Skip to contentSkip to conversation

ima: zeroed out digest values

DISCUSSION Matt Bobrowski 2 participants 2 messages Jan 3, 2023 Keys-trusted

lore
Share & tools
lore
#0 lore raw

Hi Mimi/Dmitry,

In commit 54f03916fb892 [0] the way which errors [1, 2] are being handled by some of the IMA measurement routines had slightly changed. Specifically, in the ima_collect_measurement() helper if the hash calculation failed for whatever reason (i.e. received a software interrupt whilst executing in a late stage of the ima_bprm_check security hook), rather than returning to the caller early we continue with populating the ima_digest_data within the respective iint entry, in which case is all zeroes given that we initialize the hash buffer with zeroes prior to calculating a hash. Some interfaces that piggy back of IMA measurements i.e. BPF and Audit, are now left with reporting zeroed hash values in some cases.

I wanted to confirm whether this is expected behavior?

[0]
https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395
[1] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-a7813ab229aa21485d06aed8f7f36aef97e38d8a0b18a77ecccd64c9abe91194L254
[2] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-7fb0c7b8604559abf88f1313cd798710a86e2f0fa2fab3b0f32bc7972c82846fL338

/M

maintainer
#1 lore raw
Quoted 14 lines · Matt Bobrowski

Hi Mimi/Dmitry,

In commit 54f03916fb892 [0] the way which errors [1, 2] are being handled by some of the IMA measurement routines had slightly changed. Specifically, in the ima_collect_measurement() helper if the hash calculation failed for whatever reason (i.e. received a software interrupt whilst executing in a late stage of the ima_bprm_check security hook), rather than returning to the caller early we continue with populating the ima_digest_data within the respective iint entry, in which case is all zeroes given that we initialize the hash buffer with zeroes prior to calculating a hash. Some interfaces that piggy back of IMA measurements i.e. BPF and Audit, are now left with reporting zeroed hash values in some cases.

Quoted 1 line

I wanted to confirm whether this is expected behavior?

Definitely not. Thank you for finding and reporting it.

Mimi

Quoted 7 lines

[0]
https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395
[1] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-a7813ab229aa21485d06aed8f7f36aef97e38d8a0b18a77ecccd64c9abe91194L254
[2] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-7fb0c7b8604559abf88f1313cd798710a86e2f0fa2fab3b0f32bc7972c82846fL338

/M