ima: add audit log support for larger hashes
Different files might be signed based on different hash algorithms. This patch prefixes the audit log measurement hash with the hash algorithm. Changelog: - use generic HASH_ALGO defintions - use ':' as delimiter between the hash algorithm and the digest (Roberto Sassu) - always include the hash algorithm used when audit-logging a measurement Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Signed-off-by: Peter Moody <pmoody@google.com>
This commit is contained in:
Родитель
a71dc65d30
Коммит
5278aa52f3
|
@ -270,6 +270,8 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
|
|||
{
|
||||
struct audit_buffer *ab;
|
||||
char hash[(iint->ima_hash->length * 2) + 1];
|
||||
const char *algo_name = hash_algo_name[iint->ima_hash->algo];
|
||||
char algo_hash[sizeof(hash) + strlen(algo_name) + 2];
|
||||
int i;
|
||||
|
||||
if (iint->flags & IMA_AUDITED)
|
||||
|
@ -287,7 +289,8 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
|
|||
audit_log_format(ab, "file=");
|
||||
audit_log_untrustedstring(ab, filename);
|
||||
audit_log_format(ab, " hash=");
|
||||
audit_log_untrustedstring(ab, hash);
|
||||
snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);
|
||||
audit_log_untrustedstring(ab, algo_hash);
|
||||
|
||||
audit_log_task_info(ab, current);
|
||||
audit_log_end(ab);
|
||||
|
|
Загрузка…
Ссылка в новой задаче