From patchwork Fri Feb 21 18:38:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11397179 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1A40314E3 for ; Fri, 21 Feb 2020 18:39:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0225B208E4 for ; Fri, 21 Feb 2020 18:39:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726408AbgBUSjM (ORCPT ); Fri, 21 Feb 2020 13:39:12 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:22056 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726066AbgBUSjM (ORCPT ); Fri, 21 Feb 2020 13:39:12 -0500 Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 01LIJqTK141542 for ; Fri, 21 Feb 2020 13:39:11 -0500 Received: from e06smtp04.uk.ibm.com (e06smtp04.uk.ibm.com [195.75.94.100]) by mx0b-001b2d01.pphosted.com with ESMTP id 2yadge8gyw-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Feb 2020 13:39:11 -0500 Received: from localhost by e06smtp04.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2020 18:39:09 -0000 Received: from b06cxnps3074.portsmouth.uk.ibm.com (9.149.109.194) by e06smtp04.uk.ibm.com (192.168.101.134) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 21 Feb 2020 18:39:08 -0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 01LId7oU62849096 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 21 Feb 2020 18:39:07 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 24E13AE045; Fri, 21 Feb 2020 18:39:07 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DBE28AE057; Fri, 21 Feb 2020 18:39:05 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.202.88]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 21 Feb 2020 18:39:05 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Roberto Sassu , Vitaly Chikunov , Patrick Uiterwijk , Petr Vorel , Mimi Zohar Subject: [RFC PATCH 1/8] ima-evm-utils: treat unallocated banks as an error Date: Fri, 21 Feb 2020 13:38:51 -0500 X-Mailer: git-send-email 2.7.5 In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> References: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 20022118-0016-0000-0000-000002E912E0 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20022118-0017-0000-0000-0000334C345C Message-Id: <1582310338-1562-2-git-send-email-zohar@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-02-21_06:2020-02-21,2020-02-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 mlxscore=0 priorityscore=1501 impostorscore=0 suspectscore=1 lowpriorityscore=0 phishscore=0 bulkscore=0 malwarescore=0 mlxlogscore=999 clxscore=1015 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002210140 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The TPM spec differentiates between an unknown bank and an unallocated bank. In terms of re-calculating the PCR, treat them as equivalent. Signed-off-by: Mimi Zohar --- src/evmctl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index be59ead45189..704615694cec 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1449,6 +1449,11 @@ static int tpm2_pcr_read(int idx, uint8_t *hwpcr, int len, char **errmsg) /* get the popen "cmd" return code */ ret = pclose(fp); + + /* Treat an unallocated bank as an error */ + if (!ret && (strlen(pcr) < SHA_DIGEST_LENGTH)) + ret = -1; + if (!ret) hex2bin(hwpcr, pcr, SHA_DIGEST_LENGTH); else From patchwork Fri Feb 21 18:38:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11397181 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C5D3114E3 for ; Fri, 21 Feb 2020 18:39:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id AE788222C4 for ; Fri, 21 Feb 2020 18:39:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726783AbgBUSjQ (ORCPT ); Fri, 21 Feb 2020 13:39:16 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:45364 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726066AbgBUSjQ (ORCPT ); Fri, 21 Feb 2020 13:39:16 -0500 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 01LIKcip109979 for ; Fri, 21 Feb 2020 13:39:14 -0500 Received: from e06smtp01.uk.ibm.com (e06smtp01.uk.ibm.com [195.75.94.97]) by mx0b-001b2d01.pphosted.com with ESMTP id 2y9tkdacwe-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Feb 2020 13:39:14 -0500 Received: from localhost by e06smtp01.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2020 18:39:12 -0000 Received: from b06cxnps4075.portsmouth.uk.ibm.com (9.149.109.197) by e06smtp01.uk.ibm.com (192.168.101.131) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 21 Feb 2020 18:39:09 -0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 01LId8DT45744364 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 21 Feb 2020 18:39:08 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6ECC7AE053; Fri, 21 Feb 2020 18:39:08 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 55238AE045; Fri, 21 Feb 2020 18:39:07 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.202.88]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 21 Feb 2020 18:39:07 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Roberto Sassu , Vitaly Chikunov , Patrick Uiterwijk , Petr Vorel , Mimi Zohar Subject: [RFC PATCH 2/8] ima-evm-utils: increase the size of "zero" and "fox" variables Date: Fri, 21 Feb 2020 13:38:52 -0500 X-Mailer: git-send-email 2.7.5 In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> References: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 20022118-4275-0000-0000-000003A443FB X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20022118-4276-0000-0000-000038B853EA Message-Id: <1582310338-1562-3-git-send-email-zohar@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-02-21_06:2020-02-21,2020-02-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 suspectscore=1 spamscore=0 malwarescore=0 adultscore=0 phishscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 mlxscore=0 mlxlogscore=918 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002210140 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Opening a file for write when it is already opened for read, results in a time of measure, time of use (ToMToU) error. Similarly, when opening a file for read, when it is already opened for write, results in a file measurement error. These violations are flagged by including 0x00's as the template digest in the measurement list, but extending the TPM with 0xFF's. In preparation of extending the TPM banks with bank specific digest values, increase the "zero" and "fox" variable sizes. Signed-off-by: Mimi Zohar --- src/evmctl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 704615694cec..9c8544a95b6a 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1477,8 +1477,8 @@ struct template_entry { int template_buf_len; }; -static uint8_t zero[SHA_DIGEST_LENGTH]; -static uint8_t fox[SHA_DIGEST_LENGTH]; +static uint8_t zero[MAX_DIGEST_SIZE]; +static uint8_t fox[MAX_DIGEST_SIZE]; int validate = 1; @@ -1499,7 +1499,7 @@ static int ima_verify_template_hash(struct template_entry *entry) { uint8_t digest[SHA_DIGEST_LENGTH]; - if (!memcmp(zero, entry->header.digest, sizeof(zero))) + if (!memcmp(zero, entry->header.digest, sizeof(digest))) return 0; SHA1(entry->template, entry->template_len, digest); @@ -1658,8 +1658,8 @@ static int ima_measurement(const char *file) int i; errno = 0; - memset(zero, 0, SHA_DIGEST_LENGTH); - memset(fox, 0xff, SHA_DIGEST_LENGTH); + memset(zero, 0, MAX_DIGEST_SIZE); + memset(fox, 0xff, MAX_DIGEST_SIZE); log_debug("Initial PCR value: "); log_debug_dump(pcr, sizeof(pcr)); From patchwork Fri Feb 21 18:38:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11397195 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 43D311580 for ; Fri, 21 Feb 2020 18:39:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2409E222C4 for ; Fri, 21 Feb 2020 18:39:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726494AbgBUSju (ORCPT ); Fri, 21 Feb 2020 13:39:50 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:65318 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729288AbgBUSju (ORCPT ); Fri, 21 Feb 2020 13:39:50 -0500 Received: from pps.filterd (m0098416.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 01LIdkrA186542 for ; Fri, 21 Feb 2020 13:39:49 -0500 Received: from e06smtp05.uk.ibm.com (e06smtp05.uk.ibm.com [195.75.94.101]) by mx0b-001b2d01.pphosted.com with ESMTP id 2y8ubycwum-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Feb 2020 13:39:48 -0500 Received: from localhost by e06smtp05.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2020 18:39:14 -0000 Received: from b06cxnps4076.portsmouth.uk.ibm.com (9.149.109.198) by e06smtp05.uk.ibm.com (192.168.101.135) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 21 Feb 2020 18:39:10 -0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 01LId9sZ42467454 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 21 Feb 2020 18:39:09 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id ACA32AE053; Fri, 21 Feb 2020 18:39:09 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9F5FDAE051; Fri, 21 Feb 2020 18:39:08 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.202.88]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 21 Feb 2020 18:39:08 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Roberto Sassu , Vitaly Chikunov , Patrick Uiterwijk , Petr Vorel , Mimi Zohar Subject: [RFC PATCH 3/8] ima-evm-utils: calculate the digests for multiple TPM banks Date: Fri, 21 Feb 2020 13:38:53 -0500 X-Mailer: git-send-email 2.7.5 In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> References: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 20022118-0020-0000-0000-000003AC6645 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20022118-0021-0000-0000-00002204717B Message-Id: <1582310338-1562-4-git-send-email-zohar@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-02-21_06:2020-02-21,2020-02-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 bulkscore=0 lowpriorityscore=0 spamscore=0 suspectscore=3 mlxlogscore=999 clxscore=1015 malwarescore=0 adultscore=0 impostorscore=0 phishscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002210141 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org IMA currently extends the different TPM banks by padding/truncating the SHA1 template digest. Although the IMA measurement list only includes the SHA1 template digest, the template digest could be re-calculated properly for each bank. This patch adds support for properly calculating the template hash for multiple TPM banks - "sha1" and "sha256". Signed-off-by: Mimi Zohar --- src/evmctl.c | 162 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 162 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index 9c8544a95b6a..61a0e15c8dd7 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -63,6 +63,7 @@ #include #include #include +#include "hash_info.h" #ifndef XATTR_APPAARMOR_SUFFIX #define XATTR_APPARMOR_SUFFIX "apparmor" @@ -1647,8 +1648,165 @@ void ima_ng_show(struct template_entry *entry) } } +struct tpm_bank_info { + int digest_size; + int supported; + const char *algo_name; + uint8_t digest[MAX_DIGEST_SIZE]; + uint8_t pcr[NUM_PCRS][MAX_DIGEST_SIZE]; +}; + +static void set_bank_info(struct tpm_bank_info *bank, const char *algo_name) +{ + const EVP_MD *md; + + bank->algo_name = algo_name; + md = EVP_get_digestbyname(bank->algo_name); + if (!md) + return; + + bank->supported = 1; + bank->digest_size = EVP_MD_size(md); +} + +static struct tpm_bank_info *init_tpm_banks(int *num_banks) +{ + struct tpm_bank_info *banks = NULL; + const char *default_algos[] = {"sha1", "sha256"}; + int num_algos = sizeof(default_algos) / sizeof(default_algos[0]); + int i, j; + + banks = calloc(num_algos, sizeof(struct tpm_bank_info)); + if (!banks) + return banks; + + /* re-calculate the PCRs digests for only known algorithms */ + *num_banks = num_algos; + for (i = 0; i < num_algos; i++) { + for (j = 0; j < HASH_ALGO__LAST; j++) { + if (!strcmp(default_algos[i], hash_algo_name[j])) + set_bank_info(&banks[i], hash_algo_name[j]); + } + } + return banks; +} + +/* Calculate the template hash for a particular hash algorithm */ +static int calculate_template_digest(EVP_MD_CTX *pctx, const EVP_MD *md, + struct template_entry *entry, + struct tpm_bank_info *bank) +{ + unsigned int mdlen; + int err; + + err = EVP_DigestInit(pctx, md); + if (!err) { + printf("EVP_DigestInit() failed\n"); + goto out; + } + + err = EVP_DigestUpdate(pctx, entry->template, entry->template_len); + if (!err) { + printf("EVP_DigestUpdate() failed\n"); + goto out; + } + + err = EVP_DigestFinal(pctx, bank->digest, &mdlen); + if (!err) + printf("EVP_DigestUpdate() failed\n"); +out: + if (!err) + err = 1; + return err; +} + +/* Extend a specific TPM bank with the template hash */ +static int extend_tpm_bank(EVP_MD_CTX *pctx, const EVP_MD *md, + struct template_entry *entry, + struct tpm_bank_info *bank) +{ + unsigned int mdlen; + int err; + + err = EVP_DigestInit(pctx, md); + if (!err) { + printf("EVP_DigestInit() failed\n"); + goto out; + } + + err = EVP_DigestUpdate(pctx, bank->pcr[entry->header.pcr], + bank->digest_size); + if (!err) { + printf("EVP_DigestUpdate() failed\n"); + goto out; + } + + if (validate && !memcmp(entry->header.digest, zero, SHA_DIGEST_LENGTH)) + err = EVP_DigestUpdate(pctx, fox, bank->digest_size); + else + err = EVP_DigestUpdate(pctx, bank->digest, bank->digest_size); + if (!err) { + printf("EVP_DigestUpdate() failed\n"); + goto out; + } + + err = EVP_DigestFinal(pctx, bank->pcr[entry->header.pcr], &mdlen); + if (!err) + printf("EVP_DigestFinal() failed\n"); + +out: + if (!err) + err = 1; + return err; +} + +/* Calculate and extend the template hash for multiple hash algorithms */ +static void extend_tpm_banks(struct template_entry *entry, int num_banks, + struct tpm_bank_info *bank) +{ + EVP_MD_CTX *pctx; + const EVP_MD *md; +#if OPENSSL_VERSION_NUMBER < 0x10100000 + EVP_MD_CTX ctx; + pctx = &ctx; +#else + pctx = EVP_MD_CTX_new(); +#endif + int err; + int i; + + for (i = 0; i < num_banks; i++) { + if (!bank[i].supported) + continue; + md = EVP_get_digestbyname(bank[i].algo_name); + if (!md) { + printf("EVP_get_digestbyname(%s) failed\n", + bank[i].algo_name); + bank[i].supported = 0; + continue; + } + + err = calculate_template_digest(pctx, md, entry, &bank[i]); + if (!err) { + bank[i].supported = 0; + continue; + } + + /* extend TPM BANK with template digest */ + err = extend_tpm_bank(pctx, md, entry, &bank[i]); + if (!err) + bank[i].supported = 0; + } +#if OPENSSL_VERSION_NUMBER >= 0x10100000 + EVP_MD_CTX_free(pctx); +#endif +} + static int ima_measurement(const char *file) { + struct tpm_bank_info *pseudo_banks; + int num_banks = 0; + uint8_t pcr[NUM_PCRS][SHA_DIGEST_LENGTH] = {{0}}; uint8_t hwpcr[SHA_DIGEST_LENGTH]; struct template_entry entry = { .template = 0 }; @@ -1664,6 +1822,8 @@ static int ima_measurement(const char *file) log_debug("Initial PCR value: "); log_debug_dump(pcr, sizeof(pcr)); + pseudo_banks = init_tpm_banks(&num_banks); + fp = fopen(file, "rb"); if (!fp) { log_err("Failed to open measurement file: %s\n", file); @@ -1702,6 +1862,8 @@ static int ima_measurement(const char *file) goto out; } + extend_tpm_banks(&entry, num_banks, pseudo_banks); + if (validate) ima_verify_template_hash(&entry); From patchwork Fri Feb 21 18:38:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11397183 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3D0BF1580 for ; Fri, 21 Feb 2020 18:39:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 267EB222C4 for ; Fri, 21 Feb 2020 18:39:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727656AbgBUSjR (ORCPT ); Fri, 21 Feb 2020 13:39:17 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:4346 "EHLO mx0b-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726066AbgBUSjR (ORCPT ); Fri, 21 Feb 2020 13:39:17 -0500 Received: from pps.filterd (m0127361.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 01LIO2oO094387 for ; Fri, 21 Feb 2020 13:39:16 -0500 Received: from e06smtp03.uk.ibm.com (e06smtp03.uk.ibm.com [195.75.94.99]) by mx0a-001b2d01.pphosted.com with ESMTP id 2y92xftskn-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Feb 2020 13:39:15 -0500 Received: from localhost by e06smtp03.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2020 18:39:13 -0000 Received: from b06avi18878370.portsmouth.uk.ibm.com (9.149.26.194) by e06smtp03.uk.ibm.com (192.168.101.133) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 21 Feb 2020 18:39:11 -0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 01LIdA2P43909470 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 21 Feb 2020 18:39:10 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CE6E7AE053; Fri, 21 Feb 2020 18:39:10 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DBC9FAE045; Fri, 21 Feb 2020 18:39:09 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.202.88]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 21 Feb 2020 18:39:09 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Roberto Sassu , Vitaly Chikunov , Patrick Uiterwijk , Petr Vorel , Mimi Zohar Subject: [RFC PATCH 4/8] ima-evm-utils: add support in tpm2_read_pcrs to read different TPM banks Date: Fri, 21 Feb 2020 13:38:54 -0500 X-Mailer: git-send-email 2.7.5 In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> References: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 20022118-0012-0000-0000-00000389153F X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20022118-0013-0000-0000-000021C5AFD2 Message-Id: <1582310338-1562-5-git-send-email-zohar@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-02-21_06:2020-02-21,2020-02-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 adultscore=0 clxscore=1015 lowpriorityscore=0 phishscore=0 bulkscore=0 spamscore=0 suspectscore=3 malwarescore=0 priorityscore=1501 impostorscore=0 mlxlogscore=940 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002210140 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org tpm2_read_pcrs() reads the sha1 PCRs in order to verify the measurmeent list. This patch adds support for reading other TPM banks. Signed-off-by: Mimi Zohar --- src/evmctl.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 61a0e15c8dd7..1eeab1d8268b 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1423,14 +1423,16 @@ static int tpm_pcr_read(int idx, uint8_t *pcr, int len) } #ifdef HAVE_TSSPCRREAD -static int tpm2_pcr_read(int idx, uint8_t *hwpcr, int len, char **errmsg) +static int tpm2_pcr_read(const char *algo_name, int idx, uint8_t *hwpcr, + int len, char **errmsg) { FILE *fp; char pcr[100]; /* may contain an error */ char cmd[50]; int ret; - sprintf(cmd, "tsspcrread -halg sha1 -ha %d -ns 2> /dev/null", idx); + sprintf(cmd, "tsspcrread -halg %s -ha %d -ns 2> /dev/null", + algo_name, idx); fp = popen(cmd, "r"); if (!fp) { ret = asprintf(errmsg, "popen failed: %s", strerror(errno)); @@ -1456,7 +1458,7 @@ static int tpm2_pcr_read(int idx, uint8_t *hwpcr, int len, char **errmsg) ret = -1; if (!ret) - hex2bin(hwpcr, pcr, SHA_DIGEST_LENGTH); + hex2bin(hwpcr, pcr, len); else *errmsg = strndup(pcr, strlen(pcr) - 1); /* remove newline */ @@ -1885,7 +1887,8 @@ static int ima_measurement(const char *file) #ifdef HAVE_TSSPCRREAD char *errmsg = NULL; - err = tpm2_pcr_read(i, hwpcr, sizeof(hwpcr), &errmsg); + err = tpm2_pcr_read("sha1", i, hwpcr, sizeof(hwpcr), + &errmsg); if (err) { log_info("Failed to read PCRs: (%s)\n", errmsg); free(errmsg); From patchwork Fri Feb 21 18:38:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11397185 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 267041580 for ; Fri, 21 Feb 2020 18:39:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0E1C0222C4 for ; Fri, 21 Feb 2020 18:39:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728759AbgBUSjT (ORCPT ); Fri, 21 Feb 2020 13:39:19 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:13224 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728442AbgBUSjT (ORCPT ); Fri, 21 Feb 2020 13:39:19 -0500 Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 01LIKGI0142204 for ; Fri, 21 Feb 2020 13:39:18 -0500 Received: from e06smtp07.uk.ibm.com (e06smtp07.uk.ibm.com [195.75.94.103]) by mx0a-001b2d01.pphosted.com with ESMTP id 2yafh946c2-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Feb 2020 13:39:18 -0500 Received: from localhost by e06smtp07.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2020 18:39:16 -0000 Received: from b06cxnps3075.portsmouth.uk.ibm.com (9.149.109.195) by e06smtp07.uk.ibm.com (192.168.101.137) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 21 Feb 2020 18:39:13 -0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 01LIdCl656426580 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 21 Feb 2020 18:39:12 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 49FE0AE04D; Fri, 21 Feb 2020 18:39:12 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 437C6AE045; Fri, 21 Feb 2020 18:39:11 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.202.88]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 21 Feb 2020 18:39:11 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Roberto Sassu , Vitaly Chikunov , Patrick Uiterwijk , Petr Vorel , Mimi Zohar Subject: [RFC PATCH 5/8] ima-evm-utils: read the PCRs for the requested TPM banks Date: Fri, 21 Feb 2020 13:38:55 -0500 X-Mailer: git-send-email 2.7.5 In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> References: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 20022118-0028-0000-0000-000003DCCA85 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20022118-0029-0000-0000-000024A1DABC Message-Id: <1582310338-1562-6-git-send-email-zohar@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-02-21_06:2020-02-21,2020-02-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxlogscore=999 suspectscore=3 lowpriorityscore=0 malwarescore=0 impostorscore=0 priorityscore=1501 phishscore=0 spamscore=0 adultscore=0 mlxscore=0 clxscore=1015 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002210140 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Read and store the PCRs for the requested banks to compare with the re-calculated PCR values. Signed-off-by: Mimi Zohar --- src/evmctl.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/src/evmctl.c b/src/evmctl.c index 1eeab1d8268b..3e512cf4e3d2 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1423,6 +1423,7 @@ static int tpm_pcr_read(int idx, uint8_t *pcr, int len) } #ifdef HAVE_TSSPCRREAD +static int tpm2_pcrread = 1; static int tpm2_pcr_read(const char *algo_name, int idx, uint8_t *hwpcr, int len, char **errmsg) { @@ -1464,6 +1465,13 @@ static int tpm2_pcr_read(const char *algo_name, int idx, uint8_t *hwpcr, return ret; } +#else +static int tpm2_pcrread = 0; +static int tpm2_pcr_read(const char *algo_name, int idx, uint8_t *hwpcr, + int len, char **errmsg) +{ + return -1; +} #endif #define TCG_EVENT_NAME_LEN_MAX 255 @@ -1804,9 +1812,47 @@ static void extend_tpm_banks(struct template_entry *entry, int num_banks, #endif } +/* + * Attempt to read TPM PCRs from the multiple TPM 2.0 banks. + * + * On success reading from any TPM bank, return 0. + */ +static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank) +{ + int tpm_enabled = 0; + char *errmsg = NULL; + int i, j; + int err; + + /* Any userspace applications available for reading TPM 2.0 PCRs? */ + if (!tpm2_pcrread) { + log_info("Failed to read TPM 2.0 PCRs\n"); + return 1; + } + + for (i = 0; i < num_banks; i++) { + err = 0; + for (j = 0; j < NUM_PCRS && !err; j++) { + err = tpm2_pcr_read(bank[i].algo_name, j, + bank[i].pcr[j], bank[i].digest_size, + &errmsg); + if (err) { + log_info("Failed to read %s PCRs: (%s)\n", + bank[i].algo_name, errmsg); + free(errmsg); + bank[i].supported = 0; + } + } + if (bank[i].supported) + tpm_enabled = 1; + } + return tpm_enabled ? 0 : 1; +} + static int ima_measurement(const char *file) { struct tpm_bank_info *pseudo_banks; + struct tpm_bank_info *tpm_banks; int num_banks = 0; uint8_t pcr[NUM_PCRS][SHA_DIGEST_LENGTH] = {{0}}; @@ -1825,6 +1871,7 @@ static int ima_measurement(const char *file) log_debug_dump(pcr, sizeof(pcr)); pseudo_banks = init_tpm_banks(&num_banks); + tpm_banks = init_tpm_banks(&num_banks); fp = fopen(file, "rb"); if (!fp) { @@ -1912,6 +1959,9 @@ static int ima_measurement(const char *file) if (!verify_failed) err = 0; + else + read_tpm_banks(num_banks, tpm_banks); + out: fclose(fp); return err; From patchwork Fri Feb 21 18:38:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11397187 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4757814E3 for ; Fri, 21 Feb 2020 18:39:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3097524672 for ; Fri, 21 Feb 2020 18:39:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728442AbgBUSjU (ORCPT ); Fri, 21 Feb 2020 13:39:20 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:18642 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726066AbgBUSjT (ORCPT ); Fri, 21 Feb 2020 13:39:19 -0500 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 01LIKciu109979 for ; Fri, 21 Feb 2020 13:39:18 -0500 Received: from e06smtp05.uk.ibm.com (e06smtp05.uk.ibm.com [195.75.94.101]) by mx0b-001b2d01.pphosted.com with ESMTP id 2y9tkdacy1-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Feb 2020 13:39:17 -0500 Received: from localhost by e06smtp05.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2020 18:39:16 -0000 Received: from b06cxnps4074.portsmouth.uk.ibm.com (9.149.109.196) by e06smtp05.uk.ibm.com (192.168.101.135) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 21 Feb 2020 18:39:14 -0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 01LIdD6952953326 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 21 Feb 2020 18:39:13 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8B6F4AE04D; Fri, 21 Feb 2020 18:39:13 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 79A39AE045; Fri, 21 Feb 2020 18:39:12 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.202.88]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 21 Feb 2020 18:39:12 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Roberto Sassu , Vitaly Chikunov , Patrick Uiterwijk , Petr Vorel , Mimi Zohar Subject: [RFC PATCH 6/8] ima-evm-utils: compare re-calculated PCRs with the TPM values Date: Fri, 21 Feb 2020 13:38:56 -0500 X-Mailer: git-send-email 2.7.5 In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> References: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 20022118-0020-0000-0000-000003AC6646 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20022118-0021-0000-0000-00002204717C Message-Id: <1582310338-1562-7-git-send-email-zohar@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-02-21_06:2020-02-21,2020-02-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 lowpriorityscore=0 suspectscore=1 spamscore=0 malwarescore=0 adultscore=0 phishscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 mlxscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002210140 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org After walking the measurement list, re-calculating and extending the TPM PCRs with the appropriate template digest for each bank, compare the re-calculated PCR values for each TPM bank with the actual TPM values. Signed-off-by: Mimi Zohar --- src/evmctl.c | 36 +++++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index 3e512cf4e3d2..9e21d3963556 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1701,6 +1701,38 @@ static struct tpm_bank_info *init_tpm_banks(int *num_banks) return banks; } +static int compare_tpm_banks(int num_banks, struct tpm_bank_info *bank, + struct tpm_bank_info *tpm_bank) +{ + int i, j; + int ret = 0; + + for (i = 0; i < num_banks; i++) { + if (!bank[i].supported || !tpm_bank[i].supported) + continue; + for (j = 0; j < NUM_PCRS; j++) { + if (memcmp(bank[i].pcr[j], zero, bank[i].digest_size) + == 0) + continue; + log_info("%s: PCRAgg %d: ", bank[i].algo_name, j); + log_dump(bank[i].pcr[j], bank[i].digest_size); + + log_info("%s: TPM PCR-%d: ", tpm_bank[i].algo_name, j); + log_dump(tpm_bank[i].pcr[j], tpm_bank[i].digest_size); + + ret = memcmp(bank[i].pcr[j], tpm_bank[i].pcr[j], + bank[i].digest_size); + if (!ret) + log_info("%s PCR-%d: succeed\n", + bank[i].algo_name, j); + else + log_info("%s: PCRAgg %d does not match TPM PCR-%d\n", + bank[i].algo_name, i, i); + } + } + return ret; +} + /* Calculate the template hash for a particular hash algorithm */ static int calculate_template_digest(EVP_MD_CTX *pctx, const EVP_MD *md, struct template_entry *entry, @@ -1959,8 +1991,10 @@ static int ima_measurement(const char *file) if (!verify_failed) err = 0; + else if (read_tpm_banks(num_banks, tpm_banks) != 0) + log_info("Failed to read TPM 2.0 PCRs\n"); else - read_tpm_banks(num_banks, tpm_banks); + err = compare_tpm_banks(num_banks, pseudo_banks, tpm_banks); out: fclose(fp); From patchwork Fri Feb 21 18:38:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11397191 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E6BAB14E3 for ; Fri, 21 Feb 2020 18:39:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CE551222C4 for ; Fri, 21 Feb 2020 18:39:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729305AbgBUSjt (ORCPT ); Fri, 21 Feb 2020 13:39:49 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:20572 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726066AbgBUSjt (ORCPT ); Fri, 21 Feb 2020 13:39:49 -0500 Received: from pps.filterd (m0098394.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 01LIdjcl036658 for ; Fri, 21 Feb 2020 13:39:48 -0500 Received: from e06smtp05.uk.ibm.com (e06smtp05.uk.ibm.com [195.75.94.101]) by mx0a-001b2d01.pphosted.com with ESMTP id 2y8ubwnsxm-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Feb 2020 13:39:47 -0500 Received: from localhost by e06smtp05.