From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9BF9C433E0 for ; Thu, 28 May 2020 16:37:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BD79220829 for ; Thu, 28 May 2020 16:37:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405131AbgE1QhU (ORCPT ); Thu, 28 May 2020 12:37:20 -0400 Received: from mx2.suse.de ([195.135.220.15]:33366 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405088AbgE1QhO (ORCPT ); Thu, 28 May 2020 12:37:14 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 7AC4EAEA6; Thu, 28 May 2020 16:37:12 +0000 (UTC) Date: Thu, 28 May 2020 18:37:12 +0200 Message-ID: From: Takashi Iwai To: Roberto Sassu Cc: linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: Oops at boot with linux-next kernel with IMA boot options In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 28 May 2020 17:35:16 +0200, Takashi Iwai wrote: > > Hi Roberto, > > it seems that the recent changes in IMA in linux-next caused a > regression: namely it triggers an Oops when booting with the options > ima_policy=tcb ima_template_fmt='d-ng|n-ng|d|ng' And further experiment revealed that passing only ima_template_fmt=d is enough for triggering the bug. Other formats don't matter. (snip) > It's a KVM instance without any TPM stuff, just passed the options > above. I could trigger the same bug on a bare metal, too. > > Then I performed bisection and it spotted the commit: > 6f1a1d103b48b1533a9c804e7a069e2c8e937ce7 > ima: Switch to ima_hash_algo for boot aggregate > > Actually reverting this commit fixed the Oops again. So, looking at the fact above (triggered by "d") and this bisection result, it seems that the issue is specific to ima_eventdigest_init(). The difference from others is that this has a check by ima_template_hash_algo_allowed(), and currently the check allows only SHA1 and MD5, while now SHA256 is assigned as default. So I tested adding SHA256 there like below, and it seems working. Hopefully I'm heading to a right direction... thanks, Takashi --- a/security/integrity/ima/ima_template_lib.c +++ b/security/integrity/ima/ima_template_lib.c @@ -13,7 +13,8 @@ static bool ima_template_hash_algo_allowed(u8 algo) { - if (algo == HASH_ALGO_SHA1 || algo == HASH_ALGO_MD5) + if (algo == HASH_ALGO_SHA1 || algo == HASH_ALGO_SHA256 || + algo == HASH_ALGO_MD5) return true; return false;