• Roberto Sassu's avatar
    ima: Calculate and extend PCR with digests in ima_template_entry · 1ea973df
    Roberto Sassu authored
    This patch modifies ima_calc_field_array_hash() to calculate a template
    digest for each allocated PCR bank and SHA1. It also passes the tpm_digest
    array of the template entry to ima_pcr_extend() or in case of a violation,
    the pre-initialized digests array filled with 0xff.
    
    Padding with zeros is still done if the mapping between TPM algorithm ID
    and crypto ID is unknown.
    
    This patch calculates again the template digest when a measurement list is
    restored. Copying only the SHA1 digest (due to the limitation of the
    current measurement list format) is not sufficient, as hash collision
    detection will be done on the digest calculated with the IMA default hash
    algorithm.
    Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
    Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
    1ea973df
ima_template.c 12.5 KB