ima: zeroed out digest values

ima: zeroed out digest values

[Matt Bobrowski]

Hi Mimi/Dmitry,

In commit 54f03916fb892 [0] the way which errors [1, 2] are being
handled by some of the IMA measurement routines had slightly
changed. Specifically, in the ima_collect_measurement() helper if the
hash calculation failed for whatever reason (i.e. received a software
interrupt whilst executing in a late stage of the ima_bprm_check
security hook), rather than returning to the caller early we continue
with populating the ima_digest_data within the respective iint entry,
in which case is all zeroes given that we initialize the hash buffer
with zeroes prior to calculating a hash. Some interfaces that piggy
back of IMA measurements i.e. BPF and Audit, are now left with
reporting zeroed hash values in some cases.

I wanted to confirm whether this is expected behavior?

[0]
https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395
[1] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-a7813ab229aa21485d06aed8f7f36aef97e38d8a0b18a77ecccd64c9abe91194L254
[2] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-7fb0c7b8604559abf88f1313cd798710a86e2f0fa2fab3b0f32bc7972c82846fL338

/M

Re: ima: zeroed out digest values

[Mimi Zohar]

On Tue, 2023-01-03 at 05:41 +0000, Matt Bobrowski wrote:
> Hi Mimi/Dmitry,
> 
> In commit 54f03916fb892 [0] the way which errors [1, 2] are being
> handled by some of the IMA measurement routines had slightly
> changed. Specifically, in the ima_collect_measurement() helper if the
> hash calculation failed for whatever reason (i.e. received a software
> interrupt whilst executing in a late stage of the ima_bprm_check
> security hook), rather than returning to the caller early we continue
> with populating the ima_digest_data within the respective iint entry,
> in which case is all zeroes given that we initialize the hash buffer
> with zeroes prior to calculating a hash. Some interfaces that piggy
> back of IMA measurements i.e. BPF and Audit, are now left with
> reporting zeroed hash values in some cases.
> 
> I wanted to confirm whether this is expected behavior?

Definitely not.  Thank you for finding and reporting it.

Mimi

> 
> [0]
> https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395
> [1] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-a7813ab229aa21485d06aed8f7f36aef97e38d8a0b18a77ecccd64c9abe91194L254
> [2] https://github.com/torvalds/linux/commit/54f03916fb892441f9a9b579db9ad7925cdeb395#diff-7fb0c7b8604559abf88f1313cd798710a86e2f0fa2fab3b0f32bc7972c82846fL338
> 
> /M