mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

evm: output EVM digest calculation info 

Output the data used in calculating the EVM digest and the resulting
digest as ascii hexadecimal strings.

Suggested-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> (CONFIG_DYNAMIC_DEBUG)
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Reported-by: kernel test robot <lkp@intel.com> (Use %zu for size_t)
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar 2021-05-13 18:36:04 -04:00
parent 52c208397c
commit 87ac3d002d
2 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
security/integrity/evm/evm_crypto.c
View File

@ -10,6 +10,8 @@
* Using root's kernel master key (kmk), calculate the HMAC
*/
#define pr_fmt(fmt) "EVM: "fmt
#include <linux/export.h>
#include <linux/crypto.h>
#include <linux/xattr.h>
@ -175,6 +177,30 @@ static void hmac_add_misc(struct shash_desc *desc, struct inode *inode,
type != EVM_XATTR_PORTABLE_DIGSIG)
crypto_shash_update(desc, (u8 *)&inode->i_sb->s_uuid, UUID_SIZE);
crypto_shash_final(desc, digest);
pr_debug("hmac_misc: (%zu) [%*phN]\n", sizeof(struct h_misc),
(int)sizeof(struct h_misc), &hmac_misc);
}
/*
* Dump large security xattr values as a continuous ascii hexademical string.
* (pr_debug is limited to 64 bytes.)
*/
static void dump_security_xattr(const char *prefix, const void *src,
size_t count)
{
#if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
char *asciihex, *p;
p = asciihex = kmalloc(count * 2 + 1, GFP_KERNEL);
if (!asciihex)
return;
p = bin2hex(p, src, count);
*p = 0;
pr_debug("%s: (%zu) %.*s\n", prefix, count, (int)count * 2, asciihex);
kfree(asciihex);
#endif
}
/*
@ -230,6 +256,16 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
req_xattr_value_len);
if (is_ima)
ima_present = true;
if (req_xattr_value_len < 64)
pr_debug("%s: (%zu) [%*phN]\n", req_xattr_name,
req_xattr_value_len,
(int)req_xattr_value_len,
req_xattr_value);
else
dump_security_xattr(req_xattr_name,
req_xattr_value,
req_xattr_value_len);
continue;
}
size = vfs_getxattr_alloc(&init_user_ns, dentry, xattr->name,
@ -246,6 +282,13 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
crypto_shash_update(desc, (const u8 *)xattr_value, xattr_size);
if (is_ima)
ima_present = true;
if (xattr_size < 64)
pr_debug("%s: (%zu) [%*phN]", xattr->name, xattr_size,
(int)xattr_size, xattr_value);
else
dump_security_xattr(xattr->name, xattr_value,
xattr_size);
}
hmac_add_misc(desc, inode, type, data->digest);

4
security/integrity/evm/evm_main.c
View File

@ -11,6 +11,8 @@
* evm_inode_removexattr, and evm_verifyxattr
*/
#define pr_fmt(fmt) "EVM: "fmt
#include <linux/init.h>
#include <linux/crypto.h>
#include <linux/audit.h>
@ -272,6 +274,8 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
else
evm_status = INTEGRITY_FAIL;
}
pr_debug("digest: (%d) [%*phN]\n", digest.hdr.length, digest.hdr.length,
digest.digest);
out:
if (iint)
iint->evm_status = evm_status;