Re: [Linux-ima-devel] [PATCH v2 4/5] keys, trusted: modify arguments of tpm_pcr_extend()

[Roberto Sassu]

On 5/30/2017 2:06 PM, Mimi Zohar wrote:
> On Tue, 2017-05-30 at 09:36 +0200, Roberto Sassu wrote:
> > On 5/30/2017 5:35 AM, Mimi Zohar wrote:
> > > On Fri, 2017-05-05 at 16:21 +0200, Roberto Sassu wrote:
> > > > pcrlock() has been modified to pass the correct arguments
> > > > to tpm_pcr_extend(): the pointer of a tpm2_digest structure containing
> > > > a random value generated by tpm_get_random() and the size of the array (1).
> > >
> > > If the number of arguments is wrong, that means the patch that
> > > introduced the change is not bi-sect safe.  (This comment is
> > > applicable to patch 5/5 too.)
> >
> > Jarkko (the TPM driver maintainer) asked me to not introduce
> > a new function to pass multiple digests, but to modify
> > the parameters of tpm_pcr_extend().
>
> Since struct tpm2_digest is a static size, shouldn't we be able to
> compute the number of digests?

The length of 'hash' is not passed to tpm_pcr_extend().

The only way to avoid changing the number of parameters would
be to pass a buffer whose format is the same of the event log
format defined by TCG:

<algo count> <algo1 ID> <digest1> ... <algoN ID> <digestN>

Roberto

--
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Qiuen PENG, Shengli WANG