summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.vnet.ibm.com>2013-06-07 14:16:38 +0400
committerMimi Zohar <zohar@linux.vnet.ibm.com>2013-10-27 05:32:46 +0400
commit5278aa52f35003ddafda80b0243b3693f935b134 (patch)
treeca904308ffb6482612ab6f74ee7480c8e4fcf18c /security
parenta71dc65d30a472409f05d247f4eab91b14acf2f5 (diff)
downloadlinux-5278aa52f35003ddafda80b0243b3693f935b134.tar.xz
ima: add audit log support for larger hashes
Different files might be signed based on different hash algorithms. This patch prefixes the audit log measurement hash with the hash algorithm. Changelog: - use generic HASH_ALGO defintions - use ':' as delimiter between the hash algorithm and the digest (Roberto Sassu) - always include the hash algorithm used when audit-logging a measurement Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Signed-off-by: Peter Moody <pmoody@google.com>
Diffstat (limited to 'security')
-rw-r--r--security/integrity/ima/ima_api.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index baa348179527..5fcc80695d87 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -270,6 +270,8 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
{
struct audit_buffer *ab;
char hash[(iint->ima_hash->length * 2) + 1];
+ const char *algo_name = hash_algo_name[iint->ima_hash->algo];
+ char algo_hash[sizeof(hash) + strlen(algo_name) + 2];
int i;
if (iint->flags & IMA_AUDITED)
@@ -287,7 +289,8 @@ void ima_audit_measurement(struct integrity_iint_cache *iint,
audit_log_format(ab, "file=");
audit_log_untrustedstring(ab, filename);
audit_log_format(ab, " hash=");
- audit_log_untrustedstring(ab, hash);
+ snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash);
+ audit_log_untrustedstring(ab, algo_hash);
audit_log_task_info(ab, current);
audit_log_end(ab);