[Linux-ima-user] Calculate Template Hash using ruby

[Jens L. <in...@je...>]

Hello,

I am trying to calculate the template hash for ima-ng using ruby but 
after trying lots of combinations it seems I am not getting the correct 
hash value.

According to documentation the template hash is:
template-hash: sha1 hash(filedata-hash length, filedata-hash, pathname 
length, pathname)

So I am trying to re-calculate the following IMA measurement:
10 79fa39c792abfd03ba7569e1900d155f993b01e8 ima-ng 
sha1:037d38f6148770b9565ba3f6b532c7794e37e025 /sbin/init

I would be happy if someone could have a look what I am doing wrong here.

Thanks,

Jens Lucius


#!/usr/bin/env ruby
require 'digest/sha1'
fhash="sha1:037d38f6148770b9565ba3f6b532c7794e37e025"
fhash2="037d38f6148770b9565ba3f6b532c7794e37e025"
thash="79fa39c792abfd03ba7569e1900d155f993b01e8"
fname="/sbin/init"
hash=Digest::SHA1.hexdigest([fhash.length].pack('i') + "sha1:" + 
[fhash2].pack('H*') + [fname.length].pack('i') + fname)
print "\nTest: #{thash==hash} ima #{thash} hash: #{hash}"