From bdc94c9b49480c841a30736600939594678bbd54 Mon Sep 17 00:00:00 2001 From: Mimi Zohar Date: Wed, 19 Feb 2020 06:46:46 -0500 Subject: [PATCH] ima-evm-utils: increase the size of "zero" and "fox" variables Opening a file for write when it is already opened for read, results in a time of measure, time of use (ToMToU) error. Similarly, when opening a file for read, when it is already opened for write, results in a file measurement error. These violations are flagged by including 0x00's as the template digest in the measurement list, but extending the TPM with 0xFF's. In preparation of extending the TPM banks with bank specific digest values, increase the "zero" and "fox" variable sizes. Signed-off-by: Mimi Zohar --- src/evmctl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 74fe260..757af6c 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1477,8 +1477,8 @@ struct template_entry { int template_buf_len; }; -static uint8_t zero[SHA_DIGEST_LENGTH]; -static uint8_t fox[SHA_DIGEST_LENGTH]; +static uint8_t zero[MAX_DIGEST_SIZE]; +static uint8_t fox[MAX_DIGEST_SIZE]; int validate = 1; @@ -1499,7 +1499,7 @@ static int ima_verify_template_hash(struct template_entry *entry) { uint8_t digest[SHA_DIGEST_LENGTH]; - if (!memcmp(zero, entry->header.digest, sizeof(zero))) + if (!memcmp(zero, entry->header.digest, sizeof(digest))) return 0; SHA1(entry->template, entry->template_len, digest); @@ -1658,8 +1658,8 @@ static int ima_measurement(const char *file) int i; errno = 0; - memset(zero, 0, SHA_DIGEST_LENGTH); - memset(fox, 0xff, SHA_DIGEST_LENGTH); + memset(zero, 0, MAX_DIGEST_SIZE); + memset(fox, 0xff, MAX_DIGEST_SIZE); log_debug("Initial PCR value: "); log_debug_dump(pcr, sizeof(pcr));