dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 06:33:36 +02:00
Code Releases Activity

ima-evm-utils: the IMA measurement list may have too many measurements

Browse Source 
Reading the TPM PCRs before walking the measurement list guarantees
the measurement list contains all the records, possibly too many records.
Compare the re-calculated hash after each extend with both the per bank
TPM PCR digests and the SHA1 paddeded TPM PCR digests.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar 2020-07-10 06:40:07 -04:00
parent 6baaf7f876
commit 1816644727
1 changed files with 22 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/evmctl.c
View File

@ -1880,6 +1880,7 @@ static int ima_measurement(const char *file)
struct template_entry entry = { .template = 0 }; struct template_entry entry = { .template = 0 };
FILE *fp; FILE *fp;
int err_padded = -1;
int err = -1; int err = -1;
errno = 0; errno = 0;
@ -2004,24 +2005,34 @@ static int ima_measurement(const char *file)
ima_show(&entry); ima_show(&entry);
else else
ima_ng_show(&entry); ima_ng_show(&entry);
if (!tpmbanks)
continue;
/* The measurement list might contain too many entries,
* compare the re-calculated TPM PCR values after each
* extend.
*/
err = compare_tpm_banks(num_banks, pseudo_banks, tpm_banks);
if (!err)
break;
/* Compare against original SHA1 zero padded TPM PCR values */
err_padded = compare_tpm_banks(num_banks, pseudo_padded_banks,
tpm_banks);
if (!err_padded)
break;
} }
if (tpmbanks == 0) if (tpmbanks == 0)
log_info("Failed to read any TPM PCRs\n"); log_info("Failed to read any TPM PCRs\n");
else { else {
err = compare_tpm_banks(num_banks, pseudo_banks, tpm_banks);
if (!err) if (!err)
log_info("Matched per TPM bank calculated digest(s).\n"); log_info("Matched per TPM bank calculated digest(s).\n");
else if (!err_padded) {
/* On failure, check older SHA1 zero padded hashes */ log_info("Matched SHA1 padded TPM digest(s).\n");
if (err) { err = 0;
err = compare_tpm_banks(num_banks, pseudo_padded_banks, } else
tpm_banks);
if (!err)
log_info("Matched SHA1 padded TPM digest(s).\n");
}
if (err)
log_info("Failed to match per TPM bank or SHA1 padded TPM digest(s).\n"); log_info("Failed to match per TPM bank or SHA1 padded TPM digest(s).\n");
} }