Re: [PATCH v4 1/7] ima: Switch to ima_hash_algo for boot aggregate

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu Apr 02 20, Mimi Zohar wrote:
Hi Roberto,

On Wed, 2020-03-25 at 11:47 +0100, Roberto Sassu wrote:
boot_aggregate is the first entry of IMA measurement list. Its purpose is
to link pre-boot measurements to IMA measurements. As IMA was designed to
work with a TPM 1.2, the SHA1 PCR bank was always selected even if a
TPM 2.0 with support for stronger hash algorithms is available.

This patch first tries to find a PCR bank with the IMA default hash
algorithm. If it does not find it, it selects the SHA256 PCR bank for
TPM 2.0 and SHA1 for TPM 1.2. Ultimately, it selects SHA1 also for TPM 2.0
if the SHA256 PCR bank is not found.

If none of the PCR banks above can be found, boot_aggregate file digest is
filled with zeros, as for TPM bypass, making it impossible to perform a
remote attestation of the system.

Cc: stable@xxxxxxxxxxxxxxx # 5.1.x
Fixes: 879b589210a9 ("tpm: retrieve digest size of unknown algorithms with PCR read")
Reported-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
Suggested-by: James Bottomley <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>

Thank you!  This patch set is now queued in next-integrity-testing
during the open window.  Jerry, I assume this works for you.  Could we
get your tag?

thanks!

Mimi


Hi Mimi,

Yes, I no longer get the errors with this patch.


Tested-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>


Regards,
Jerry




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux