Commit add1c05d authored by Roberto Sassu's avatar Roberto Sassu Committed by Mimi Zohar

ima: defer determining the appraisal hash algorithm for 'ima' template

The same hash algorithm should be used for calculating the file
data hash for the IMA measurement list, as for appraising the file
data integrity.  (The appraise hash algorithm is stored in the
'security.ima' extended attribute.)  The exception is when the
reference file data hash digest, stored in the extended attribute,
is larger than the one supported by the template.  In this case,
the file data hash needs to be calculated twice, once for the
measurement list and, again, for appraisal.
Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent 5278aa52
...@@ -145,6 +145,7 @@ static int process_measurement(struct file *file, const char *filename, ...@@ -145,6 +145,7 @@ static int process_measurement(struct file *file, const char *filename,
{ {
struct inode *inode = file_inode(file); struct inode *inode = file_inode(file);
struct integrity_iint_cache *iint; struct integrity_iint_cache *iint;
struct ima_template_desc *template_desc = ima_template_desc_current();
char *pathbuf = NULL; char *pathbuf = NULL;
const char *pathname = NULL; const char *pathname = NULL;
int rc = -ENOMEM, action, must_appraise, _func; int rc = -ENOMEM, action, must_appraise, _func;
...@@ -188,7 +189,10 @@ static int process_measurement(struct file *file, const char *filename, ...@@ -188,7 +189,10 @@ static int process_measurement(struct file *file, const char *filename,
goto out_digsig; goto out_digsig;
} }
if (action & IMA_APPRAISE_SUBMASK) if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) {
if (action & IMA_APPRAISE_SUBMASK)
xattr_ptr = &xattr_value;
} else
xattr_ptr = &xattr_value; xattr_ptr = &xattr_value;
rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len); rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment