From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-24.9 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B65C0C4338F for ; Wed, 4 Aug 2021 17:39:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8C31660F41 for ; Wed, 4 Aug 2021 17:39:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234567AbhHDRjv (ORCPT ); Wed, 4 Aug 2021 13:39:51 -0400 Received: from linux.microsoft.com ([13.77.154.182]:37452 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231410AbhHDRju (ORCPT ); Wed, 4 Aug 2021 13:39:50 -0400 Received: from [10.137.112.111] (unknown [131.107.147.111]) by linux.microsoft.com (Postfix) with ESMTPSA id A21FD20B36E0; Wed, 4 Aug 2021 10:39:37 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com A21FD20B36E0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1628098777; bh=BmxsRYJ0XNs021aqPW3vQh12zIMTm59GOpKwiHgA8s4=; h=Subject:To:References:From:Date:In-Reply-To:From; b=MeVnrRP1299IQ64R4yF3r31x9j5d4hqv1bfo4MBL829vq1Sqkqo+0MEdWOZaAXmum avJvtA5R3Mslkx3ZQwlv+dA6qTxAUK6XQwc5MPqMbQiNeOCM5d5Qu3RvMIvT5EL2RW dFnMQIQgY6fOXsuYDLbNDvXsr4AJeEFJ6UnU0J+U= Subject: Re: [PATCH v6 1/5] IMA: remove the dependency on CRYPTO_MD5 To: THOBY Simon , "zohar@linux.ibm.com" , "dmitry.kasatkin@gmail.com" , "linux-integrity@vger.kernel.org" , BARVAUX Didier References: <20210804092010.350372-1-simon.thoby@viveris.fr> <20210804092010.350372-2-simon.thoby@viveris.fr> From: Lakshmi Ramasubramanian Message-ID: Date: Wed, 4 Aug 2021 10:41:37 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.12.0 MIME-Version: 1.0 In-Reply-To: <20210804092010.350372-2-simon.thoby@viveris.fr> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org On 8/4/2021 2:20 AM, THOBY Simon wrote: > MD5 is a weak digest algorithm that shouldn't be used for cryptographic > operation. It hinders the efficiency of a patch set that aims to limit > the digests allowed for the extended file attribute namely security.ima. > MD5 is no longer a requirement for IMA, nor should it be used there. > > Remove the CRYPTO_MD5 dependency for IMA. Reviewed-by: Lakshmi Ramasubramanian > > Signed-off-by: Simon Thoby > --- > security/integrity/ima/Kconfig | 1 - > security/integrity/ima/ima_main.c | 3 ++- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > index d0ceada99243..f3a9cc201c8c 100644 > --- a/security/integrity/ima/Kconfig > +++ b/security/integrity/ima/Kconfig > @@ -6,7 +6,6 @@ config IMA > select SECURITYFS > select CRYPTO > select CRYPTO_HMAC > - select CRYPTO_MD5 > select CRYPTO_SHA1 > select CRYPTO_HASH_INFO > select TCG_TPM if HAS_IOMEM && !UML > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > index 1cba6beb5a60..b70ee0125168 100644 > --- a/security/integrity/ima/ima_main.c > +++ b/security/integrity/ima/ima_main.c > @@ -53,7 +53,8 @@ static int __init hash_setup(char *str) > if (strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) == 0) { > if (strncmp(str, "sha1", 4) == 0) { > ima_hash_algo = HASH_ALGO_SHA1; > - } else if (strncmp(str, "md5", 3) == 0) { > + } else if (IS_ENABLED(CONFIG_CRYPTO_MD5) > + && strncmp(str, "md5", 3) == 0) { > ima_hash_algo = HASH_ALGO_MD5; > } else { > pr_err("invalid hash algorithm \"%s\" for template \"%s\"", >