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2020 18:39:18 -0000 Received: from b06cxnps3074.portsmouth.uk.ibm.com (9.149.109.194) by e06smtp05.uk.ibm.com (192.168.101.135) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 21 Feb 2020 18:39:15 -0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 01LIdEXd50725062 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 21 Feb 2020 18:39:14 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9FB20AE045; Fri, 21 Feb 2020 18:39:14 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BC8A9AE04D; Fri, 21 Feb 2020 18:39:13 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.202.88]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 21 Feb 2020 18:39:13 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Roberto Sassu , Vitaly Chikunov , Patrick Uiterwijk , Petr Vorel , Mimi Zohar Subject: [RFC PATCH 7/8] ima-evm-utils: use a common bank variable for TPM 1.2 and TPM 2.0 Date: Fri, 21 Feb 2020 13:38:57 -0500 X-Mailer: git-send-email 2.7.5 In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> References: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 20022118-0020-0000-0000-000003AC6647 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20022118-0021-0000-0000-00002204717D Message-Id: <1582310338-1562-8-git-send-email-zohar@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-02-21_06:2020-02-21,2020-02-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 phishscore=0 spamscore=0 priorityscore=1501 mlxlogscore=999 bulkscore=0 malwarescore=0 lowpriorityscore=0 clxscore=1015 adultscore=0 mlxscore=0 suspectscore=3 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002210141 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Extend read_tpm_banks() to support TPM 1.2, by reading TPM 1.2 SHA1 PCRs into the first bank and mark the other banks as disabled. Signed-off-by: Mimi Zohar --- src/evmctl.c | 37 ++++++++++++++++++++++++++++++------- 1 file changed, 30 insertions(+), 7 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 9e21d3963556..49ce7ea2ce1a 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1399,7 +1399,7 @@ static int tpm_pcr_read(int idx, uint8_t *pcr, int len) char *p, pcr_str[7], buf[70]; /* length of the TPM string */ int result = -1; - sprintf(pcr_str, "PCR-%d", idx); + sprintf(pcr_str, "PCR-%2.2d", idx); fp = fopen(pcrs, "r"); if (!fp) @@ -1844,8 +1844,26 @@ static void extend_tpm_banks(struct template_entry *entry, int num_banks, #endif } +/* Read TPM 1.2 PCRs */ +static int read_tpm_pcrs(int num_banks, struct tpm_bank_info *tpm_banks) +{ + int i; + + for (i = 0; i < NUM_PCRS; i++) { + if (tpm_pcr_read(i, tpm_banks[0].pcr[i], SHA_DIGEST_LENGTH)) { + log_debug("Failed to read TPM 1.2 PCRs.\n"); + return -1; + } + } + + tpm_banks[0].supported = 1; + for (i = 1; i < num_banks; i++) + tpm_banks[i].supported = 0; + return 0; +} + /* - * Attempt to read TPM PCRs from the multiple TPM 2.0 banks. + * Attempt to read TPM PCRs from either TPM 1.2 or multiple TPM 2.0 banks. * * On success reading from any TPM bank, return 0. */ @@ -1856,12 +1874,17 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank) int i, j; int err; + /* First try reading PCRs from exported TPM 1.2 securityfs file */ + if (read_tpm_pcrs(num_banks, bank) == 0) + return 0; + /* Any userspace applications available for reading TPM 2.0 PCRs? */ if (!tpm2_pcrread) { - log_info("Failed to read TPM 2.0 PCRs\n"); + log_debug("Failed to read TPM 2.0 PCRs\n"); return 1; } + /* Read PCRs from multiple TPM 2.0 banks */ for (i = 0; i < num_banks; i++) { err = 0; for (j = 0; j < NUM_PCRS && !err; j++) { @@ -1869,8 +1892,8 @@ static int read_tpm_banks(int num_banks, struct tpm_bank_info *bank) bank[i].pcr[j], bank[i].digest_size, &errmsg); if (err) { - log_info("Failed to read %s PCRs: (%s)\n", - bank[i].algo_name, errmsg); + log_debug("Failed to read %s PCRs: (%s)\n", + bank[i].algo_name, errmsg); free(errmsg); bank[i].supported = 0; } @@ -1991,8 +2014,8 @@ static int ima_measurement(const char *file) if (!verify_failed) err = 0; - else if (read_tpm_banks(num_banks, tpm_banks) != 0) - log_info("Failed to read TPM 2.0 PCRs\n"); + if (read_tpm_banks(num_banks, tpm_banks) != 0) + log_info("Failed to read any TPM PCRs\n"); else err = compare_tpm_banks(num_banks, pseudo_banks, tpm_banks); From patchwork Fri Feb 21 18:38:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mimi Zohar X-Patchwork-Id: 11397189 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3C4D61580 for ; Fri, 21 Feb 2020 18:39:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 21C8C222C4 for ; Fri, 21 Feb 2020 18:39:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729269AbgBUSjV (ORCPT ); Fri, 21 Feb 2020 13:39:21 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:32536 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726066AbgBUSjV (ORCPT ); Fri, 21 Feb 2020 13:39:21 -0500 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 01LILxM5105671 for ; Fri, 21 Feb 2020 13:39:20 -0500 Received: from e06smtp01.uk.ibm.com (e06smtp01.uk.ibm.com [195.75.94.97]) by mx0a-001b2d01.pphosted.com with ESMTP id 2y9sbvsv5g-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Feb 2020 13:39:20 -0500 Received: from localhost by e06smtp01.