linux-kernel - Re: [PATCH v2 2/8] ima: Switch to ima_hash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1580992272.5585.337.camel@linux.ibm.com>
Date:   Thu, 06 Feb 2020 07:31:12 -0500
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Roberto Sassu <roberto.sassu@...wei.com>,
        "James.Bottomley@...senPartnership.com" 
        <James.Bottomley@...senPartnership.com>,
        "jarkko.sakkinen@...ux.intel.com" <jarkko.sakkinen@...ux.intel.com>
Cc:     "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Silviu Vlasceanu <Silviu.Vlasceanu@...wei.com>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: Re: [PATCH v2 2/8] ima: Switch to ima_hash_algo for boot aggregate

On Thu, 2020-02-06 at 12:28 +0000, Roberto Sassu wrote:
> > -----Original Message-----
> > From: Mimi Zohar [mailto:zohar@...ux.ibm.com]
> > Sent: Thursday, February 6, 2020 1:17 PM
> > To: Roberto Sassu <roberto.sassu@...wei.com>;
> > James.Bottomley@...senPartnership.com;
> > jarkko.sakkinen@...ux.intel.com
> > Cc: linux-integrity@...r.kernel.org; linux-security-module@...r.kernel.org;
> > linux-kernel@...r.kernel.org; Silviu Vlasceanu
> > <Silviu.Vlasceanu@...wei.com>; stable@...r.kernel.org
> > Subject: Re: [PATCH v2 2/8] ima: Switch to ima_hash_algo for boot
> > aggregate
> > 
> > On Thu, 2020-02-06 at 09:36 +0000, Roberto Sassu wrote:
> > > > Hi Roberto,
> > > >
> > > > On Wed, 2020-02-05 at 11:33 +0100, Roberto Sassu wrote:
> > > >
> > > > <snip>
> > > >
> > > > > Reported-by: Jerry Snitselaar <jsnitsel@...hat.com>
> > > > > Suggested-by: James Bottomley
> > > > <James.Bottomley@...senPartnership.com>
> > > > > Signed-off-by: Roberto Sassu <roberto.sassu@...wei.com>
> > > > > Cc: stable@...r.kernel.org
> > > >
> > > > Cc'ing stable resulted in Sasha's automated message.  If you're going
> > > > to Cc stable, then please include the stable kernel release (e.g. Cc:
> > > > stable@...r.kernel.org # v5.3).  Also please include a "Fixes" tag.
> > > >  Normally only bug fixes are backported.
> > >
> > > Ok, will add the kernel version. I also thought which commit I should
> > > mention in the Fixes tag. IMA always read the SHA1 bank from the
> > > beginning. I could mention the patch that introduces the new API
> > > to read other banks, but I'm not sure. What do you think?
> > 
> > This patch is dependent on nr_allocated_banks.  Please try applying
> > this patch to the earliest stable kernel with the commit that
> > introduces nr_allocated_banks and test to make sure it works properly.
> 
> It also depends on 879b589210a9 ("tpm: retrieve digest size of unknown"
> algorithms with PCR read") which exported the mapping between TPM
> algorithm ID and crypto ID, and changed the definition of tpm_pcr_read()
> to read non-SHA1 PCR banks. It requires many patches, so backporting it
> is not a trivial task. I think the earliest kernel this patch can be backported to
> is 5.1.

Agreed.  Thank you for checking.

Mimi