Re: [PATCH v2] ima: fix violation measurement list record

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 7/5/22 10:10, Mimi Zohar wrote:
Although the violation digest in the IMA measurement list is always
zeroes, the size of the digest should be based on the hash algorithm.
Until recently the hash algorithm was hard coded to sha1.  Fix the
violation digest size included in the IMA measurement list.

This is just a cosmetic change which should not affect attestation.

Reported-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
Fixes: 09091c44cb73 ("ima: use IMA default hash algorithm for integrity violations")
Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxx>

Tested-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>

---
  security/integrity/ima/ima_template_lib.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
index c877f01a5471..34a8cabe09b1 100644
--- a/security/integrity/ima/ima_template_lib.c
+++ b/security/integrity/ima/ima_template_lib.c
@@ -324,9 +324,9 @@ static int ima_eventdigest_init_common(const u8 *digest, u32 digestsize,
  		/*
  		 * If digest is NULL, the event being recorded is a violation.
  		 * Make room for the digest by increasing the offset of
-		 * IMA_DIGEST_SIZE.
+		 * hash algorithm digest size.
  		 */
-		offset += IMA_DIGEST_SIZE;
+		offset += hash_digest_size[hash_algo];
return ima_write_template_field_data(buffer, offset + digestsize,
  					     fmt, field_data);



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux Kernel]     [Linux Kernel Hardening]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]

  Powered by Linux