dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-11-04 06:40:49 +01:00
Code Releases Activity

ima-evm-utils: add support in tpm2_read_pcrs to read different TPM banks

Browse Source 
tpm2_read_pcrs() reads the sha1 PCRs in order to verify the measurmeent
list.  This patch adds support for reading other TPM banks.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar
2020-02-17 21:11:58 -05:00
parent 696bf0b108
commit 2f482a6989
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/evmctl.c
View File

@@ -1423,14 +1423,16 @@ static int tpm_pcr_read(int idx, uint8_t *pcr, int len)
} }
#ifdef HAVE_TSSPCRREAD #ifdef HAVE_TSSPCRREAD
static int tpm2_pcr_read(int idx, uint8_t *hwpcr, int len, char **errmsg) static int tpm2_pcr_read(const char *algo_name, int idx, uint8_t *hwpcr,
int len, char **errmsg)
{ {
FILE *fp; FILE *fp;
char pcr[100]; /* may contain an error */ char pcr[100]; /* may contain an error */
char cmd[50]; char cmd[50];
int ret; int ret;
sprintf(cmd, "tsspcrread -halg sha1 -ha %d -ns 2> /dev/null", idx); sprintf(cmd, "tsspcrread -halg %s -ha %d -ns 2> /dev/null",
algo_name, idx);
fp = popen(cmd, "r"); fp = popen(cmd, "r");
if (!fp) { if (!fp) {
ret = asprintf(errmsg, "popen failed: %s", strerror(errno)); ret = asprintf(errmsg, "popen failed: %s", strerror(errno));
@@ -1456,7 +1458,7 @@ static int tpm2_pcr_read(int idx, uint8_t *hwpcr, int len, char **errmsg)
ret = -1; ret = -1;
if (!ret) if (!ret)
hex2bin(hwpcr, pcr, SHA_DIGEST_LENGTH); hex2bin(hwpcr, pcr, len);
else else
*errmsg = strndup(pcr, strlen(pcr) - 1); /* remove newline */ *errmsg = strndup(pcr, strlen(pcr) - 1); /* remove newline */
@@ -1885,7 +1887,8 @@ static int ima_measurement(const char *file)
#ifdef HAVE_TSSPCRREAD #ifdef HAVE_TSSPCRREAD
char *errmsg = NULL; char *errmsg = NULL;
err = tpm2_pcr_read(i, hwpcr, sizeof(hwpcr), &errmsg); err = tpm2_pcr_read("sha1", i, hwpcr, sizeof(hwpcr),
&errmsg);
if (err) { if (err) {
log_info("Failed to read PCRs: (%s)\n", errmsg); log_info("Failed to read PCRs: (%s)\n", errmsg);
free(errmsg); free(errmsg);