• Mimi Zohar's avatar
    ima: enable support for larger default filedata hash algorithms · e7a2ad7e
    Mimi Zohar authored
    The IMA measurement list contains two hashes - a template data hash
    and a filedata hash.  The template data hash is committed to the TPM,
    which is limited, by the TPM v1.2 specification, to 20 bytes.  The
    filedata hash is defined as 20 bytes as well.
    
    Now that support for variable length measurement list templates was
    added, the filedata hash is not limited to 20 bytes.  This patch adds
    Kconfig support for defining larger default filedata hash algorithms
    and replacing the builtin default with one specified on the kernel
    command line.
    
    <uapi/linux/hash_info.h> contains a list of hash algorithms.  The
    Kconfig default hash algorithm is a subset of this list, but any hash
    algorithm included in the list can be specified at boot, using the
    'ima_hash=' kernel command line option.
    
    Changelog v2:
    - update Kconfig
    
    Changelog:
    - support hashes that are configured
    - use generic HASH_ALGO_ definitions
    - add Kconfig support
    - hash_setup must be called only once (Dmitry)
    - removed trailing whitespaces (Roberto Sassu)
    Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
    Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
    e7a2ad7e
ima_main.c 9.05 KB