diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index caaedd4b58fd..cebaeb620b89 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -75,6 +75,7 @@ extern struct ima_algo_desc *ima_algo_array __ro_after_init; extern int ima_appraise; extern struct tpm_chip *ima_tpm_chip; extern const char boot_aggregate_name[]; +extern const char boot_aggregate_late_name[]; /* IMA event related data */ struct ima_event_data { diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c index 7e0aa09a12e6..d53f4d89a53e 100644 --- a/security/integrity/ima/ima_init.c +++ b/security/integrity/ima/ima_init.c @@ -22,6 +22,7 @@ /* name for boot aggregate entry */ const char boot_aggregate_name[] = "boot_aggregate"; +const char boot_aggregate_late_name[] = "boot_aggregate_late"; struct tpm_chip *ima_tpm_chip; /* Add the boot aggregate to the IMA measurement list and extend @@ -45,11 +46,11 @@ static int __init ima_add_boot_aggregate(void) const char *audit_cause = "ENOMEM"; struct ima_template_entry *entry; struct ima_iint_cache tmp_iint, *iint = &tmp_iint; - struct ima_event_data event_data = { .iint = iint, - .filename = boot_aggregate_name }; + struct ima_event_data event_data = { .iint = iint }; struct ima_max_digest_data hash; struct ima_digest_data *hash_hdr = container_of(&hash.hdr, struct ima_digest_data, hdr); + const char *filename; int result = -ENOMEM; int violation = 0; @@ -59,6 +60,12 @@ static int __init ima_add_boot_aggregate(void) iint->ima_hash->algo = ima_hash_algo; iint->ima_hash->length = hash_digest_size[ima_hash_algo]; + if (IS_ENABLED(CONFIG_IMA_INIT_LATE_SYNC)) + filename = boot_aggregate_late_name; + else + filename = boot_aggregate_name; + event_data.filename = filename; + /* * With TPM 2.0 hash agility, TPM chips could support multiple TPM * PCR banks, allowing firmware to configure and enable different @@ -86,7 +93,7 @@ static int __init ima_add_boot_aggregate(void) } result = ima_store_template(entry, violation, NULL, - boot_aggregate_name, + filename, CONFIG_IMA_MEASURE_PCR_IDX); if (result < 0) { ima_free_template_entry(entry); @@ -95,7 +102,7 @@ static int __init ima_add_boot_aggregate(void) } return 0; err_out: - integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, boot_aggregate_name, op, + integrity_audit_msg(AUDIT_INTEGRITY_PCR, NULL, filename, op, audit_cause, result, 0); return result; } diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c index 0e627eac9c33..8a89236f926c 100644 --- a/security/integrity/ima/ima_template_lib.c +++ b/security/integrity/ima/ima_template_lib.c @@ -363,7 +363,8 @@ int ima_eventdigest_init(struct ima_event_data *event_data, goto out; } - if ((const char *)event_data->filename == boot_aggregate_name) { + if ((const char *)event_data->filename == boot_aggregate_name || + (const char *)event_data->filename == boot_aggregate_late_name) { if (ima_tpm_chip) { hash.hdr.algo = HASH_ALGO_SHA1; result = ima_calc_boot_aggregate(hash_hdr);