diff mbox series

[3/3] ima-evm-utils: support providing the TPM 1.2 PCRs as a file

Message ID 1594305396-21280-4-git-send-email-zohar@linux.ibm.com (mailing list archive)
State New, archived
Headers show
Series additional "ima-measurement" support | expand

Commit Message

Mimi Zohar July 9, 2020, 2:36 p.m. UTC 
"evmctl ima_measurement" walks the IMA measurement list calculating the
PCRs and verifies the calculated values against the system's PCRs.
Instead of reading the system's PCRs, provide the PCRs as a file.  For
TPM 1.2 the PCRs are exported via a securityfs file.

Verifying the IMA measurement list against the exported TPM 1.2 PCRs
file may be used remotely for regression testing.  If used in a
production environment, the provided TPM PCRs must be compared with
those included in the TPM 1.2 quote as well.

This patch defines an evmctl ima_measurement "--pcrs <filename>" option.

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 src/evmctl.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/src/evmctl.c b/src/evmctl.c
index 814aa6b75571..21ae1c7ca5a7 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
@@ -160,6 +160,8 @@  struct tpm_bank_info {
 	uint8_t pcr[NUM_PCRS][MAX_DIGEST_SIZE];
 };
 
+static char *pcrfile;
+
 static int bin2file(const char *file, const char *ext, const unsigned char *data, int len)
 {
 	FILE *fp;
@@ -1377,12 +1379,18 @@  static char *misc_pcrs = "/sys/class/misc/tpm0/device/pcrs";
 /* Read all of the TPM 1.2 PCRs */
 static int tpm_pcr_read(struct tpm_bank_info *tpm_banks, int len)
 {
-	FILE *fp;
+	FILE *fp = NULL;
 	char *p, pcr_str[7], buf[70]; /* length of the TPM string */
 	int result = -1;
 	int i = 0;
 
-	fp = fopen(pcrs, "r");
+	/* Use the provided TPM 1.2 pcrs file */
+	if (pcrfile)
+		fp = fopen(pcrfile, "r");
+
+	if (!fp)
+		fp = fopen(pcrs, "r");
+
 	if (!fp)
 		fp = fopen(misc_pcrs, "r");
 
@@ -2347,7 +2355,7 @@  struct command cmds[] = {
 	{"ima_verify", cmd_verify_ima, 0, "file", "Verify IMA signature (for debugging).\n"},
 	{"ima_setxattr", cmd_setxattr_ima, 0, "[--sigfile file]", "Set IMA signature from sigfile\n"},
 	{"ima_hash", cmd_hash_ima, 0, "file", "Make file content hash.\n"},
-	{"ima_measurement", cmd_ima_measurement, 0, "[--validate] [--verify] file", "Verify measurement list (experimental).\n"},
+	{"ima_measurement", cmd_ima_measurement, 0, "[--validate] [--verify] [--pcrs file] file", "Verify measurement list (experimental).\n"},
 	{"ima_boot_aggregate", cmd_ima_bootaggr, 0, "[file]", "Calculate per TPM bank boot_aggregate digests\n"},
 	{"ima_fix", cmd_ima_fix, 0, "[-t fdsxm] path", "Recursively fix IMA/EVM xattrs in fix mode.\n"},
 	{"ima_clear", cmd_ima_clear, 0, "[-t fdsxm] path", "Recursively remove IMA/EVM xattrs.\n"},
@@ -2388,6 +2396,7 @@  static struct option opts[] = {
 	{"xattr-user", 0, 0, 140},
 	{"validate", 0, 0, 141},
 	{"verify", 0, 0, 142},
+	{"pcrs", 1, 0, 143},
 	{}
 
 };
@@ -2572,6 +2581,9 @@  int main(int argc, char *argv[])
 		case 142: /* --verify */
 			verify = 1;
 			break;
+		case 143:
+			pcrfile = optarg;
+			break;
 		case '?':
 			exit(1);
 			break;