Compare commits
No commits in common. 'c9' and 'i9c-beta' have entirely different histories.
@ -1,59 +0,0 @@
|
||||
--- a/scripts/create_runtime_policy.sh 2023-10-09 17:04:26.121194607 +0200
|
||||
+++ b/scripts/create_runtime_policy.sh 2023-10-09 17:06:02.089855614 +0200
|
||||
@@ -42,7 +42,7 @@
|
||||
exit $NOARGS;
|
||||
fi
|
||||
|
||||
-ALGO=sha1sum
|
||||
+ALGO=sha256sum
|
||||
|
||||
ALGO_LIST=("sha1sum" "sha256sum" "sha512sum")
|
||||
|
||||
@@ -78,7 +78,7 @@
|
||||
|
||||
|
||||
# Where to look for initramfs image
|
||||
-INITRAMFS_LOC="/boot/"
|
||||
+INITRAMFS_LOC="/boot"
|
||||
if [ -d "/ostree" ]; then
|
||||
# If we are on an ostree system change where we look for initramfs image
|
||||
loc=$(grep -E "/ostree/[^/]([^/]*)" -o /proc/cmdline | head -n 1 | cut -d / -f 3)
|
||||
@@ -121,7 +121,7 @@
|
||||
cp -r /tmp/ima/$i-extracted-unmk/. /tmp/ima/$i-extracted
|
||||
fi
|
||||
elif [[ -x "/usr/lib/dracut/skipcpio" ]] ; then
|
||||
- /usr/lib/dracut/skipcpio $i | gunzip -c | cpio -i -d 2> /dev/null
|
||||
+ /usr/lib/dracut/skipcpio $i | gunzip -c 2> /dev/null | cpio -i -d 2> /dev/null
|
||||
else
|
||||
echo "ERROR: No tools for initramfs image processing found!"
|
||||
break
|
||||
@@ -130,9 +130,26 @@
|
||||
find -type f -exec $ALGO "./{}" \; | sed "s| \./\./| /|" >> $OUTPUT
|
||||
done
|
||||
|
||||
-# Convert to runtime policy
|
||||
-echo "Converting created allowlist to Keylime runtime policy"
|
||||
-python3 $WORKING_DIR/../keylime/cmd/convert_runtime_policy.py -a $OUTPUT -o $OUTPUT
|
||||
+# when ROOTFS_LOC = '/', the path starts on allowlist ends up with double '//'
|
||||
+#
|
||||
+# Example:
|
||||
+#
|
||||
+# b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c //bar
|
||||
+#
|
||||
+# Replace the unwanted '//' with a single '/'
|
||||
+sed -i 's| /\+| /|g' $ALLOWLIST_DIR/${OUTPUT}
|
||||
+
|
||||
+# When the file name contains newlines or backslashes, the output of sha256sum
|
||||
+# adds a backslash at the beginning of the line.
|
||||
+#
|
||||
+# Example:
|
||||
+#
|
||||
+# $ echo foo > ba\\r
|
||||
+# $ sha256sum ba\\r
|
||||
+# \b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c ba\\r
|
||||
+#
|
||||
+# Remove the unwanted backslash prefix
|
||||
+sed -i 's/^\\//g' $ALLOWLIST_DIR/${OUTPUT}
|
||||
|
||||
# Clean up
|
||||
rm -rf /tmp/ima
|
||||
@ -1,44 +0,0 @@
|
||||
diff --git a/keylime/cloud_verifier_common.py b/keylime/cloud_verifier_common.py
|
||||
index a7399d2..c0f416d 100644
|
||||
--- a/keylime/cloud_verifier_common.py
|
||||
+++ b/keylime/cloud_verifier_common.py
|
||||
@@ -8,7 +8,7 @@ from keylime.agentstates import AgentAttestState, AgentAttestStates, TPMClockInf
|
||||
from keylime.common import algorithms
|
||||
from keylime.db.verifier_db import VerfierMain
|
||||
from keylime.failure import Component, Event, Failure
|
||||
-from keylime.ima import file_signatures
|
||||
+from keylime.ima import file_signatures, ima
|
||||
from keylime.ima.types import RuntimePolicyType
|
||||
from keylime.tpm import tpm_util
|
||||
from keylime.tpm.tpm_main import Tpm
|
||||
@@ -271,7 +271,7 @@ def process_get_status(agent: VerfierMain) -> Dict[str, Any]:
|
||||
logger.debug('The contents of the agent %s attribute "mb_refstate" are %s', agent.agent_id, agent.mb_refstate)
|
||||
|
||||
has_runtime_policy = 0
|
||||
- if agent.ima_policy.generator and agent.ima_policy.generator > 1:
|
||||
+ if agent.ima_policy.generator and agent.ima_policy.generator > ima.RUNTIME_POLICY_GENERATOR.EmptyAllowList:
|
||||
has_runtime_policy = 1
|
||||
|
||||
response = {
|
||||
diff --git a/keylime/cmd/create_policy.py b/keylime/cmd/create_policy.py
|
||||
index 0841d64..086b92a 100755
|
||||
--- a/keylime/cmd/create_policy.py
|
||||
+++ b/keylime/cmd/create_policy.py
|
||||
@@ -6,6 +6,7 @@ import argparse
|
||||
import binascii
|
||||
import collections
|
||||
import copy
|
||||
+import datetime
|
||||
import gzip
|
||||
import json
|
||||
import multiprocessing
|
||||
@@ -580,6 +581,9 @@ def main() -> None:
|
||||
policy["excludes"] = sorted(list(set(policy["excludes"])))
|
||||
policy["ima"]["ignored_keyrings"] = sorted(list(set(policy["ima"]["ignored_keyrings"])))
|
||||
|
||||
+ policy["meta"]["generator"] = ima.RUNTIME_POLICY_GENERATOR.LegacyAllowList
|
||||
+ policy["meta"]["timestamp"] = str(datetime.datetime.now())
|
||||
+
|
||||
try:
|
||||
ima.validate_runtime_policy(policy)
|
||||
except ima.ImaValidationError as ex:
|
||||
@ -1,80 +0,0 @@
|
||||
From add9847988e963fd124863736592fc16cc8c716b Mon Sep 17 00:00:00 2001
|
||||
From: Stefan Berger <stefanb@linux.ibm.com>
|
||||
Date: Tue, 11 Jul 2023 18:03:28 -0400
|
||||
Subject: [PATCH 14/14] tpm_util: Replace a logger.error with an Exception in
|
||||
case of invalid signature
|
||||
|
||||
This fixes a possibly severe issue in 7.2.5 & 7.3.0.
|
||||
|
||||
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
|
||||
---
|
||||
keylime/tpm/tpm_util.py | 6 +-----
|
||||
keylime/tpm/tpm_util_test.py | 21 +++++++++++++++++++++
|
||||
2 files changed, 22 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/keylime/tpm/tpm_util.py b/keylime/tpm/tpm_util.py
|
||||
index ce2ce0f..58a1a04 100644
|
||||
--- a/keylime/tpm/tpm_util.py
|
||||
+++ b/keylime/tpm/tpm_util.py
|
||||
@@ -3,7 +3,6 @@ import string
|
||||
import struct
|
||||
from typing import Any, Dict, List, Optional, Tuple, Union
|
||||
|
||||
-from cryptography.exceptions import InvalidSignature
|
||||
from cryptography.hazmat import backends
|
||||
from cryptography.hazmat.primitives import hashes, hmac, serialization
|
||||
from cryptography.hazmat.primitives.asymmetric import ec, padding
|
||||
@@ -155,10 +154,7 @@ def checkquote(
|
||||
digest.update(quoteblob)
|
||||
quote_digest = digest.finalize()
|
||||
|
||||
- try:
|
||||
- verify(pubkey, signature, quote_digest, hashfunc)
|
||||
- except InvalidSignature:
|
||||
- logger.error("Invalid quote signature!")
|
||||
+ verify(pubkey, signature, quote_digest, hashfunc)
|
||||
|
||||
# Check that reported nonce is expected one
|
||||
retDict = tpm2_objects.unmarshal_tpms_attest(quoteblob)
|
||||
diff --git a/keylime/tpm/tpm_util_test.py b/keylime/tpm/tpm_util_test.py
|
||||
index aaf16cd..2c73997 100644
|
||||
--- a/keylime/tpm/tpm_util_test.py
|
||||
+++ b/keylime/tpm/tpm_util_test.py
|
||||
@@ -2,6 +2,7 @@ import base64
|
||||
import unittest
|
||||
from unittest import mock
|
||||
|
||||
+from cryptography.exceptions import InvalidSignature
|
||||
from cryptography.hazmat.primitives.asymmetric.ec import (
|
||||
SECP256R1,
|
||||
EllipticCurve,
|
||||
@@ -60,6 +61,26 @@ class TestTpmUtil(unittest.TestCase):
|
||||
except Exception as e:
|
||||
self.fail(f"checkquote failed with {e}")
|
||||
|
||||
+ # test bad input
|
||||
+ bad_quoteblob = bytearray(quoteblob)
|
||||
+ bad_quoteblob[5] ^= 0x1
|
||||
+ with self.assertRaises(InvalidSignature):
|
||||
+ checkquote(aikblob, nonce, sigblob, bad_quoteblob, pcrblob, "sha256")
|
||||
+
|
||||
+ l = list(nonce)
|
||||
+ l[0] = "a"
|
||||
+ bad_nonce = "".join(l)
|
||||
+ with self.assertRaises(Exception):
|
||||
+ checkquote(aikblob, bad_nonce, sigblob, quoteblob, pcrblob, "sha256")
|
||||
+
|
||||
+ bad_pcrblob = bytearray(pcrblob)
|
||||
+ bad_pcrblob[5] ^= 0x1
|
||||
+ with self.assertRaises(Exception):
|
||||
+ checkquote(aikblob, nonce, sigblob, quoteblob, bad_pcrblob, "sha256")
|
||||
+
|
||||
+ with self.assertRaises(ValueError):
|
||||
+ checkquote(aikblob, nonce, sigblob, quoteblob, pcrblob, "sha1")
|
||||
+
|
||||
@staticmethod
|
||||
def not_random(numbytes: int) -> bytes:
|
||||
return b"\x12" * numbytes
|
||||
--
|
||||
2.41.0
|
||||
|
||||
Loading…
Reference in new issue