linux/security/integrity/ima
Enrico Bravi 9fa8e76250 ima: add crypto agility support for template-hash algorithm
The template hash showed by the ascii_runtime_measurements and
binary_runtime_measurements is the one calculated using sha1 and there is
no possibility to change this value, despite the fact that the template
hash is calculated using the hash algorithms corresponding to all the PCR
banks configured in the TPM.

Add the support to retrieve the ima log with the template data hash
calculated with a specific hash algorithm.
Add a new file in the securityfs ima directory for each hash algo
configured in a PCR bank of the TPM. Each new file has the name with
the following structure:

        {binary, ascii}_runtime_measurements_<hash_algo_name>

Legacy files are kept, to avoid breaking existing applications, but as
symbolic links which point to {binary, ascii}_runtime_measurements_sha1
files. These two files are created even if a TPM chip is not detected or
the sha1 bank is not configured in the TPM.

As example, in the case a TPM chip is present and sha256 is the only
configured PCR bank, the listing of the securityfs ima directory is the
following:

lr--r--r-- [...] ascii_runtime_measurements -> ascii_runtime_measurements_sha1
-r--r----- [...] ascii_runtime_measurements_sha1
-r--r----- [...] ascii_runtime_measurements_sha256
lr--r--r-- [...] binary_runtime_measurements -> binary_runtime_measurements_sha1
-r--r----- [...] binary_runtime_measurements_sha1
-r--r----- [...] binary_runtime_measurements_sha256
--w------- [...] policy
-r--r----- [...] runtime_measurements_count
-r--r----- [...] violations

Signed-off-by: Enrico Bravi <enrico.bravi@polito.it>
Signed-off-by: Silvia Sisinni <silvia.sisinni@polito.it>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2024-04-12 09:59:04 -04:00
..
ima_api.c ima: Move file-change detection variables into new structure 2024-04-09 17:14:57 -04:00
ima_appraise.c integrity: Avoid -Wflex-array-member-not-at-end warnings 2024-04-08 07:55:48 -04:00
ima_asymmetric_keys.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
ima_crypto.c ima: add crypto agility support for template-hash algorithm 2024-04-12 09:59:04 -04:00
ima_efi.c ima: require signed IMA policy when UEFI secure boot is enabled 2023-08-01 08:18:11 -04:00
ima_fs.c ima: add crypto agility support for template-hash algorithm 2024-04-12 09:59:04 -04:00
ima_iint.c ima: Move file-change detection variables into new structure 2024-04-09 17:14:57 -04:00
ima_init.c integrity: Avoid -Wflex-array-member-not-at-end warnings 2024-04-08 07:55:48 -04:00
ima_kexec.c ima: add crypto agility support for template-hash algorithm 2024-04-12 09:59:04 -04:00
ima_main.c ima: re-evaluate file integrity on file metadata change 2024-04-09 17:14:57 -04:00
ima_modsig.c ima: Add __counted_by for struct modsig and use struct_size() 2023-10-20 10:52:41 -07:00
ima_mok.c IMA: remove -Wmissing-prototypes warning 2021-07-23 08:05:06 -04:00
ima_policy.c ima: Make it independent from 'integrity' LSM 2024-02-15 23:43:47 -05:00
ima_queue_keys.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
ima_queue.c IMA: support for duplicate measurement records 2021-06-11 12:54:13 -04:00
ima_template_lib.c integrity: Avoid -Wflex-array-member-not-at-end warnings 2024-04-08 07:55:48 -04:00
ima_template_lib.h ima: define a new template field named 'd-ngv2' and templates 2022-05-05 11:49:13 -04:00
ima_template.c ima: Fix misuse of dereference of pointer in template_desc_init_fields() 2022-11-16 11:47:55 -05:00
ima.h ima: add crypto agility support for template-hash algorithm 2024-04-12 09:59:04 -04:00
Kconfig ima: Move to LSM infrastructure 2024-02-15 23:43:46 -05:00
Makefile ima: Make it independent from 'integrity' LSM 2024-02-15 23:43:47 -05:00