RE: [PATCH 2/2] ima: support calculating the boot_aggregate based on different TPM banks

[Roberto Sassu]

> -----Original Message-----
> From: Mimi Zohar [mailto:zohar@xxxxxxxxxxxxx]
> Sent: Tuesday, January 28, 2020 4:41 PM
> To: Roberto Sassu <roberto.sassu@xxxxxxxxxx>; linux-
> integrity@xxxxxxxxxxxxxxx
> Cc: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>; James Bottomley
> <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>; linux-
> kernel@xxxxxxxxxxxxxxx; Silviu Vlasceanu <Silviu.Vlasceanu@xxxxxxxxxx>
> Subject: Re: [PATCH 2/2] ima: support calculating the boot_aggregate based
> on different TPM banks
> 
> On Tue, 2020-01-28 at 14:19 +0000, Roberto Sassu wrote:
> > > -----Original Message-----
> > > From: linux-integrity-owner@xxxxxxxxxxxxxxx [mailto:linux-integrity-
> > > owner@xxxxxxxxxxxxxxx] On Behalf Of Mimi Zohar
> > > Sent: Monday, January 27, 2020 5:02 PM
> > > To: linux-integrity@xxxxxxxxxxxxxxx
> > > Cc: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>; James Bottomley
> > > <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>; linux-
> > > kernel@xxxxxxxxxxxxxxx; Mimi Zohar <zohar@xxxxxxxxxxxxx>
> > > Subject: [PATCH 2/2] ima: support calculating the boot_aggregate based
> on
> > > different TPM banks
> > >
> > > Calculating the boot_aggregate attempts to read the TPM SHA1 bank,
> > > assuming it is always enabled.  With TPM 2.0 hash agility, TPM chips
> > > could support multiple TPM PCR banks, allowing firmware to configure
> and
> > > enable different banks.
> > >
> > > Instead of hard coding the TPM 2.0 bank hash algorithm used for
> calculating
> > > the boot-aggregate, see if the configured IMA_DEFAULT_HASH
> algorithm is
> > > an allocated TPM bank, otherwise use the first allocated TPM bank.
> > >
> > > For TPM 1.2 SHA1 is the only supported hash algorithm.
> > >
> > > Reported-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
> > > Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxx>
> > > ---
> > >  security/integrity/ima/ima_crypto.c | 37
> > > ++++++++++++++++++++++++++++++++++++-
> > >  1 file changed, 36 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/security/integrity/ima/ima_crypto.c
> > > b/security/integrity/ima/ima_crypto.c
> > > index 7967a6904851..b1b26d61f174 100644
> > > --- a/security/integrity/ima/ima_crypto.c
> > > +++ b/security/integrity/ima/ima_crypto.c
> > > @@ -656,8 +656,25 @@ static void __init ima_pcrread(u32 idx, struct
> > > tpm_digest *d)
> > >  		pr_err("Error Communicating to TPM chip\n");
> > >  }
> > >
> > > +/* tpm2_hash_map is the same as defined in tpm2-cmd.c and
> > > trusted_tpm2.c */
> > > +static struct tpm2_hash tpm2_hash_map[] = {
> > > +	{HASH_ALGO_SHA1, TPM_ALG_SHA1},
> > > +	{HASH_ALGO_SHA256, TPM_ALG_SHA256},
> > > +	{HASH_ALGO_SHA384, TPM_ALG_SHA384},
> > > +	{HASH_ALGO_SHA512, TPM_ALG_SHA512},
> > > +	{HASH_ALGO_SM3_256, TPM_ALG_SM3_256},
> > > +};
> > > +
> > >  /*
> > > - * Calculate the boot aggregate hash
> > > + * The boot_aggregate is a cumulative hash over TPM registers 0 - 7.
> With
> > > + * TPM 2.0 hash agility, TPM chips could support multiple TPM PCR
> banks,
> > > + * allowing firmware to configure and enable different banks.
> > > + *
> > > + * Instead of hard coding the TPM bank hash algorithm used for
> calculating
> > > + * the boot-aggregate, see if the configured IMA_DEFAULT_HASH
> > > algorithm is
> > > + * an allocated TPM bank, otherwise use the first allocated TPM bank.
> > > + *
> > > + * For TPM 1.2 SHA1 is the only hash algorithm.
> > >   */
> > >  static int __init ima_calc_boot_aggregate_tfm(char *digest,
> > >  					      struct crypto_shash *tfm)
> > > @@ -673,6 +690,24 @@ static int __init
> ima_calc_boot_aggregate_tfm(char
> > > *digest,
> > >  	if (rc != 0)
> > >  		return rc;
> > >
> > > +	for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) {
> > > +		if (tpm2_hash_map[i].crypto_id == ima_hash_algo) {
> >
> > It is not necessary to define a new map. ima_tpm_chip->allocated_banks
> > has a crypto_id field.
> 
> Ok, thanks.

When you send the new version, please include patch 1/8 of my patch set,
that sets crypto_id to HASH_ALGO__LAST if there is no mapping between
TPM ID and crypto ID.

Thanks

Roberto

HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Li Jian, Shi Yanli