Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5278aa52 authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: add audit log support for larger hashes 



Different files might be signed based on different hash algorithms.
This patch prefixes the audit log measurement hash with the hash
algorithm.

Changelog:
- use generic HASH_ALGO defintions
- use ':' as delimiter between the hash algorithm and the digest
  (Roberto Sassu)
- always include the hash algorithm used when audit-logging a measurement

Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: default avatarRoberto Sassu <roberto.sassu@polito.it>
Signed-off-by: default avatarPeter Moody <pmoody@google.com>
parent a71dc65d

security/integrity/ima/ima_api.c

+4 −1
Original line number Diff line number Diff line
@@ -270,6 +270,8 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, 
{

	struct audit_buffer *ab;

	char hash[(iint->ima_hash->length * 2) + 1];

	const char *algo_name = hash_algo_name[iint->ima_hash->algo];

	char algo_hash[sizeof(hash) + strlen(algo_name) + 2];

	int i;



	if (iint->flags & IMA_AUDITED)
@@ -287,7 +289,8 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, 
	audit_log_format(ab, "file=");

	audit_log_untrustedstring(ab, filename);

	audit_log_format(ab, " hash=");

	audit_log_untrustedstring(ab, hash);

	snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);

	audit_log_untrustedstring(ab, algo_hash);



	audit_log_task_info(ab, current);

	audit_log_end(ab);