[PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-18 Thread Maurizio Drocco
IMA is not considering TPM registers 8-9 when calculating the boot aggregate. When registers 8-9 are used to store measurements of the kernel and its command line (e.g., grub2 bootloader with tpm module enabled), IMA should include them in the boot aggregate. Signed-off-by: Maurizio Drocco --- s

RE: [PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-18 Thread Roberto Sassu
> From: Mimi Zohar [mailto:zo...@linux.ibm.com] > Sent: Tuesday, June 16, 2020 8:11 PM > On Tue, 2020-06-16 at 17:29 +, Roberto Sassu wrote: > > > From: James Bottomley [mailto:j...@linux.ibm.com] > > > Sent: Friday, June 12, 2020 7:14 PM > > > On Fri, 2020-06-12 at 15:11 +, Roberto Sassu w

Re: [PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-16 Thread Mimi Zohar
On Tue, 2020-06-16 at 17:29 +, Roberto Sassu wrote: > > From: James Bottomley [mailto:j...@linux.ibm.com] > > Sent: Friday, June 12, 2020 7:14 PM > > On Fri, 2020-06-12 at 15:11 +, Roberto Sassu wrote: > > > with recent patches, boot_aggregate can be calculated from non-SHA1 > > > PCR banks

RE: [PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-16 Thread Roberto Sassu
> From: James Bottomley [mailto:j...@linux.ibm.com] > Sent: Friday, June 12, 2020 7:14 PM > On Fri, 2020-06-12 at 15:11 +, Roberto Sassu wrote: > > with recent patches, boot_aggregate can be calculated from non-SHA1 > > PCR banks. I would replace with: > > > > Extend cumulative digest over ...

Re: [PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-12 Thread James Bottomley
On Fri, 2020-06-12 at 15:11 +, Roberto Sassu wrote: > with recent patches, boot_aggregate can be calculated from non-SHA1 > PCR banks. I would replace with: > > Extend cumulative digest over ... > > Given that with this patch boot_aggregate is calculated differently, > shouldn't we call it bo

RE: [PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-12 Thread Roberto Sassu
> From: linux-integrity-ow...@vger.kernel.org [mailto:linux-integrity- > ow...@vger.kernel.org] On Behalf Of Maurizio Drocco > Sent: Friday, June 12, 2020 4:38 PM > IMA is not considering TPM registers 8-9 when calculating the boot > aggregate. When registers 8-9 are used to store measurements of t

[PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-12 Thread Maurizio Drocco
IMA is not considering TPM registers 8-9 when calculating the boot aggregate. When registers 8-9 are used to store measurements of the kernel and its command line (e.g., grub2 bootloader with tpm module enabled), IMA should include them in the boot aggregate. Signed-off-by: Maurizio Drocco --- s

Re: [PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-11 Thread kernel test robot
Hi Maurizio, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on integrity/next-integrity] [also build test WARNING on next-20200611] [cannot apply to v5.7] [if your patch is applied to the wrong git tree, please drop us a note to help improve the system. BTW, we al

Re: [PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-11 Thread Mimi Zohar
Hi Maurizo, On Thu, 2020-06-11 at 15:54 -0400, Maurizio Drocco wrote: > IMA is not considering TPM registers 8-9 when calculating the boot > aggregate. When registers 8-9 are used to store measurements of the > kernel and its command line (e.g., grub2 bootloader with tpm module > enabled), IMA sho

[PATCH] extend IMA boot_aggregate with kernel measurements

2020-06-11 Thread Maurizio Drocco
IMA is not considering TPM registers 8-9 when calculating the boot aggregate. When registers 8-9 are used to store measurements of the kernel and its command line (e.g., grub2 bootloader with tpm module enabled), IMA should include them in the boot aggregate. Signed-off-by: Maurizio Drocco --- s