| Message ID | 1591376548.5816.14.camel@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [GIT,PULL] integrity subsystem updates for v5.8 | expand |
The pull request you sent on Fri, 05 Jun 2020 13:02:28 -0400:
> git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git tags/integrity-v5.8
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/3c0ad98c2eda5ff30d23777e30744be6f7b8f097
Thank you!
On Fri, Jun 5, 2020 at 10:03 AM Mimi Zohar <zohar@linux.ibm.com> wrote: > > The main changes are extending the TPM 2.0 PCR banks with bank > specific file hashes, calculating the "boot_aggregate" based on other > TPM PCR banks, using the default IMA hash algorithm, instead of SHA1, > as the basis for the cache hash table key, and preventing the mprotect > syscall to circumvent an IMA mmap appraise policy rule. I'm not sure why I didn't notice this during my test builds, but this results in a new warning: WARNING: modpost: vmlinux.o(.text+0x496264): Section mismatch in reference from the function ima_calc_boot_aggregate() to the function .init.text:ima_pcrread() The function ima_calc_boot_aggregate() references the function __init ima_pcrread(). This is often because ima_calc_boot_aggregate lacks a __init annotation or the annotation of ima_pcrread is wrong. and I think the warning is real - and the problem is real, not just a missing annotation. It looks like ima_calc_boot_aggregate() may be called not only at init time (ima_eventdigest_init() is referenced from "struct ima_template_field supported_fields[]", for example) So calling an __init function would be very wrong, because it might be gone by that time. Hmm? Linus
> From: linux-integrity-owner@vger.kernel.org [mailto:linux-integrity- > owner@vger.kernel.org] On Behalf Of Linus Torvalds > Sent: Sunday, June 7, 2020 9:59 PM > On Fri, Jun 5, 2020 at 10:03 AM Mimi Zohar <zohar@linux.ibm.com> wrote: > > > > The main changes are extending the TPM 2.0 PCR banks with bank > > specific file hashes, calculating the "boot_aggregate" based on other > > TPM PCR banks, using the default IMA hash algorithm, instead of SHA1, > > as the basis for the cache hash table key, and preventing the mprotect > > syscall to circumvent an IMA mmap appraise policy rule. > > I'm not sure why I didn't notice this during my test builds, but this > results in a new warning: > > WARNING: modpost: vmlinux.o(.text+0x496264): Section mismatch in > reference from the function ima_calc_boot_aggregate() to the function > .init.text:ima_pcrread() > The function ima_calc_boot_aggregate() references > the function __init ima_pcrread(). > This is often because ima_calc_boot_aggregate lacks a __init > annotation or the annotation of ima_pcrread is wrong. > > and I think the warning is real - and the problem is real, not just a > missing annotation. > > It looks like ima_calc_boot_aggregate() may be called not only at init > time (ima_eventdigest_init() is referenced from "struct > ima_template_field supported_fields[]", for example) > > So calling an __init function would be very wrong, because it might be > gone by that time. > > Hmm? Right, I also missed it. Will send a patch soon. Roberto HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Li Jian, Shi Yanli
Hi Linus, The main changes are extending the TPM 2.0 PCR banks with bank specific file hashes, calculating the "boot_aggregate" based on other TPM PCR banks, using the default IMA hash algorithm, instead of SHA1, as the basis for the cache hash table key, and preventing the mprotect syscall to circumvent an IMA mmap appraise policy rule. - In preparation for extending TPM 2.0 PCR banks with bank specific digests, commit 0b6cf6b97b7e ("tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()") modified tpm_pcr_extend(). The original SHA1 file digests were padded/truncated, before being extended into the other TPM PCR banks. This pull request calculates and extends the TPM PCR banks with bank specific file hashes completing the above change. - The "boot_aggregate", the first IMA measurement list record, is the "trusted boot" link between the pre-boot environment and the running OS. With TPM 2.0, the "boot_aggregate" record is not limited to being based on the SHA1 TPM PCR bank, but can be calculated based on any enabled bank, assuming the hash algorithm is also enabled in the kernel. Other changes include the following and five other bug fixes/code clean up: - supporting both a SHA1 and a larger "boot_aggregate" digest in a custom template format containing both the the SHA1 ('d') and larger digests ('d-ng') fields. - Initial hash table key fix, but additional changes would be good. thanks, Mimi The following changes since commit ae83d0b416db002fe95601e7f97f64b59514d936: Linux 5.7-rc2 (2020-04-19 14:35:30 -0700) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git tags/integrity-v5.8 for you to fetch changes up to 42413b49804b250ced70dac8815388af2d4ad872: ima: Directly free *entry in ima_alloc_init_template() if digests is NULL (2020-06-05 06:04:11 -0400) ---------------------------------------------------------------- integrity-v5.8 ---------------------------------------------------------------- Krzysztof Struczynski (3): ima: Fix ima digest hash table key calculation ima: Remove redundant policy rule set in add_rules() ima: Set again build_ima_appraise variable Mimi Zohar (1): ima: verify mprotect change is consistent with mmap policy Roberto Sassu (11): ima: Switch to ima_hash_algo for boot aggregate ima: Evaluate error in init_ima() ima: Store template digest directly in ima_template_entry ima: Switch to dynamically allocated buffer for template digests ima: Allocate and initialize tfm for each PCR bank ima: Calculate and extend PCR with digests in ima_template_entry ima: Use ima_hash_algo for collision detection in the measurement list evm: Fix possible memory leak in evm_calc_hmac_or_hash() ima: Directly assign the ima_default_policy pointer to ima_rules ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init() ima: Directly free *entry in ima_alloc_init_template() if digests is NULL include/linux/ima.h | 7 + security/integrity/evm/evm_crypto.c | 2 +- security/integrity/ima/ima.h | 20 ++- security/integrity/ima/ima_api.c | 23 +-- security/integrity/ima/ima_crypto.c | 252 +++++++++++++++++++++++++----- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_init.c | 24 ++- security/integrity/ima/ima_main.c | 54 +++++++ security/integrity/ima/ima_policy.c | 12 +- security/integrity/ima/ima_queue.c | 36 +++-- security/integrity/ima/ima_template.c | 25 ++- security/integrity/ima/ima_template_lib.c | 18 +++ security/security.c | 7 +- 13 files changed, 397 insertions(+), 87 deletions(-)