xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()

Browse Source 
If the template field 'd' is chosen and the digest to be added to the
measurement entry was not calculated with SHA1 or MD5, it is
recalculated with SHA1, by using the passed file descriptor. However, this
cannot be done for boot_aggregate, because there is no file descriptor.

This patch adds a call to ima_calc_boot_aggregate() in
ima_eventdigest_init(), so that the digest can be recalculated also for the
boot_aggregate entry.

Cc: stable@vger.kernel.org # 3.13.x
Fixes: 3ce1217d6c ("ima: define template fields library and new helpers")
Reported-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Roberto Sassu
2020-06-03 17:08:21 +02:00
committed by Mimi Zohar
parent 067a436b1b
commit 6cc7c266e5
4 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
security/integrity/ima/ima_template_lib.c
View File

@@ -286,6 +286,24 @@ int ima_eventdigest_init(struct ima_event_data *event_data,
goto out;
}
if ((const char *)event_data->filename == boot_aggregate_name) {
if (ima_tpm_chip) {
hash.hdr.algo = HASH_ALGO_SHA1;
result = ima_calc_boot_aggregate(&hash.hdr);
/* algo can change depending on available PCR banks */
if (!result && hash.hdr.algo != HASH_ALGO_SHA1)
result = -EINVAL;
if (result < 0)
memset(&hash, 0, sizeof(hash));
}
cur_digest = hash.hdr.digest;
cur_digestsize = hash_digest_size[HASH_ALGO_SHA1];
goto out;
}
if (!event_data->file) /* missing info to re-calculate the digest */
return -EINVAL;