RE: [PATCH v3 2/2] ima: support calculating the boot_aggregate based on different TPM banks

From: Roberto Sassu
Date: Thu Jan 30 2020 - 11:54:50 EST


> -----Original Message-----
> From: linux-integrity-owner@xxxxxxxxxxxxxxx [mailto:linux-integrity-
> owner@xxxxxxxxxxxxxxx] On Behalf Of Mimi Zohar
> Sent: Thursday, January 30, 2020 5:23 PM
> To: linux-integrity@xxxxxxxxxxxxxxx
> Cc: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>; James Bottomley
> <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>; linux-
> kernel@xxxxxxxxxxxxxxx; Mimi Zohar <zohar@xxxxxxxxxxxxx>
> Subject: [PATCH v3 2/2] ima: support calculating the boot_aggregate based
> on different TPM banks
>
> Calculating the boot_aggregate attempts to read the TPM SHA1 bank,
> assuming it is always enabled. With TPM 2.0 hash agility, TPM chips
> could support multiple TPM PCR banks, allowing firmware to configure and
> enable different banks.
>
> Instead of hard coding the TPM 2.0 bank hash algorithm used for calculating
> the boot-aggregate, use the same hash algorithm for reading the TPM PCRs
> as
> for calculating the boot aggregate digest. Preference is given to the
> configured IMA default hash algorithm.
>
> For TPM 1.2 SHA1 is the only supported hash algorithm.
>
> Reported-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
> Suggested-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
> Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxx>
> ---
> security/integrity/ima/ima_crypto.c | 45
> ++++++++++++++++++++++++++++++++++++-
> 1 file changed, 44 insertions(+), 1 deletion(-)
>
> diff --git a/security/integrity/ima/ima_crypto.c
> b/security/integrity/ima/ima_crypto.c
> index 7967a6904851..a020aaefdea8 100644
> --- a/security/integrity/ima/ima_crypto.c
> +++ b/security/integrity/ima/ima_crypto.c
> @@ -656,13 +656,34 @@ static void __init ima_pcrread(u32 idx, struct
> tpm_digest *d)
> pr_err("Error Communicating to TPM chip\n");
> }
>
> +static enum hash_algo get_hash_algo(const char *algname)
> +{
> + int i;
> +
> + for (i = 0; i < HASH_ALGO__LAST; i++) {
> + if (strcmp(algname, hash_algo_name[i]) == 0)
> + break;
> + }
> +
> + return i;
> +}
> +
> /*
> - * Calculate the boot aggregate hash
> + * The boot_aggregate is a cumulative hash over TPM registers 0 - 7. With
> + * TPM 1.2 the boot_aggregate was based on reading the SHA1 PCRs, but
> with
> + * TPM 2.0 hash agility, TPM chips could support multiple TPM PCR banks,
> + * allowing firmware to configure and enable different banks.
> + *
> + * Knowing which TPM bank is read to calculate the boot_aggregate digest
> + * needs to be conveyed to a verifier. For this reason, use the same
> + * hash algorithm for reading the TPM PCRs as for calculating the boot
> + * aggregate digest as stored in the measurement list.
> */
> static int __init ima_calc_boot_aggregate_tfm(char *digest,
> struct crypto_shash *tfm)
> {
> struct tpm_digest d = { .alg_id = TPM_ALG_SHA1, .digest = {0} };
> + enum hash_algo crypto_id;
> int rc;
> u32 i;
> SHASH_DESC_ON_STACK(shash, tfm);
> @@ -673,6 +694,28 @@ static int __init ima_calc_boot_aggregate_tfm(char
> *digest,
> if (rc != 0)
> return rc;
>
> + crypto_id = get_hash_algo(crypto_shash_alg_name(tfm));

Wouldn't be better to determine the index of ima_tpm_chip->allocated_banks
in patch 1/2 and pass that index here, to avoid another search?

Roberto

HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Li Jian, Shi Yanli