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Feb 2020 18:39:18 -0000 Received: from b06cxnps4075.portsmouth.uk.ibm.com (9.149.109.197) by e06smtp01.uk.ibm.com (192.168.101.131) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Fri, 21 Feb 2020 18:39:16 -0000 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 01LIdFhH57475178 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 21 Feb 2020 18:39:15 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C3965AE045; Fri, 21 Feb 2020 18:39:15 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CFD08AE04D; Fri, 21 Feb 2020 18:39:14 +0000 (GMT) Received: from localhost.localdomain (unknown [9.85.202.88]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Fri, 21 Feb 2020 18:39:14 +0000 (GMT) From: Mimi Zohar To: linux-integrity@vger.kernel.org Cc: Roberto Sassu , Vitaly Chikunov , Patrick Uiterwijk , Petr Vorel , Mimi Zohar Subject: [RFC PATCH 8/8] ima-evm-utils: remove TPM 1.2 specific code Date: Fri, 21 Feb 2020 13:38:58 -0500 X-Mailer: git-send-email 2.7.5 In-Reply-To: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> References: <1582310338-1562-1-git-send-email-zohar@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 20022118-4275-0000-0000-000003A443FC X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 20022118-4276-0000-0000-000038B853EB Message-Id: <1582310338-1562-9-git-send-email-zohar@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572 definitions=2020-02-21_06:2020-02-21,2020-02-21 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 phishscore=0 mlxscore=0 malwarescore=0 bulkscore=0 mlxlogscore=999 impostorscore=0 priorityscore=1501 lowpriorityscore=0 adultscore=0 suspectscore=4 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002210140 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Now that read_tpm_banks() reads the TPM 1.2 PCRs, remove the TPM 1.2 specific code for reading and verifying the SHA1 PCRs. Signed-off-by: Mimi Zohar --- src/evmctl.c | 64 +++--------------------------------------------------------- 1 file changed, 3 insertions(+), 61 deletions(-) diff --git a/src/evmctl.c b/src/evmctl.c index 49ce7ea2ce1a..b6b9d19749e6 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1493,19 +1493,6 @@ static uint8_t fox[MAX_DIGEST_SIZE]; int validate = 1; -void ima_extend_pcr(uint8_t *pcr, uint8_t *digest, int length) -{ - SHA_CTX ctx; - - SHA1_Init(&ctx); - SHA1_Update(&ctx, pcr, length); - if (validate && !memcmp(digest, zero, length)) - SHA1_Update(&ctx, fox, length); - else - SHA1_Update(&ctx, digest, length); - SHA1_Final(pcr, &ctx); -} - static int ima_verify_template_hash(struct template_entry *entry) { uint8_t digest[SHA_DIGEST_LENGTH]; @@ -1910,21 +1897,14 @@ static int ima_measurement(const char *file) struct tpm_bank_info *tpm_banks; int num_banks = 0; - uint8_t pcr[NUM_PCRS][SHA_DIGEST_LENGTH] = {{0}}; - uint8_t hwpcr[SHA_DIGEST_LENGTH]; struct template_entry entry = { .template = 0 }; FILE *fp; int err = -1; - bool verify_failed = false; - int i; errno = 0; memset(zero, 0, MAX_DIGEST_SIZE); memset(fox, 0xff, MAX_DIGEST_SIZE); - log_debug("Initial PCR value: "); - log_debug_dump(pcr, sizeof(pcr)); - pseudo_banks = init_tpm_banks(&num_banks); tpm_banks = init_tpm_banks(&num_banks); @@ -1940,9 +1920,6 @@ static int ima_measurement(const char *file) init_public_keys("/etc/keys/x509_evm.der"); while (fread(&entry.header, sizeof(entry.header), 1, fp)) { - ima_extend_pcr(pcr[entry.header.pcr], entry.header.digest, - SHA_DIGEST_LENGTH); - if (!fread(entry.name, entry.header.name_len, 1, fp)) { log_err("Unable to read template name\n"); goto out; @@ -1977,47 +1954,12 @@ static int ima_measurement(const char *file) ima_ng_show(&entry); } - - for (i = 0; i < NUM_PCRS; i++) { - if (memcmp(pcr[i], zero, SHA_DIGEST_LENGTH) == 0) - continue; - - log_info("PCRAgg %.2d: ", i); - log_dump(pcr[i], SHA_DIGEST_LENGTH); - - if (tpm_pcr_read(i, hwpcr, sizeof(hwpcr))) { -#ifdef HAVE_TSSPCRREAD - char *errmsg = NULL; - - err = tpm2_pcr_read("sha1", i, hwpcr, sizeof(hwpcr), - &errmsg); - if (err) { - log_info("Failed to read PCRs: (%s)\n", errmsg); - free(errmsg); - exit(1); - } -#else - log_info("Failed to read TPM 1.2 PCRs.\n"); - exit(1); -#endif - } - - log_info("HW PCR-%d: ", i); - log_dump(hwpcr, sizeof(hwpcr)); - - if (memcmp(pcr[i], hwpcr, sizeof(SHA_DIGEST_LENGTH)) != 0) { - log_err("PCRAgg %d does not match HW PCR-%d\n", i, i); - - verify_failed = true; - } - } - - if (!verify_failed) + if (read_tpm_banks(num_banks, tpm_banks) != 0) { err = 0; - if (read_tpm_banks(num_banks, tpm_banks) != 0) log_info("Failed to read any TPM PCRs\n"); - else + } else { err = compare_tpm_banks(num_banks, pseudo_banks, tpm_banks); + } out: fclose(fp);