RE: [PATCH v2 2/8] ima: Switch to ima_hash_algo for boot aggregate

[Roberto Sassu]

> -----Original Message-----
> From: Mimi Zohar [mailto:zohar@xxxxxxxxxxxxx]
> Sent: Thursday, February 6, 2020 1:17 PM
> To: Roberto Sassu <roberto.sassu@xxxxxxxxxx>;
> James.Bottomley@xxxxxxxxxxxxxxxxxxxxx;
> jarkko.sakkinen@xxxxxxxxxxxxxxx
> Cc: linux-integrity@xxxxxxxxxxxxxxx; linux-security-module@xxxxxxxxxxxxxxx;
> linux-kernel@xxxxxxxxxxxxxxx; Silviu Vlasceanu
> <Silviu.Vlasceanu@xxxxxxxxxx>; stable@xxxxxxxxxxxxxxx
> Subject: Re: [PATCH v2 2/8] ima: Switch to ima_hash_algo for boot
> aggregate
> 
> On Thu, 2020-02-06 at 09:36 +0000, Roberto Sassu wrote:
> > > Hi Roberto,
> > >
> > > On Wed, 2020-02-05 at 11:33 +0100, Roberto Sassu wrote:
> > >
> > > <snip>
> > >
> > > > Reported-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
> > > > Suggested-by: James Bottomley
> > > <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>
> > > > Signed-off-by: Roberto Sassu <roberto.sassu@xxxxxxxxxx>
> > > > Cc: stable@xxxxxxxxxxxxxxx
> > >
> > > Cc'ing stable resulted in Sasha's automated message.ÂÂIf you're going
> > > to Cc stable, then please include the stable kernel release (e.g. Cc:
> > > stable@xxxxxxxxxxxxxxx # v5.3). ÂAlso please include a "Fixes" tag.
> > > ÂNormally only bug fixes are backported.
> >
> > Ok, will add the kernel version. I also thought which commit I should
> > mention in the Fixes tag. IMA always read the SHA1 bank from the
> > beginning. I could mention the patch that introduces the new API
> > to read other banks, but I'm not sure. What do you think?
> 
> This patch is dependent on nr_allocated_banks. ÂPlease try applying
> this patch to the earliest stable kernel with the commit that
> introduces nr_allocated_banks and test to make sure it works properly.

It also depends on 879b589210a9 ("tpm: retrieve digest size of unknown"
algorithms with PCR read") which exported the mapping between TPM
algorithm ID and crypto ID, and changed the definition of tpm_pcr_read()
to read non-SHA1 PCR banks. It requires many patches, so backporting it
is not a trivial task. I think the earliest kernel this patch can be backported to
is 5.1.

Roberto