From 6921833477a97f3a29d5c62f8c424ce9dce776b0 Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Wed, 17 Jan 2018 21:23:35 -0500 Subject: [PATCH] ima-evm-utils: add support for validating multiple pcrs The IMA measurement list may contain records for different PCRs. This patch walks the measurement list, calculating a PCR aggregate value for each PCR. Signed-off-by: Mimi Zohar --- src/evmctl.c | 36 +++++++++++++++++++++++------------- src/imaevm.h | 3 +++ 2 files changed, 26 insertions(+), 13 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 93a51f8..eee7397 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1407,12 +1407,15 @@ void ima_ng_show(struct template_entry *entry) static int ima_measurement(const char *file) { - uint8_t pcr[SHA_DIGEST_LENGTH] = {0,}; - uint8_t pcr10[SHA_DIGEST_LENGTH]; + uint8_t pcr[NUM_PCRS][SHA_DIGEST_LENGTH] = {{0}}; + uint8_t hwpcr[SHA_DIGEST_LENGTH]; struct template_entry entry = { .template = 0 }; FILE *fp; int err = -1; + bool verify_failed = false; + int i; + memset(zero, 0, SHA_DIGEST_LENGTH); memset(fox, 0xff, SHA_DIGEST_LENGTH); log_debug("Initial PCR value: "); @@ -1429,7 +1432,8 @@ static int ima_measurement(const char *file) init_public_keys(params.keyfile); while (fread(&entry.header, sizeof(entry.header), 1, fp)) { - ima_extend_pcr(pcr, entry.header.digest, SHA_DIGEST_LENGTH); + ima_extend_pcr(pcr[entry.header.pcr], entry.header.digest, + SHA_DIGEST_LENGTH); if (!fread(entry.name, entry.header.name_len, 1, fp)) { log_err("Unable to read template name\n"); @@ -1463,23 +1467,29 @@ static int ima_measurement(const char *file) ima_ng_show(&entry); } - tpm_pcr_read(10, pcr10, sizeof(pcr10)); - log_info("PCRAgg: "); - log_dump(pcr, sizeof(pcr)); + for (i = 0; i < NUM_PCRS; i++) { + if (memcmp(pcr[i], zero, SHA_DIGEST_LENGTH) == 0) + continue; - log_info("PCR-10: "); - log_dump(pcr10, sizeof(pcr10)); + log_info("PCRAgg %.2d: ", i); + log_dump(pcr[i], SHA_DIGEST_LENGTH); - if (memcmp(pcr, pcr10, sizeof(pcr))) { - log_err("PCRAgg does not match PCR-10\n"); - goto out; + tpm_pcr_read(i, hwpcr, sizeof(hwpcr)); + log_info("HW PCR-%d: ", i); + log_dump(hwpcr, sizeof(hwpcr)); + + if (memcmp(pcr[i], hwpcr, sizeof(SHA_DIGEST_LENGTH)) != 0) { + log_err("PCRAgg %d does not match HW PCR-%d\n", i, i); + + verify_failed = true; + } } - err = 0; + if (!verify_failed) + err = 0; out: fclose(fp); - return err; } diff --git a/src/imaevm.h b/src/imaevm.h index f5cee7d..69d663c 100644 --- a/src/imaevm.h +++ b/src/imaevm.h @@ -188,6 +188,9 @@ struct RSA_ASN1_template { size_t size; }; +#define NUM_PCRS 20 +#define DEFAULT_PCR 10 + extern const struct RSA_ASN1_template RSA_ASN1_templates[PKEY_HASH__LAST]; extern struct libevm_params params;