evm: output EVM digest calculation info
Output the data used in calculating the EVM digest and the resulting digest as ascii hexadecimal strings. Suggested-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> (CONFIG_DYNAMIC_DEBUG) Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Reported-by: kernel test robot <lkp@intel.com> (Use %zu for size_t) Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
parent
52c208397c
commit
87ac3d002d
@ -10,6 +10,8 @@
|
|||||||
* Using root's kernel master key (kmk), calculate the HMAC
|
* Using root's kernel master key (kmk), calculate the HMAC
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
#define pr_fmt(fmt) "EVM: "fmt
|
||||||
|
|
||||||
#include <linux/export.h>
|
#include <linux/export.h>
|
||||||
#include <linux/crypto.h>
|
#include <linux/crypto.h>
|
||||||
#include <linux/xattr.h>
|
#include <linux/xattr.h>
|
||||||
@ -175,6 +177,30 @@ static void hmac_add_misc(struct shash_desc *desc, struct inode *inode,
|
|||||||
type != EVM_XATTR_PORTABLE_DIGSIG)
|
type != EVM_XATTR_PORTABLE_DIGSIG)
|
||||||
crypto_shash_update(desc, (u8 *)&inode->i_sb->s_uuid, UUID_SIZE);
|
crypto_shash_update(desc, (u8 *)&inode->i_sb->s_uuid, UUID_SIZE);
|
||||||
crypto_shash_final(desc, digest);
|
crypto_shash_final(desc, digest);
|
||||||
|
|
||||||
|
pr_debug("hmac_misc: (%zu) [%*phN]\n", sizeof(struct h_misc),
|
||||||
|
(int)sizeof(struct h_misc), &hmac_misc);
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Dump large security xattr values as a continuous ascii hexademical string.
|
||||||
|
* (pr_debug is limited to 64 bytes.)
|
||||||
|
*/
|
||||||
|
static void dump_security_xattr(const char *prefix, const void *src,
|
||||||
|
size_t count)
|
||||||
|
{
|
||||||
|
#if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
|
||||||
|
char *asciihex, *p;
|
||||||
|
|
||||||
|
p = asciihex = kmalloc(count * 2 + 1, GFP_KERNEL);
|
||||||
|
if (!asciihex)
|
||||||
|
return;
|
||||||
|
|
||||||
|
p = bin2hex(p, src, count);
|
||||||
|
*p = 0;
|
||||||
|
pr_debug("%s: (%zu) %.*s\n", prefix, count, (int)count * 2, asciihex);
|
||||||
|
kfree(asciihex);
|
||||||
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
@ -230,6 +256,16 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
|
|||||||
req_xattr_value_len);
|
req_xattr_value_len);
|
||||||
if (is_ima)
|
if (is_ima)
|
||||||
ima_present = true;
|
ima_present = true;
|
||||||
|
|
||||||
|
if (req_xattr_value_len < 64)
|
||||||
|
pr_debug("%s: (%zu) [%*phN]\n", req_xattr_name,
|
||||||
|
req_xattr_value_len,
|
||||||
|
(int)req_xattr_value_len,
|
||||||
|
req_xattr_value);
|
||||||
|
else
|
||||||
|
dump_security_xattr(req_xattr_name,
|
||||||
|
req_xattr_value,
|
||||||
|
req_xattr_value_len);
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
size = vfs_getxattr_alloc(&init_user_ns, dentry, xattr->name,
|
size = vfs_getxattr_alloc(&init_user_ns, dentry, xattr->name,
|
||||||
@ -246,6 +282,13 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
|
|||||||
crypto_shash_update(desc, (const u8 *)xattr_value, xattr_size);
|
crypto_shash_update(desc, (const u8 *)xattr_value, xattr_size);
|
||||||
if (is_ima)
|
if (is_ima)
|
||||||
ima_present = true;
|
ima_present = true;
|
||||||
|
|
||||||
|
if (xattr_size < 64)
|
||||||
|
pr_debug("%s: (%zu) [%*phN]", xattr->name, xattr_size,
|
||||||
|
(int)xattr_size, xattr_value);
|
||||||
|
else
|
||||||
|
dump_security_xattr(xattr->name, xattr_value,
|
||||||
|
xattr_size);
|
||||||
}
|
}
|
||||||
hmac_add_misc(desc, inode, type, data->digest);
|
hmac_add_misc(desc, inode, type, data->digest);
|
||||||
|
|
||||||
|
@ -11,6 +11,8 @@
|
|||||||
* evm_inode_removexattr, and evm_verifyxattr
|
* evm_inode_removexattr, and evm_verifyxattr
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
#define pr_fmt(fmt) "EVM: "fmt
|
||||||
|
|
||||||
#include <linux/init.h>
|
#include <linux/init.h>
|
||||||
#include <linux/crypto.h>
|
#include <linux/crypto.h>
|
||||||
#include <linux/audit.h>
|
#include <linux/audit.h>
|
||||||
@ -272,6 +274,8 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
|
|||||||
else
|
else
|
||||||
evm_status = INTEGRITY_FAIL;
|
evm_status = INTEGRITY_FAIL;
|
||||||
}
|
}
|
||||||
|
pr_debug("digest: (%d) [%*phN]\n", digest.hdr.length, digest.hdr.length,
|
||||||
|
digest.digest);
|
||||||
out:
|
out:
|
||||||
if (iint)
|
if (iint)
|
||||||
iint->evm_status = evm_status;
|
iint->evm_status = evm_status;
|
||||||
|
Loading…
x
Reference in New Issue
Block a user