ima: differentiate between template hash and file data hash sizes
authorMimi Zohar <zohar@linux.vnet.ibm.com>
Tue, 12 Mar 2013 00:29:47 +0000 (20:29 -0400)
committerMimi Zohar <zohar@linux.vnet.ibm.com>
Fri, 25 Oct 2013 21:17:00 +0000 (17:17 -0400)
The TPM v1.2 limits the template hash size to 20 bytes.  This
patch differentiates between the template hash size, as defined
in the ima_template_entry, and the file data hash size, as
defined in the ima_template_data.  Subsequent patches add support
for different file data hash algorithms.

Change log:
- hash digest definition in ima_store_template() should be TPM_DIGEST_SIZE

Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
security/integrity/ima/ima.h
security/integrity/ima/ima_api.c
security/integrity/ima/ima_crypto.c
security/integrity/ima/ima_fs.c
security/integrity/ima/ima_init.c
security/integrity/ima/ima_queue.c

index efcdef2bf1bc364b446c1855dab05863cd63a8af..52393edfbfd97109552ecf2005935623253b0f46 100644 (file)
@@ -49,7 +49,7 @@ struct ima_template_data {
 };
 
 struct ima_template_entry {
-       u8 digest[IMA_DIGEST_SIZE];     /* sha1 or md5 measurement hash */
+       u8 digest[TPM_DIGEST_SIZE];     /* sha1 or md5 measurement hash */
        const char *template_name;
        int template_len;
        struct ima_template_data template;
index 5a7942e20814f880da20fdf5b143c7cdae9a24ab..2cc5dcc6bdebf0ea4591aca063e403bb8638248d 100644 (file)
@@ -46,7 +46,7 @@ int ima_store_template(struct ima_template_entry *entry,
        int result;
        struct {
                struct ima_digest_data hdr;
-               char digest[IMA_MAX_DIGEST_SIZE];
+               char digest[TPM_DIGEST_SIZE];
        } hash;
 
        memset(entry->digest, 0, sizeof(entry->digest));
index 2fd1786514671c2f6d8683e4456933b8ef000fef..872c6698067cdc64a91fb36b5558d689750fffe5 100644 (file)
@@ -155,7 +155,7 @@ static void __init ima_pcrread(int idx, u8 *pcr)
  */
 int __init ima_calc_boot_aggregate(char *digest)
 {
-       u8 pcr_i[IMA_DIGEST_SIZE];
+       u8 pcr_i[TPM_DIGEST_SIZE];
        int rc, i;
        struct {
                struct shash_desc shash;
@@ -173,7 +173,7 @@ int __init ima_calc_boot_aggregate(char *digest)
        for (i = TPM_PCR0; i < TPM_PCR8; i++) {
                ima_pcrread(i, pcr_i);
                /* now accumulate with current aggregate */
-               rc = crypto_shash_update(&desc.shash, pcr_i, IMA_DIGEST_SIZE);
+               rc = crypto_shash_update(&desc.shash, pcr_i, TPM_DIGEST_SIZE);
        }
        if (!rc)
                crypto_shash_final(&desc.shash, digest);
index 5f0fd113433a27ff9fa43c92e1492212f8509bf2..c35cfb5b3c5eb05f86a78484dc81edacd5d67eac 100644 (file)
@@ -133,7 +133,7 @@ static int ima_measurements_show(struct seq_file *m, void *v)
        ima_putc(m, &pcr, sizeof pcr);
 
        /* 2nd: template digest */
-       ima_putc(m, e->digest, IMA_DIGEST_SIZE);
+       ima_putc(m, e->digest, TPM_DIGEST_SIZE);
 
        /* 3rd: template name size */
        namelen = strlen(e->template_name);
@@ -167,11 +167,11 @@ static const struct file_operations ima_measurements_ops = {
        .release = seq_release,
 };
 
-static void ima_print_digest(struct seq_file *m, u8 *digest)
+static void ima_print_digest(struct seq_file *m, u8 *digest, int size)
 {
        int i;
 
-       for (i = 0; i < IMA_DIGEST_SIZE; i++)
+       for (i = 0; i < size; i++)
                seq_printf(m, "%02x", *(digest + i));
 }
 
@@ -182,7 +182,7 @@ void ima_template_show(struct seq_file *m, void *e, enum ima_show_type show)
 
        switch (show) {
        case IMA_SHOW_ASCII:
-               ima_print_digest(m, entry->digest);
+               ima_print_digest(m, entry->digest, IMA_DIGEST_SIZE);
                seq_printf(m, " %s\n", entry->file_name);
                break;
        case IMA_SHOW_BINARY:
@@ -212,7 +212,7 @@ static int ima_ascii_measurements_show(struct seq_file *m, void *v)
        seq_printf(m, "%2d ", CONFIG_IMA_MEASURE_PCR_IDX);
 
        /* 2nd: SHA1 template hash */
-       ima_print_digest(m, e->digest);
+       ima_print_digest(m, e->digest, TPM_DIGEST_SIZE);
 
        /* 3th:  template name */
        seq_printf(m, " %s ", e->template_name);
index 162ea723db3df5f07a2dd23f4bcc66e1af03a898..9d0243c10558f561466128183c3eec1206fab191 100644 (file)
@@ -74,7 +74,7 @@ err_out:
 
 int __init ima_init(void)
 {
-       u8 pcr_i[IMA_DIGEST_SIZE];
+       u8 pcr_i[TPM_DIGEST_SIZE];
        int rc;
 
        ima_used_chip = 0;
index ff63fe00c19554921b172425d5261495a98a6bcf..e63ff3369f108c55e0d0682c7d893aeebfcbf8fa 100644 (file)
@@ -50,7 +50,7 @@ static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value)
        key = ima_hash_key(digest_value);
        rcu_read_lock();
        hlist_for_each_entry_rcu(qe, &ima_htable.queue[key], hnext) {
-               rc = memcmp(qe->entry->digest, digest_value, IMA_DIGEST_SIZE);
+               rc = memcmp(qe->entry->digest, digest_value, TPM_DIGEST_SIZE);
                if (rc == 0) {
                        ret = qe;
                        break;
@@ -106,7 +106,7 @@ static int ima_pcr_extend(const u8 *hash)
 int ima_add_template_entry(struct ima_template_entry *entry, int violation,
                           const char *op, struct inode *inode)
 {
-       u8 digest[IMA_DIGEST_SIZE];
+       u8 digest[TPM_DIGEST_SIZE];
        const char *audit_cause = "hash_added";
        char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
        int audit_info = 1;