ima_tpm.sh 2.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
  1. #!/bin/sh
  2. # SPDX-License-Identifier: GPL-2.0-or-later
  3. # Copyright (c) 2009 IBM Corporation
  4. # Copyright (c) 2018-2020 Petr Vorel <pvorel@suse.cz>
  5. # Author: Mimi Zohar <zohar@linux.ibm.com>
  6. #
  7. # Verify the boot and PCR aggregates.
  8. TST_CNT=2
  9. TST_NEEDS_CMDS="awk cut ima_boot_aggregate"
  10. . ima_setup.sh
  11. test1()
  12. {
  13. tst_res TINFO "verify boot aggregate"
  14. local zero="0000000000000000000000000000000000000000"
  15. local tpm_bios="$SECURITYFS/tpm0/binary_bios_measurements"
  16. local ima_measurements="$ASCII_MEASUREMENTS"
  17. local boot_aggregate boot_hash line
  18. # IMA boot aggregate
  19. read line < $ima_measurements
  20. boot_hash=$(echo $line | awk '{print $(NF-1)}' | cut -d':' -f2)
  21. if [ ! -f "$tpm_bios" ]; then
  22. tst_res TINFO "TPM Hardware Support not enabled in kernel or no TPM chip found"
  23. if [ "$boot_hash" = "$zero" ]; then
  24. tst_res TPASS "bios boot aggregate is 0"
  25. else
  26. tst_res TFAIL "bios boot aggregate is not 0"
  27. fi
  28. else
  29. boot_aggregate=$(ima_boot_aggregate $tpm_bios | grep "boot_aggregate:" | cut -d':' -f2)
  30. if [ "$boot_hash" = "$boot_aggregate" ]; then
  31. tst_res TPASS "bios aggregate matches IMA boot aggregate"
  32. else
  33. tst_res TFAIL "bios aggregate does not match IMA boot aggregate"
  34. fi
  35. fi
  36. }
  37. # Probably cleaner to programmatically read the PCR values directly
  38. # from the TPM, but that would require a TPM library. For now, use
  39. # the PCR values from /sys/devices.
  40. validate_pcr()
  41. {
  42. tst_res TINFO "verify PCR (Process Control Register)"
  43. local dev_pcrs="$1"
  44. local pcr hash aggregate_pcr
  45. aggregate_pcr="$(evmctl -v ima_measurement $BINARY_MEASUREMENTS 2>&1 | \
  46. grep 'HW PCR-10:' | awk '{print $3}')"
  47. if [ -z "$aggregate_pcr" ]; then
  48. tst_res TFAIL "failed to get PCR-10"
  49. return 1
  50. fi
  51. while read line; do
  52. pcr="$(echo $line | cut -d':' -f1)"
  53. if [ "$pcr" = "PCR-10" ]; then
  54. hash="$(echo $line | cut -d':' -f2 | awk '{ gsub (" ", "", $0); print tolower($0) }')"
  55. [ "$hash" = "$aggregate_pcr" ]
  56. return $?
  57. fi
  58. done < $dev_pcrs
  59. return 1
  60. }
  61. test2()
  62. {
  63. tst_res TINFO "verify PCR values"
  64. tst_check_cmds evmctl || return
  65. tst_res TINFO "evmctl version: $(evmctl --version)"
  66. local pcrs_path="/sys/class/tpm/tpm0/device/pcrs"
  67. if [ -f "$pcrs_path" ]; then
  68. tst_res TINFO "new PCRS path, evmctl >= 1.1 required"
  69. else
  70. pcrs_path="/sys/class/misc/tpm0/device/pcrs"
  71. fi
  72. if [ -f "$pcrs_path" ]; then
  73. validate_pcr $pcrs_path
  74. if [ $? -eq 0 ]; then
  75. tst_res TPASS "aggregate PCR value matches real PCR value"
  76. else
  77. tst_res TFAIL "aggregate PCR value does not match real PCR value"
  78. fi
  79. else
  80. tst_res TCONF "TPM Hardware Support not enabled in kernel or no TPM chip found"
  81. fi
  82. }
  83. tst_run