Skip to content

Commit c66ad32

Browse files
sarroutbisarroutbi
committed
Use new uefi_log_handler to fix count issues
Signed-off-by: Sergio Arroutbi <[email protected]>
1 parent 796fe7f commit c66ad32

File tree

4 files changed

+61
-71
lines changed

4 files changed

+61
-71
lines changed

‎Cargo.lock

Lines changed: 7 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎keylime-push-model-agent/src/struct_filler.rs

Lines changed: 27 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ use keylime::algorithms::HashAlgorithm;
44
use keylime::config::PushModelConfigTrait;
55
use keylime::context_info::ContextInfo;
66
use keylime::structures;
7+
use keylime::uefi::uefi_log_handler;
78
use log::error;
89

910
pub trait StructureFiller {
@@ -46,11 +47,30 @@ impl StructureFiller for FillerFromHardware<'_> {
4647

4748
pub struct FillerFromHardware<'a> {
4849
pub tpm_context_info: &'a mut ContextInfo,
50+
pub uefi_log_handler: Option<uefi_log_handler::UefiLogHandler>,
4951
}
5052

5153
impl<'a> FillerFromHardware<'a> {
5254
pub fn new(tpm_context_info: &'a mut ContextInfo) -> Self {
53-
FillerFromHardware { tpm_context_info }
55+
// TODO: Change config obtaining here to avoid repetitions
56+
let config = keylime::config::PushModelConfig::default();
57+
let uefi_log_handler = uefi_log_handler::UefiLogHandler::new(
58+
&config.get_uefi_logs_binary_file_path(),
59+
);
60+
if uefi_log_handler.is_err() {
61+
error!(
62+
"Failed to create UEFI log handler: {}",
63+
uefi_log_handler.unwrap_err()
64+
);
65+
return FillerFromHardware {
66+
tpm_context_info,
67+
uefi_log_handler: None,
68+
};
69+
}
70+
FillerFromHardware {
71+
tpm_context_info,
72+
uefi_log_handler: Some(uefi_log_handler.unwrap()),
73+
}
5474
}
5575
// TODO: Change this function to use the attestation request appropriately
5676
// Add self to the function signature to use the tpm_context
@@ -71,6 +91,10 @@ impl<'a> FillerFromHardware<'a> {
7191
error!("Failed to get PCR banks for SHA256");
7292
vec![]
7393
});
94+
let uefi_count = self
95+
.uefi_log_handler
96+
.as_ref()
97+
.map_or(0, |handler| handler.get_entry_count());
7498
structures::AttestationRequest {
7599
data: structures::RequestData {
76100
type_: "attestation".to_string(),
@@ -101,17 +125,7 @@ impl<'a> FillerFromHardware<'a> {
101125
evidence_type: "uefi_log".to_string(),
102126
capabilities: structures::LogCapabilities {
103127
evidence_version: Some(config.get_uefi_logs_evidence_version()),
104-
entry_count: keylime::file_ops::read_file(config.get_measuredboot_ml_count_file().as_str())
105-
.map(|content| {
106-
content
107-
.trim()
108-
.parse::<u32>()
109-
.unwrap_or(0)
110-
})
111-
.unwrap_or_else(|_| {
112-
error!("Failed to read UEFI logs entry count file");
113-
0
114-
}),
128+
entry_count: uefi_count,
115129
supports_partial_access: config.get_uefi_logs_supports_partial_access(),
116130
appendable: config.get_uefi_logs_appendable(),
117131
formats: config.get_uefi_logs_formats(),
@@ -121,17 +135,7 @@ impl<'a> FillerFromHardware<'a> {
121135
evidence_type: "ima_log".to_string(),
122136
capabilities: structures::LogCapabilities {
123137
evidence_version: None,
124-
entry_count: keylime::file_ops::read_file(config.get_ima_ml_count_file().as_str())
125-
.map(|content| {
126-
content
127-
.trim()
128-
.parse::<u32>()
129-
.unwrap_or(0)
130-
})
131-
.unwrap_or_else(|_| {
132-
error!("Failed to read IMA log entry count file");
133-
0
134-
}),
138+
entry_count: 0, // Placeholder, will be filled later
135139
supports_partial_access: config.get_ima_logs_supports_partial_access(),
136140
appendable: config.get_ima_logs_appendable(),
137141
formats: config.get_ima_logs_formats(),

