dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 06:33:36 +02:00
Code Releases Activity

Limit comparing the calculated PCR value to just a single bank

Browse Source 
TPM 2.0 banks may be extended either with a padded SHA1 hash or more
recently with a per TPM bank calculated hash.  If the measurement list
is carried across kexec, the original kernel might extend the TPM
differently than the new kernel.

Support for verifying a mixed IMA measurement list is not supported.  To
permit verifying just the SHA1 bank, specify "--verify-bank=sha1" on the
command line.

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar 2021-02-09 11:01:48 -05:00
parent d80b6d5a7d
commit 8cbf05fcde
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/evmctl.c
View File

@ -125,6 +125,7 @@ static char *caps_str;
static char *ima_str;
static char *selinux_str;
static char *search_type;
static char *verify_bank;
static int verify_list_sig;
static int recursive;
static int msize;
@ -2010,6 +2011,16 @@ static int ima_measurement(const char *file)
pseudo_banks_mask = (1 << num_banks) - 1;
pseudo_padded_banks_mask = pseudo_banks_mask;
/* Instead of verifying all the banks, only verify a single bank */
for (c = 0; c < num_banks; c++) {
if (verify_bank
&& strcmp(pseudo_padded_banks[c].algo_name, verify_bank)) {
pseudo_banks_mask ^= (1 << c);
pseudo_padded_banks_mask ^= (1 << c);
break;
}
}
while (fread(&entry.header, sizeof(entry.header), 1, fp)) {
entry_num++;
if (entry.header.name_len > TCG_EVENT_NAME_LEN_MAX) {
@ -2536,7 +2547,7 @@ struct command cmds[] = {
{"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"},
{"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"},
{"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"},
{"ima_measurement", cmd_ima_measurement, 0, "[--ignore-violations] [--verify-sig [--key key1, key2, ...]] [--pcrs [hash-algorithm,]file [--pcrs hash-algorithm,file] ...] file", "Verify measurement list (experimental).\n"},
{"ima_measurement", cmd_ima_measurement, 0, "[--ignore-violations] [--verify-sig [--key key1, key2, ...]] [--pcrs [hash-algorithm,]file [--pcrs hash-algorithm,file] ...] [--verify-bank hash-algorithm] file", "Verify measurement list (experimental).\n"},
{"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[--pcrs hash-algorithm,file] [TPM 1.2 BIOS event log]", "Calculate per TPM bank boot_aggregate digests\n"},
{"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"},
{"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"},
@ -2577,6 +2588,7 @@ static struct option opts[] = {
{"xattr-user", 0, 0, 140},
{"ignore-violations", 0, 0, 141},
{"pcrs", 1, 0, 142},
{"verify-bank", 2, 0, 143},
{}
};
@ -2765,6 +2777,9 @@ int main(int argc, char *argv[])
}
pcrfile[npcrfile++] = optarg;
break;
case 143:
verify_bank = optarg;
break;
case '?':
exit(1);
break;