dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 14:43:37 +02:00
Code Releases Activity

ima-evm-utils: increase the size of "zero" and "fox" variables

Browse Source 
Opening a file for write when it is already opened for read, results in
a time of measure, time of use (ToMToU) error.  Similarly, when opening
a file for read, when it is already opened for write, results in a file
measurement error.  These violations are flagged by including 0x00's as
the template digest in the measurement list, but extending the TPM with
0xFF's.

In preparation of extending the TPM banks with bank specific digest
values, increase the "zero" and "fox" variable sizes.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar 2020-02-19 06:46:46 -05:00
parent dc3897f011
commit bdc94c9b49
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/evmctl.c
View File

@ -1477,8 +1477,8 @@ struct template_entry {
int template_buf_len; int template_buf_len;
}; };
static uint8_t zero[SHA_DIGEST_LENGTH]; static uint8_t zero[MAX_DIGEST_SIZE];
static uint8_t fox[SHA_DIGEST_LENGTH]; static uint8_t fox[MAX_DIGEST_SIZE];
int validate = 1; int validate = 1;
@ -1499,7 +1499,7 @@ static int ima_verify_template_hash(struct template_entry *entry)
{ {
uint8_t digest[SHA_DIGEST_LENGTH]; uint8_t digest[SHA_DIGEST_LENGTH];
if (!memcmp(zero, entry->header.digest, sizeof(zero))) if (!memcmp(zero, entry->header.digest, sizeof(digest)))
return 0; return 0;
SHA1(entry->template, entry->template_len, digest); SHA1(entry->template, entry->template_len, digest);
@ -1658,8 +1658,8 @@ static int ima_measurement(const char *file)
int i; int i;
errno = 0; errno = 0;
memset(zero, 0, SHA_DIGEST_LENGTH); memset(zero, 0, MAX_DIGEST_SIZE);
memset(fox, 0xff, SHA_DIGEST_LENGTH); memset(fox, 0xff, MAX_DIGEST_SIZE);
log_debug("Initial PCR value: "); log_debug("Initial PCR value: ");
log_debug_dump(pcr, sizeof(pcr)); log_debug_dump(pcr, sizeof(pcr));