Commit 87ac3d00 authored by Mimi Zohar's avatar Mimi Zohar
Browse files

evm: output EVM digest calculation info 



Output the data used in calculating the EVM digest and the resulting
digest as ascii hexadecimal strings.

Suggested-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> (CONFIG_DYNAMIC_DEBUG)
Reviewed-by: default avatarLakshmi Ramasubramanian <nramas@linux.microsoft.com>
Reported-by: kernel test robot <lkp@intel.com> (Use %zu for size_t)
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 52c20839

security/integrity/evm/evm_crypto.c

+43 −0
Original line number Diff line number Diff line
@@ -10,6 +10,8 @@ 
 *	 Using root's kernel master key (kmk), calculate the HMAC

 */



#define pr_fmt(fmt) "EVM: "fmt



#include <linux/export.h>

#include <linux/crypto.h>

#include <linux/xattr.h>
@@ -175,6 +177,30 @@ static void hmac_add_misc(struct shash_desc *desc, struct inode *inode, 
	    type != EVM_XATTR_PORTABLE_DIGSIG)

		crypto_shash_update(desc, (u8 *)&inode->i_sb->s_uuid, UUID_SIZE);

	crypto_shash_final(desc, digest);



	pr_debug("hmac_misc: (%zu) [%*phN]\n", sizeof(struct h_misc),

		 (int)sizeof(struct h_misc), &hmac_misc);

}



/*

 * Dump large security xattr values as a continuous ascii hexademical string.

 * (pr_debug is limited to 64 bytes.)

 */

static void dump_security_xattr(const char *prefix, const void *src,

				size_t count)

{

#if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)

	char *asciihex, *p;



	p = asciihex = kmalloc(count * 2 + 1, GFP_KERNEL);

	if (!asciihex)

		return;



	p = bin2hex(p, src, count);

	*p = 0;

	pr_debug("%s: (%zu) %.*s\n", prefix, count, (int)count * 2, asciihex);

	kfree(asciihex);

#endif

}



/*
@@ -230,6 +256,16 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry, 
					     req_xattr_value_len);

			if (is_ima)

				ima_present = true;



			if (req_xattr_value_len < 64)

				pr_debug("%s: (%zu) [%*phN]\n", req_xattr_name,

					 req_xattr_value_len,

					 (int)req_xattr_value_len,

					 req_xattr_value);

			else

				dump_security_xattr(req_xattr_name,

						    req_xattr_value,

						    req_xattr_value_len);

			continue;

		}

		size = vfs_getxattr_alloc(&init_user_ns, dentry, xattr->name,
@@ -246,6 +282,13 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry, 
		crypto_shash_update(desc, (const u8 *)xattr_value, xattr_size);

		if (is_ima)

			ima_present = true;



		if (xattr_size < 64)

			pr_debug("%s: (%zu) [%*phN]", xattr->name, xattr_size,

				 (int)xattr_size, xattr_value);

		else

			dump_security_xattr(xattr->name, xattr_value,

					    xattr_size);

	}

	hmac_add_misc(desc, inode, type, data->digest);

security/integrity/evm/evm_main.c

+4 −0
Original line number Diff line number Diff line
@@ -11,6 +11,8 @@ 
 *	evm_inode_removexattr, and evm_verifyxattr

 */



#define pr_fmt(fmt) "EVM: "fmt



#include <linux/init.h>

#include <linux/crypto.h>

#include <linux/audit.h>
@@ -272,6 +274,8 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, 
		else

			evm_status = INTEGRITY_FAIL;

	}

	pr_debug("digest: (%d) [%*phN]\n", digest.hdr.length, digest.hdr.length,

		  digest.digest);

out:

	if (iint)

		iint->evm_status = evm_status;