aboutsummaryrefslogtreecommitdiff
path: root/scripts/gdb/linux/modules.py
diff options
context:
space:
mode:
authorRoberto Sassu <[email protected]>2020-03-25 11:47:06 +0100
committerMimi Zohar <[email protected]>2020-04-19 22:03:39 -0400
commit6f1a1d103b48b1533a9c804e7a069e2c8e937ce7 (patch)
treef081c5a832103b1d491060e480cdc4bf205919d0 /scripts/gdb/linux/modules.py
parentae83d0b416db002fe95601e7f97f64b59514d936 (diff)
ima: Switch to ima_hash_algo for boot aggregate
boot_aggregate is the first entry of IMA measurement list. Its purpose is to link pre-boot measurements to IMA measurements. As IMA was designed to work with a TPM 1.2, the SHA1 PCR bank was always selected even if a TPM 2.0 with support for stronger hash algorithms is available. This patch first tries to find a PCR bank with the IMA default hash algorithm. If it does not find it, it selects the SHA256 PCR bank for TPM 2.0 and SHA1 for TPM 1.2. Ultimately, it selects SHA1 also for TPM 2.0 if the SHA256 PCR bank is not found. If none of the PCR banks above can be found, boot_aggregate file digest is filled with zeros, as for TPM bypass, making it impossible to perform a remote attestation of the system. Cc: [email protected] # 5.1.x Fixes: 879b589210a9 ("tpm: retrieve digest size of unknown algorithms with PCR read") Reported-by: Jerry Snitselaar <[email protected]> Suggested-by: James Bottomley <[email protected]> Signed-off-by: Roberto Sassu <[email protected]> Signed-off-by: Mimi Zohar <[email protected]>
Diffstat (limited to 'scripts/gdb/linux/modules.py')
0 files changed, 0 insertions, 0 deletions