lkml.org 
[lkml]   [2021]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v1 4/5] ima: support fs-verity file digest based signatures
On Thu, Dec 02, 2021 at 04:55:06PM -0500, Mimi Zohar wrote:
> case IMA_VERITY_DIGSIG:
> - fallthrough;
> + set_bit(IMA_DIGSIG, &iint->atomic_flags);
> +
> + /*
> + * The IMA signature is based on a hash of IMA_VERITY_DIGSIG
> + * and the fs-verity file digest, not directly on the
> + * fs-verity file digest. Both digests should probably be
> + * included in the IMA measurement list, but for now this
> + * digest is only used for verifying the IMA signature.
> + */
> + verity_digest[0] = IMA_VERITY_DIGSIG;
> + memcpy(verity_digest + 1, iint->ima_hash->digest,
> + iint->ima_hash->length);
> +
> + hash.hdr.algo = iint->ima_hash->algo;
> + hash.hdr.length = iint->ima_hash->length;

This is still wrong because the bytes being signed don't include the hash
algorithm. Unless you mean for it to be implicitly always SHA-256? fs-verity
supports SHA-512 too, and it may support other hash algorithms in the future.

- Eric

\
 
 \ /
  Last update: 2021-12-02 23:09    [W:0.037 / U:0.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site