On Wed, Jun 03, 2020 at 06:03:35PM -0400, Mimi Zohar wrote:
Hi Roberto,
On Wed, 2020-06-03 at 17:08 +0200, Roberto Sassu wrote:
If the template field 'd' is chosen and the digest to be added to the measurement entry was not calculated with SHA1 or MD5, it is recalculated with SHA1, by using the passed file descriptor. However, this cannot be done for boot_aggregate, because there is no file descriptor.
This patch adds a call to ima_calc_boot_aggregate() in ima_eventdigest_init(), so that the digest can be recalculated also for the boot_aggregate entry.
Cc: stable@vger.kernel.org # 3.13.x Fixes: 3ce1217d6cd5d ("ima: define template fields library and new helpers") Reported-by: Takashi Iwai tiwai@suse.de Signed-off-by: Roberto Sassu roberto.sassu@huawei.com
Thanks, Roberto.
I've pushed both patches out to the next-integrity branch and would appreciate some additional testing.
thanks,
Mimi
Hi Mimi and Roberto,
FWIW, I've tested this patch manually and things went fine, with no unexpected behavior or results.
However, wouldn't it be worth add a note in kmsg about the ima_calc_boot_aggregate() being called with an algo different from the system's default? Just to let the user know he won't find a sha256 when check the measurement. But that's something we can add later too.
Thanks.