All of lore.kernel.org
 help / color / mirror / Atom feed
From: Matt Bobrowski <mattbobrowski@google.com>
To: zohar@linux.ibm.com, dmitry.kasatkin@gmail.com
Cc: linux-integrity@vger.kernel.org, paul@paul-moore.com, eparis@redhat.com
Subject: ima: zeroed out digest values
Date: Tue, 3 Jan 2023 05:41:26 +0000	[thread overview]
Message-ID: <Y7PABtHq14jMGrgK@google.com> (raw)

Hi Mimi/Dmitry,

In commit 54f03916fb892 [0] the way which errors [1, 2] are being
handled by some of the IMA measurement routines had slightly
changed. Specifically, in the ima_collect_measurement() helper if the
hash calculation failed for whatever reason (i.e. received a software
interrupt whilst executing in a late stage of the ima_bprm_check
security hook), rather than returning to the caller early we continue
with populating the ima_digest_data within the respective iint entry,
in which case is all zeroes given that we initialize the hash buffer
with zeroes prior to calculating a hash. Some interfaces that piggy
back of IMA measurements i.e. BPF and Audit, are now left with
reporting zeroed hash values in some cases.

I wanted to confirm whether this is expected behavior?

[0]
https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395
[1] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-a7813ab229aa21485d06aed8f7f36aef97e38d8a0b18a77ecccd64c9abe91194L254
[2] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-7fb0c7b8604559abf88f1313cd798710a86e2f0fa2fab3b0f32bc7972c82846fL338

/M

             reply	other threads:[~2023-01-03  5:41 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-01-03  5:41 Matt Bobrowski [this message]
2023-01-03 16:37 ` ima: zeroed out digest values Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Y7PABtHq14jMGrgK@google.com \
    --to=mattbobrowski@google.com \
    --cc=dmitry.kasatkin@gmail.com \
    --cc=eparis@redhat.com \
    --cc=linux-integrity@vger.kernel.org \
    --cc=paul@paul-moore.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.