dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 14:43:37 +02:00
Code Releases Activity

ima-evm-utils: support providing the TPM 1.2 PCRs as a file

Browse Source 
"evmctl ima_measurement" walks the IMA measurement list calculating the
PCRs and verifies the calculated values against the system's PCRs.
Instead of reading the system's PCRs, provide the PCRs as a file.  For
TPM 1.2 the PCRs are exported via a securityfs file.

Verifying the IMA measurement list against the exported TPM 1.2 PCRs
file may be used remotely for regression testing.  If used in a
production environment, the provided TPM PCRs must be compared with
those included in the TPM 1.2 quote as well.

This patch defines an evmctl ima_measurement "--pcrs <filename>" option.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar 2020-07-08 18:11:24 -04:00
parent d5b24fa18e
commit 354510fa50
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/evmctl.c
View File

@ -160,6 +160,8 @@ struct tpm_bank_info {
uint8_t pcr[NUM_PCRS][MAX_DIGEST_SIZE]; uint8_t pcr[NUM_PCRS][MAX_DIGEST_SIZE];
}; };
static char *pcrfile;
static int bin2file(const char *file, const char *ext, const unsigned char *data, int len) static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)
{ {
FILE *fp; FILE *fp;
@ -1377,12 +1379,18 @@ static char *misc_pcrs = "/sys/class/misc/tpm0/device/pcrs";
/* Read all of the TPM 1.2 PCRs */ /* Read all of the TPM 1.2 PCRs */
static int tpm_pcr_read(struct tpm_bank_info *tpm_banks, int len) static int tpm_pcr_read(struct tpm_bank_info *tpm_banks, int len)
{ {
FILE *fp; FILE *fp = NULL;
char *p, pcr_str[7], buf[70]; /* length of the TPM string */ char *p, pcr_str[7], buf[70]; /* length of the TPM string */
int result = -1; int result = -1;
int i = 0; int i = 0;
/* Use the provided TPM 1.2 pcrs file */
if (pcrfile)
fp = fopen(pcrfile, "r");
if (!fp)
fp = fopen(pcrs, "r"); fp = fopen(pcrs, "r");
if (!fp) if (!fp)
fp = fopen(misc_pcrs, "r"); fp = fopen(misc_pcrs, "r");
@ -2345,7 +2353,7 @@ struct command cmds[] = {
{"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"}, {"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"},
{"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"}, {"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"},
{"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"}, {"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"},
{"ima_measurement", cmd_ima_measurement, 0, "[--validate] [--verify] file", "Verify measurement list (experimental).\n"}, {"ima_measurement", cmd_ima_measurement, 0, "[--validate] [--verify] [--pcrs file] file", "Verify measurement list (experimental).\n"},
{"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[file]", "Calculate per TPM bank boot_aggregate digests\n"}, {"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[file]", "Calculate per TPM bank boot_aggregate digests\n"},
{"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"}, {"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"},
{"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"}, {"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"},
@ -2386,6 +2394,7 @@ static struct option opts[] = {
{"xattr-user", 0, 0, 140}, {"xattr-user", 0, 0, 140},
{"validate", 0, 0, 141}, {"validate", 0, 0, 141},
{"verify", 0, 0, 142}, {"verify", 0, 0, 142},
{"pcrs", 1, 0, 143},
{} {}
}; };
@ -2570,6 +2579,9 @@ int main(int argc, char *argv[])
case 142: /* --verify */ case 142: /* --verify */
verify = 1; verify = 1;
break; break;
case 143:
pcrfile = optarg;
break;
case '?': case '?':
exit(1); exit(1);
break; break;