mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-26 20:44:32 +08:00
9803d413f4
Pass the filename argument to ima_add_template_entry() in order to eliminate a dependency on template specific data (third argument of integrity_audit_msg). This change is required because, with the new template management mechanism, the generation of a new measurement entry will be performed by new specific functions (introduced in next patches) and the current IMA code will not be aware anymore of how data is stored in the entry payload. Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
105 lines
2.9 KiB
C
105 lines
2.9 KiB
C
/*
|
|
* Copyright (C) 2005,2006,2007,2008 IBM Corporation
|
|
*
|
|
* Authors:
|
|
* Reiner Sailer <sailer@watson.ibm.com>
|
|
* Leendert van Doorn <leendert@watson.ibm.com>
|
|
* Mimi Zohar <zohar@us.ibm.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License as
|
|
* published by the Free Software Foundation, version 2 of the
|
|
* License.
|
|
*
|
|
* File: ima_init.c
|
|
* initialization and cleanup functions
|
|
*/
|
|
#include <linux/module.h>
|
|
#include <linux/scatterlist.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/err.h>
|
|
#include <crypto/hash_info.h>
|
|
#include "ima.h"
|
|
|
|
/* name for boot aggregate entry */
|
|
static const char *boot_aggregate_name = "boot_aggregate";
|
|
int ima_used_chip;
|
|
|
|
/* Add the boot aggregate to the IMA measurement list and extend
|
|
* the PCR register.
|
|
*
|
|
* Calculate the boot aggregate, a SHA1 over tpm registers 0-7,
|
|
* assuming a TPM chip exists, and zeroes if the TPM chip does not
|
|
* exist. Add the boot aggregate measurement to the measurement
|
|
* list and extend the PCR register.
|
|
*
|
|
* If a tpm chip does not exist, indicate the core root of trust is
|
|
* not hardware based by invalidating the aggregate PCR value.
|
|
* (The aggregate PCR value is invalidated by adding one value to
|
|
* the measurement list and extending the aggregate PCR value with
|
|
* a different value.) Violations add a zero entry to the measurement
|
|
* list and extend the aggregate PCR value with ff...ff's.
|
|
*/
|
|
static void __init ima_add_boot_aggregate(void)
|
|
{
|
|
struct ima_template_entry *entry;
|
|
const char *op = "add_boot_aggregate";
|
|
const char *audit_cause = "ENOMEM";
|
|
int result = -ENOMEM;
|
|
int violation = 1;
|
|
struct {
|
|
struct ima_digest_data hdr;
|
|
char digest[TPM_DIGEST_SIZE];
|
|
} hash;
|
|
|
|
entry = kmalloc(sizeof(*entry), GFP_KERNEL);
|
|
if (!entry)
|
|
goto err_out;
|
|
|
|
memset(&entry->template, 0, sizeof(entry->template));
|
|
strncpy(entry->template.file_name, boot_aggregate_name,
|
|
IMA_EVENT_NAME_LEN_MAX);
|
|
if (ima_used_chip) {
|
|
violation = 0;
|
|
hash.hdr.algo = HASH_ALGO_SHA1;
|
|
result = ima_calc_boot_aggregate(&hash.hdr);
|
|
if (result < 0) {
|
|
audit_cause = "hashing_error";
|
|
kfree(entry);
|
|
goto err_out;
|
|
}
|
|
memcpy(entry->template.digest, hash.hdr.digest,
|
|
hash.hdr.length);
|
|
}
|
|
result = ima_store_template(entry, violation, NULL,
|
|
boot_aggregate_name);
|
|
if (result < 0)
|
|
kfree(entry);
|
|
return;
|
|
err_out:
|
|
integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op,
|
|
audit_cause, result, 0);
|
|
}
|
|
|
|
int __init ima_init(void)
|
|
{
|
|
u8 pcr_i[TPM_DIGEST_SIZE];
|
|
int rc;
|
|
|
|
ima_used_chip = 0;
|
|
rc = tpm_pcr_read(TPM_ANY_NUM, 0, pcr_i);
|
|
if (rc == 0)
|
|
ima_used_chip = 1;
|
|
|
|
if (!ima_used_chip)
|
|
pr_info("IMA: No TPM chip found, activating TPM-bypass!\n");
|
|
|
|
rc = ima_init_crypto();
|
|
if (rc)
|
|
return rc;
|
|
ima_add_boot_aggregate(); /* boot aggregate must be first entry */
|
|
ima_init_policy();
|
|
|
|
return ima_fs_init();
|
|
}
|