Messages in this thread | | | From | Roberto Sassu <> | Subject | [PATCH 0/6] ima: fixes for the new template management mechanism | Date | Fri, 15 Nov 2013 14:45:38 +0100 |
| |
Hi everyone
this patch set fixes some issues in the new template management mechanism. In particular, first four patches are simple bug fixes, explained in the patch description, while last two restore the original IMA behavior when producing a measurement entry with the old 'ima' template'. In respect to the behavior adopted for newly introduced templates ('ima-ng' and 'ima-sig'), where the total template length and the field length are sent through the 'binary_runtime_measurements' interface and the latter information is included in the calculation of the template digest, for the old 'ima' template it is necessary to handle the following exceptions:
- the event digest field length is NOT sent through the userspace interface and is NOT included in the template digest calculation; - the event name field length is sent through the userspace interface but is NOT included in the template digest calculation.
Regards
Roberto Sassu
Roberto Sassu (6): ima: change the default hash algorithm to SHA1 in ima_eventdigest_ng_init() ima: pass HASH_ALGO__LAST as hash algo in ima_eventdigest_init() ima: remove unneeded size_limit argument from ima_eventdigest_init_common() ima: check result of crypto_shash_update() in ima_calc_field_array_hash_tfm ima: do not include field length in template digest calc for ima template ima: do not send field length to userspace for digest of ima template
security/integrity/ima/ima.h | 6 ++++-- security/integrity/ima/ima_api.c | 1 + security/integrity/ima/ima_crypto.c | 17 ++++++++++++----- security/integrity/ima/ima_fs.c | 14 +++++++++++--- security/integrity/ima/ima_template_lib.c | 24 +++++++++++++----------- 5 files changed, 41 insertions(+), 21 deletions(-)
-- 1.8.1.4
[unhandled content-type:application/x-pkcs7-signature] | |