Re: [PATCH 4/4] ima: support fs-verity file digest based signatures
From: Lakshmi Ramasubramanian <hidden>
Date: 2021-11-30 05:56:37
Also in:
linux-fscrypt, lkml
Hi Mimi, On 11/29/2021 9:00 AM, Mimi Zohar wrote:
Instead of calculating a file hash and verifying the signature stored in the security.ima xattr against the calculated file hash, verify the signature of the fs-verity's file digest. The fs-verity file digest is a hash that includes the Merkle tree root hash.
This patch is reading the fs-verity signature for the given file using the new function fsverity_measure() that was defined in [Patch 1/4]. Is it also verifying the fs-verity signature here?
quoted hunk ↗ jump to hunk
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- security/integrity/ima/ima_api.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index 179c7f0364c2..ee1701f8c0f3 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c@@ -16,6 +16,7 @@ #include <linux/xattr.h> #include <linux/evm.h> #include <linux/iversion.h> +#include <linux/fsverity.h> #include "ima.h"@@ -205,6 +206,23 @@ int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode, allowed_algos); } +static int ima_collect_verity_measurement(struct integrity_iint_cache *iint, + struct ima_digest_data *hash) +{ + u8 verity_digest[FS_VERITY_MAX_DIGEST_SIZE]; + enum hash_algo verity_alg; + int rc; + + rc = fsverity_measure(iint->inode, verity_digest, &verity_alg);
nit: fsverity_collect_measurement() may be more appropriate for this function (defined in [PATCH 1/4]). thanks, -lakshmi
quoted hunk ↗ jump to hunk
+ if (rc) + return -EINVAL; + if (hash->algo != verity_alg) + return -EINVAL; + hash->length = hash_digest_size[verity_alg]; + memcpy(hash->digest, verity_digest, hash->length); + return 0; +} + /* * ima_collect_measurement - collect file measurement *@@ -256,6 +274,8 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, if (buf) result = ima_calc_buffer_hash(buf, size, &hash.hdr); + else if (veritysig) + result = ima_collect_verity_measurement(iint, &hash.hdr); else result = ima_calc_file_hash(file, &hash.hdr);