diff options
| author | Roberto Sassu <roberto.sassu@huawei.com> | 2020-03-25 13:47:09 +0300 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2020-04-20 05:03:39 +0300 |
| commit | aa724fe18a8a8285d0071c3bfc932efb090d142d (patch) | |
| tree | 87fc69a1f17ebe723ebb9a16ff82ae4432e43379 /security/integrity/ima/ima.h | |
| parent | 7ca79645a1f8837c3850b881a2c0b43cfba5dc36 (diff) | |
| download | linux-aa724fe18a8a8285d0071c3bfc932efb090d142d.tar.xz | |
ima: Switch to dynamically allocated buffer for template digests
This patch dynamically allocates the array of tpm_digest structures in
ima_alloc_init_template() and ima_restore_template_data(). The size of the
array is equal to the number of PCR banks plus ima_extra_slots, to make
room for SHA1 and the IMA default hash algorithm, when PCR banks with those
algorithms are not allocated.
Calculating the SHA1 digest is mandatory, as SHA1 still remains the default
hash algorithm for the measurement list. When IMA will support the Crypto
Agile format, remaining digests will be also provided.
The position in the measurement entry array of the SHA1 digest is stored in
the ima_sha1_idx global variable and is determined at IMA initialization
time.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Diffstat (limited to 'security/integrity/ima/ima.h')
| -rw-r--r-- | security/integrity/ima/ima.h | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index a2dfe24e04c7..2a7ed68e6414 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -45,11 +45,15 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; #define IMA_TEMPLATE_IMA_NAME "ima" #define IMA_TEMPLATE_IMA_FMT "d|n" +#define NR_BANKS(chip) ((chip != NULL) ? chip->nr_allocated_banks : 0) + /* current content of the policy */ extern int ima_policy_flag; /* set during initialization */ extern int ima_hash_algo; +extern int ima_sha1_idx __ro_after_init; +extern int ima_extra_slots __ro_after_init; extern int ima_appraise; extern struct tpm_chip *ima_tpm_chip; @@ -92,7 +96,7 @@ struct ima_template_desc { struct ima_template_entry { int pcr; - u8 digest[TPM_DIGEST_SIZE]; /* sha1 or md5 measurement hash */ + struct tpm_digest *digests; struct ima_template_desc *template_desc; /* template descriptor */ u32 template_data_len; struct ima_field_data template_data[0]; /* template related data */ |