‎keylime/src/config/push_model_config.rs

Lines changed: 26 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,6 @@ pub const DEFAULT_CONTACT_PORT: u32 = 9002;
99
pub const DEFAULT_IMA_ML_DIRECTORY_PATH: &str = "/sys/kernel/security/ima";
1010
pub static DEFAULT_IMA_ML_COUNT_FILE: Lazy<String> =
1111
Lazy::new(|| format!("{}/measurements", DEFAULT_IMA_ML_DIRECTORY_PATH));
12-
pub const DEFAULT_MEASUREDBOOT_ML_DIRECTORY_PATH: &str =
13-
"/sys/kernel/security/tpm0";
14-
pub static DEFAULT_MEASUREDBOOT_ML_COUNT_FILE: Lazy<String> =
15-
Lazy::new(|| format!("{}/count", DEFAULT_MEASUREDBOOT_ML_DIRECTORY_PATH));
1612
pub const DEFAULT_EK_HANDLE: &str = "";
1713
pub const DEFAULT_ENABLE_IAK_IDEVID: bool = false;
1814
pub const DEFAULT_IP: &str = "127.0.0.1";
@@ -26,6 +22,16 @@ pub const DEFAULT_SERVER_KEY_PASSWORD: &str = "";
2622
pub const DEFAULT_TPM_HASH_ALG: &str = "sha256";
2723
pub const DEFAULT_TPM_ENCRYPTION_ALG: &str = "rsa";
2824
pub const DEFAULT_TPM_SIGNING_ALG: &str = "rsassa";
25+
pub const DEFAULT_UEFI_LOGS_BINARY_PATH: &str = "/sys/kernel/security/tpm0";
26+
pub const DEFAULT_UEFI_LOGS_BINARY_FILE: &str = "binary_bios_measurements";
27+
pub static DEFAULT_UEFI_LOGS_BINARY_FILE_PATH: Lazy<String> =
28+
Lazy::new(|| {
29+
format!(
30+
"{}/{}",
31+
DEFAULT_UEFI_LOGS_BINARY_PATH, DEFAULT_UEFI_LOGS_BINARY_FILE
32+
)
33+
});
34+
2935
pub const DEFAULT_UUID: &str = "b0acd25f-2205-4c37-932d-e8f99a8d39ef";
3036

3137
// IMA logs specific defaults
@@ -45,8 +51,6 @@ pub trait PushModelConfigTrait {
4551
fn get_contact_port(&self) -> u32;
4652
fn get_enable_iak_idevid(&self) -> bool;
4753
fn get_ek_handle(&self) -> String;
48-
fn get_measuredboot_ml_directory_path(&self) -> String;
49-
fn get_measuredboot_ml_count_file(&self) -> String;
5054
fn get_ima_logs_appendable(&self) -> bool;
5155
fn get_ima_logs_formats(&self) -> Vec<String>;
5256
fn get_ima_logs_supports_partial_access(&self) -> bool;
@@ -63,6 +67,7 @@ pub trait PushModelConfigTrait {
6367
fn get_registrar_api_versions(&self) -> Vec<String>;
6468
fn get_api_versions(&self) -> Vec<String>;
6569
fn get_uefi_logs_appendable(&self) -> bool;
70+
fn get_uefi_logs_binary_file_path(&self) -> String;
6671
fn get_uefi_logs_evidence_version(&self) -> String;
6772
fn get_uefi_logs_formats(&self) -> Vec<String>;
6873
fn get_uefi_logs_supports_partial_access(&self) -> bool;
@@ -88,8 +93,6 @@ pub struct PushModelConfig {
8893
ima_logs_supports_partial_access: bool,
8994
ima_ml_directory_path: String,
9095
ima_ml_count_file: String,
91-
measuredboot_ml_directory_path: String,
92-
measuredboot_ml_count_file: String,
9396
registrar_api_versions: Vec<String>,
9497
registrar_ip: String,
9598
registrar_port: u32,
@@ -99,10 +102,11 @@ pub struct PushModelConfig {
99102
tpm_encryption_alg: String,
100103
tpm_hash_alg: String,
101104
tpm_signing_alg: String,
102-
uefi_logs_evidence_version: String,
103-
uefi_logs_supports_partial_access: bool,
104105
uefi_logs_appendable: bool,
106+
uefi_logs_binary_file_path: String,
107+
uefi_logs_evidence_version: String,
105108
uefi_logs_formats: Vec<String>,
109+
uefi_logs_supports_partial_access: bool,
106110
uuid: String,
107111
}
108112

@@ -126,11 +130,6 @@ impl PushModelConfig {
126130
.to_string()
127131
.clone(),
128132
ima_ml_count_file: DEFAULT_IMA_ML_COUNT_FILE.to_string().clone(),
129-
measuredboot_ml_directory_path:
130-
DEFAULT_MEASUREDBOOT_ML_DIRECTORY_PATH.to_string().clone(),
131-
measuredboot_ml_count_file: DEFAULT_MEASUREDBOOT_ML_COUNT_FILE
132-
.to_string()
133-
.clone(),
134133
registrar_ip: DEFAULT_REGISTRAR_IP.to_string(),
135134
registrar_port: DEFAULT_REGISTRAR_PORT,
136135
registrar_api_versions: DEFAULT_REGISTRAR_API_VERSIONS
@@ -149,6 +148,8 @@ impl PushModelConfig {
149148
.collect(),
150149
uefi_logs_supports_partial_access:
151150
DEFAULT_UEFI_LOGS_SUPPORTS_PARTIAL_ACCESS,
151+
uefi_logs_binary_file_path: DEFAULT_UEFI_LOGS_BINARY_FILE_PATH
152+
.to_string(),
152153
tpm_encryption_alg: DEFAULT_TPM_ENCRYPTION_ALG.to_string(),
153154
tpm_hash_alg: DEFAULT_TPM_HASH_ALG.to_string(),
154155
tpm_signing_alg: DEFAULT_TPM_SIGNING_ALG.to_string(),
@@ -186,14 +187,6 @@ impl PushModelConfigTrait for PushModelConfig {
186187
self.ima_logs_appendable
187188
}
188189

189-
fn get_ima_logs_formats(&self) -> Vec<String> {
190-
self.ima_logs_formats.clone()
191-
}
192-
193-
fn get_ima_logs_supports_partial_access(&self) -> bool {
194-
self.ima_logs_supports_partial_access
195-
}
196-
197190
fn get_ima_ml_count_file(&self) -> String {
198191
self.ima_ml_count_file.clone()
199192
}
@@ -202,12 +195,12 @@ impl PushModelConfigTrait for PushModelConfig {
202195
self.ima_ml_directory_path.clone()
203196
}
204197

205-
fn get_measuredboot_ml_directory_path(&self) -> String {
206-
self.measuredboot_ml_directory_path.clone()
198+
fn get_ima_logs_formats(&self) -> Vec<String> {
199+
self.ima_logs_formats.clone()
207200
}
208201

209-
fn get_measuredboot_ml_count_file(&self) -> String {
210-
self.measuredboot_ml_count_file.clone()
202+
fn get_ima_logs_supports_partial_access(&self) -> bool {
203+
self.ima_logs_supports_partial_access
211204
}
212205

213206
fn get_registrar_ip(&self) -> String {
@@ -238,6 +231,10 @@ impl PushModelConfigTrait for PushModelConfig {
238231
self.uefi_logs_appendable
239232
}
240233

234+
fn get_uefi_logs_binary_file_path(&self) -> String {
235+
self.uefi_logs_binary_file_path.clone()
236+
}
237+
241238
fn get_uefi_logs_evidence_version(&self) -> String {
242239
self.uefi_logs_evidence_version.clone()
243240
}
@@ -277,9 +274,9 @@ impl PushModelConfigTrait for PushModelConfig {
277274
enable_iak_idevid: {}, ek_handle: {},
278275
ima_logs_appendable: {}, ima_logs_formats: {:?}, ima_logs_supports_partial_access: {},
279276
ima_ml_directory_path: {}, ima_ml_count_file: {},
280-
measuredboot_ml_directory_path: {}, measuredboot_ml_count_file: {},
281277
registrar_ip: {}, registrar_port: {}, server_cert: {},
282278
server_key: {}, server_key_password: {},
279+
uefi_logs_binary_file_path: {},
283280
uefi_logs_evidence_version: {}, uefi_logs_supports_partial_access: {},
284281
uefi_logs_appendable: {}, uefi_logs_formats: {:?},
285282
tpm_encryption_alg: {}, tpm_hash_alg: {}, tpm_signing_alg: {},
@@ -294,13 +291,12 @@ impl PushModelConfigTrait for PushModelConfig {
294291
self.ima_logs_supports_partial_access,
295292
self.ima_ml_directory_path,
296293
self.ima_ml_count_file,
297-
self.measuredboot_ml_directory_path,
298-
self.measuredboot_ml_count_file,
299294
self.registrar_ip,
300295
self.registrar_port,
301296
self.server_cert,
302297
self.server_key,
303298
self.server_key_password,
299+
self.uefi_logs_binary_file_path,
304300
self.uefi_logs_evidence_version,
305301
self.uefi_logs_supports_partial_access,
306302
self.uefi_logs_appendable,
@@ -355,14 +351,6 @@ mod tests {
355351
pmc.get_ima_ml_count_file()
356352
== DEFAULT_IMA_ML_COUNT_FILE.to_string()
357353
);
358-
assert!(
359-
pmc.get_measuredboot_ml_directory_path()
360-
== DEFAULT_MEASUREDBOOT_ML_DIRECTORY_PATH
361-
);
362-
assert!(
363-
pmc.get_measuredboot_ml_count_file()
364-
== DEFAULT_MEASUREDBOOT_ML_COUNT_FILE.to_string()
365-
);
366354
assert!(pmc.get_registrar_ip() == DEFAULT_REGISTRAR_IP);
367355
assert!(pmc.get_registrar_port() == DEFAULT_REGISTRAR_PORT);
368356
assert!(pmc.get_server_cert() == DEFAULT_SERVER_CERT);
@@ -416,11 +404,6 @@ mod tests {
416404
));
417405
assert!(display_string.contains(&pmc.get_ima_ml_directory_path()));
418406
assert!(display_string.contains(&pmc.get_ima_ml_count_file()));
419-
assert!(display_string
420-
.contains(&pmc.get_measuredboot_ml_directory_path()));
421-
assert!(
422-
display_string.contains(&pmc.get_measuredboot_ml_count_file())
423-
);
424407
assert!(display_string.contains(&pmc.get_registrar_ip()));
425408
assert!(
426409
display_string.contains(&pmc.get_registrar_port().to_string())

‎keylime/src/structures/capabilities_negotiation.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ pub enum EvidenceSupported {
4141
pub struct LogCapabilities {
4242
#[serde(skip_serializing_if = "Option::is_none")]
4343
pub evidence_version: Option<String>,
44-
pub entry_count: u32,
44+
pub entry_count: usize,
4545
pub supports_partial_access: bool,
4646
pub appendable: bool,
4747
pub formats: Vec<String>,

0 commit comments

Comments
 (0)