scripts/create_allowlist.sh doesn't produce a boot_aggregate item and IMA attestation requires it

Is your an issue a feature request? If so, please raise it as an enhancement

I believe it is an issue with the current implementation.

Environment

• OS / version: Fedora Server 33
• Processor architecture: x86_64
• TPM Manufacturer: Microsoft HyperV vTPM
• Keylime version: keylime-5.8.0-1.fc33.noarch

Description

scripts/create_allowlist.sh does not add a boot_aggregate item, nor have an option to add the current one. After generating the allowlist and using keylime_tenant to set up IMA attestation, I get the following message:

2021-02-12 16:03:32.281 - keylime.ima - WARNING - No boot_aggregate value found in allowlist, adding an empty one

Then, attestation fails because it compares against 0.

To workaround this, add a “boot_aggregate” item with the corresponding digest. To add the current boot_aggregate for the current system:

grep boot_aggregate /sys/kernel/security/ima/ascii_runtime_measurements | awk '{ sub("sha256:","",$4); print $4 "  " $5 }' >> allowlist.txt

Expected behavior vs. actual behavior

Expected behaviour is one of the following:

1. You should not need to add a boot_aggregate in allowlist. The expected boot_aggregate should be taken from the TPM Quote, by concatenating and digesting the reported PCR 0 to 7 values. The IMA Measurement Log boot_aggregate should be compared with the recontructed boot_aggregate from the TPM Quote. If that matches, then we can start trusting whatever is in the IMA Measurement Log
2. The tool should warn about the missing boot_aggregate item, or ask to include the current one (it is taking the current digest of the binaries, so getting the current boot_aggregate make sense here as well)
3. Reconstruct the boot_aggregate from the current PCR values an add it to the allowlist?

Steps to reproduce problem

1. Run scripts/create_allowlist.sh allowlist.txt sha256sum
2. Use allowlist.txt to add a host with the keylime_tenant command
3. IMA Attestation will fail

Relevant logs

2021-02-12 16:03:32.281 - keylime.ima - WARNING - No boot_aggregate value found in allowlist, adding an empty one

Attach any relevant log files that can help to debug your issue.

[dnoliver]

I think that, to solve the immediate problem of having a demo that just works, adding some commands in scripts/create_allowlist.sh to append the current boot_aggregate (taken from /sys/kernel/security/ima/ascii_runtime_measurement or computed from the output of tpm2_pcrread) to the allowlist output works. I think I can do that @lukehinds 😃

But for the future, I really think that keylime should quote PCR 0 to 7 when the --allowlist is used, compute the boot_aggregate from the quote, and use that value for comparison with the boot_aggregate reported in the IMA measurement log. But this is a much bigger change.

I was also going to say something about the SHA1 bank being used by default, arguing that Fedora now uses SHA256 for everything related to IMA by default, but I noticed that still defaults to SHA1 in the PCR bank selection 😦. I filed a bug for this in https://bugzilla.redhat.com/show_bug.cgi?id=1928286

[maugustosilva]

@dnoliver @lukehinds Two quick comments:

1. Yes, you are correct, the scripts we have currently on the repository do not add the boot aggregate as the first item on the allowlist, and the solution that you pointed out (grabbing from ascii_runtime_measurement) is the correct one. We have been using internally a significantly improved version of the script, and I fully intend to open a PR on this.
2. The computation of the value of PCRs is of utmost importance, and we are doing a non-trivial amount of work to get that incorporated into Keylime as quickly as possible. Please take a look https://github.com/keylime/keylime/issues/491 and you will see that we are including (and validating) PCRs 0-9 (and 11-14) independently of IMA (using “TPM pre-boot event logs”). We have one PR already merged (#517), one waiting to be merged (#534), with two more ready to go.