
#include <linux/evm.h>
#include <linux/iversion.h>
+#include <linux/fsverity.h>
#include "ima.h"
@@ -205,6 +206,23 @@ int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
allowed_algos);
}
+static int ima_collect_verity_measurement(struct integrity_iint_cache *iint,
+ struct ima_digest_data *hash)
+{
+ u8 verity_digest[FS_VERITY_MAX_DIGEST_SIZE];
+ enum hash_algo verity_alg;
+ int rc;
+
+ rc = fsverity_measure(iint->inode, verity_digest, &verity_alg);
nit: fsverity_collect_measurement() may be more appropriate for this
function (defined in [PATCH 1/4]).
thanks,
-lakshmi
+ if (rc)
+ return -EINVAL;
+ if (hash->algo != verity_alg)
+ return -EINVAL;
+ hash->length = hash_digest_size[verity_alg];
+ memcpy(hash->digest, verity_digest, hash->length);
+ return 0;
+}
+
/*
* ima_collect_measurement - collect file measurement
*
@@ -256,6 +274,8 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
if (buf)
result = ima_calc_buffer_hash(buf, size, &hash.hdr);
+ else if (veritysig)
+ result = ima_collect_verity_measurement(iint, &hash.hdr);
else
result = ima_calc_file_hash(file, &hash.hdr);
