diff options
| author | Tushar Sugandhi <tusharsu@linux.microsoft.com> | 2021-08-14 00:38:00 +0300 |
|---|---|---|
| committer | Mike Snitzer <snitzer@redhat.com> | 2021-08-20 23:07:36 +0300 |
| commit | 33ace4ca125315d7f4f2b022bf6c83dfade8f9d8 (patch) | |
| tree | 7d5ab7f941dc30f46344a1d71320e6443ff91f1e /drivers/md/dm-verity-target.c | |
| parent | f1cd6cb24b6b3cd95227e8016d092310a4015e96 (diff) | |
| download | linux-33ace4ca125315d7f4f2b022bf6c83dfade8f9d8.tar.xz | |
dm ima: update dm target attributes for ima measurements
Certain DM targets ('integrity', 'multipath', 'verity') need to update the
way their attributes are recorded in the ima log, so that the attestation
servers can interpret the data correctly and decide if the devices
meet the attestation requirements. For instance, the "mode=%c" attribute
in the 'integrity' target is measured twice, the 'verity' target is
missing the attribute "root_hash_sig_key_desc=%s", and the 'multipath'
target needs to index the attributes properly.
Update 'integrity' target to remove the duplicate measurement of
the attribute "mode=%c". Add "root_hash_sig_key_desc=%s" attribute
for the 'verity' target. Index various attributes in 'multipath'
target. Also, add "nr_priority_groups=%u" attribute to 'multipath'
target to record the number of priority groups.
Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
Suggested-by: Thore Sommer <public@thson.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Diffstat (limited to 'drivers/md/dm-verity-target.c')
| -rw-r--r-- | drivers/md/dm-verity-target.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c index bfefa100c265..22a5ac82446a 100644 --- a/drivers/md/dm-verity-target.c +++ b/drivers/md/dm-verity-target.c @@ -794,6 +794,8 @@ static void verity_status(struct dm_target *ti, status_type_t type, DMEMIT(",ignore_zero_blocks=%c", v->zero_digest ? 'y' : 'n'); DMEMIT(",check_at_most_once=%c", v->validated_blocks ? 'y' : 'n'); + if (v->signature_key_desc) + DMEMIT(",root_hash_sig_key_desc=%s", v->signature_key_desc); if (v->mode != DM_VERITY_MODE_EIO) { DMEMIT(",verity_mode="); |