ima: do not include field length in template digest calc for ima template
To maintain compatibility with userspace tools, the field length must not
be included in the template digest calculation for the 'ima' template.
Fixes commit: a71dc65
ima: switch to new template management mechanism
Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
This commit is contained in:
parent
4c1cc40a2d
commit
b6f8f16f41
|
@ -97,7 +97,8 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
|
||||||
const char *op, struct inode *inode,
|
const char *op, struct inode *inode,
|
||||||
const unsigned char *filename);
|
const unsigned char *filename);
|
||||||
int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
|
int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash);
|
||||||
int ima_calc_field_array_hash(struct ima_field_data *field_data, int num_fields,
|
int ima_calc_field_array_hash(struct ima_field_data *field_data,
|
||||||
|
struct ima_template_desc *desc, int num_fields,
|
||||||
struct ima_digest_data *hash);
|
struct ima_digest_data *hash);
|
||||||
int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
|
int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
|
||||||
void ima_add_violation(struct file *file, const unsigned char *filename,
|
void ima_add_violation(struct file *file, const unsigned char *filename,
|
||||||
|
|
|
@ -94,6 +94,7 @@ int ima_store_template(struct ima_template_entry *entry,
|
||||||
/* this function uses default algo */
|
/* this function uses default algo */
|
||||||
hash.hdr.algo = HASH_ALGO_SHA1;
|
hash.hdr.algo = HASH_ALGO_SHA1;
|
||||||
result = ima_calc_field_array_hash(&entry->template_data[0],
|
result = ima_calc_field_array_hash(&entry->template_data[0],
|
||||||
|
entry->template_desc,
|
||||||
num_fields, &hash.hdr);
|
num_fields, &hash.hdr);
|
||||||
if (result < 0) {
|
if (result < 0) {
|
||||||
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
|
integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
|
||||||
|
|
|
@ -140,6 +140,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
|
||||||
* Calculate the hash of template data
|
* Calculate the hash of template data
|
||||||
*/
|
*/
|
||||||
static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
|
static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
|
||||||
|
struct ima_template_desc *td,
|
||||||
int num_fields,
|
int num_fields,
|
||||||
struct ima_digest_data *hash,
|
struct ima_digest_data *hash,
|
||||||
struct crypto_shash *tfm)
|
struct crypto_shash *tfm)
|
||||||
|
@ -160,9 +161,13 @@ static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
|
||||||
return rc;
|
return rc;
|
||||||
|
|
||||||
for (i = 0; i < num_fields; i++) {
|
for (i = 0; i < num_fields; i++) {
|
||||||
rc = crypto_shash_update(&desc.shash,
|
if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) {
|
||||||
(const u8 *) &field_data[i].len,
|
rc = crypto_shash_update(&desc.shash,
|
||||||
sizeof(field_data[i].len));
|
(const u8 *) &field_data[i].len,
|
||||||
|
sizeof(field_data[i].len));
|
||||||
|
if (rc)
|
||||||
|
break;
|
||||||
|
}
|
||||||
rc = crypto_shash_update(&desc.shash, field_data[i].data,
|
rc = crypto_shash_update(&desc.shash, field_data[i].data,
|
||||||
field_data[i].len);
|
field_data[i].len);
|
||||||
if (rc)
|
if (rc)
|
||||||
|
@ -175,7 +180,8 @@ static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
|
||||||
return rc;
|
return rc;
|
||||||
}
|
}
|
||||||
|
|
||||||
int ima_calc_field_array_hash(struct ima_field_data *field_data, int num_fields,
|
int ima_calc_field_array_hash(struct ima_field_data *field_data,
|
||||||
|
struct ima_template_desc *desc, int num_fields,
|
||||||
struct ima_digest_data *hash)
|
struct ima_digest_data *hash)
|
||||||
{
|
{
|
||||||
struct crypto_shash *tfm;
|
struct crypto_shash *tfm;
|
||||||
|
@ -185,7 +191,8 @@ int ima_calc_field_array_hash(struct ima_field_data *field_data, int num_fields,
|
||||||
if (IS_ERR(tfm))
|
if (IS_ERR(tfm))
|
||||||
return PTR_ERR(tfm);
|
return PTR_ERR(tfm);
|
||||||
|
|
||||||
rc = ima_calc_field_array_hash_tfm(field_data, num_fields, hash, tfm);
|
rc = ima_calc_field_array_hash_tfm(field_data, desc, num_fields,
|
||||||
|
hash, tfm);
|
||||||
|
|
||||||
ima_free_tfm(tfm);
|
ima_free_tfm(tfm);
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue