linux-kernel - Re: ima measurement carrying on -mm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87wphuwf8j.fsf@x220.int.ebiederm.org>
Date:   Thu, 29 Sep 2016 16:47:08 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     Thiago Jung Bauermann <bauerman@...ux.vnet.ibm.com>,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Mimi Zohar <zohar@...ux.vnet.ibm.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: ima measurement carrying on -mm

Andrew Morton <akpm@...ux-foundation.org> writes:

> On Thu, 29 Sep 2016 17:44:10 -0300 Thiago Jung Bauermann <bauerman@...ux.vnet.ibm.com> wrote:
>
>> Hello Andrew,
>> 
>> You have in the -mm tree a version of the "kexec handover buffer" and "ima 
>> carry measurement list" patches that were NAKed by Eric Biederman. I would 
>> just like to double-check that there's no risk of that version reaching 
>> v4.9.
>> 
>> Mimi posted v5 of a merged patch set that addresses Eric's concern:
>> 
>> https://lists.ozlabs.org/pipermail/linuxppc-dev/2016-September/149183.html
>> 
>> There are no separate kexec handover patches anymore. They were folded into 
>> the series above. The kexec code is simplified now, it doesn't support 
>> updating the buffer and recalculating the hash on reboot, and is now IMA-
>> specific instead of a generic kexec feature.
>
> Yup, thanks.
>
> I wasn't thinking any of this material is suitable for 4.9.  Seems that
> a bit more consideration will be needed.  Am I wrong about that?

With Mimi's v5 version of these patches the kexec portions look reasonable
and the rest is pretty much just ima code and a little bit of powerpc
specific glue (as this is only currently supported for the powerpc
way of passing boot parameters).

> Are all of these -mm patches up to date?

No.  There was a v5 that mimi posted.  I think the patches listed below are
obsolete at this point.

> kexec_file-allow-arch-specific-memory-walking-for-kexec_add_buffer.patch
> kexec_file-change-kexec_add_buffer-to-take-kexec_buf-as-argument.patch
> kexec_file-factor-out-kexec_locate_mem_hole-from-kexec_add_buffer.patch
> powerpc-change-places-using-config_kexec-to-use-config_kexec_core-instead.patch
> powerpc-factor-out-relocation-code-from-module_64c-to-elf_util_64c.patch
> powerpc-generalize-elf64_apply_relocate_add.patch
> powerpc-adapt-elf64_apply_relocate_add-for-kexec_file_load.patch
> powerpc-add-functions-to-read-elf-files-of-any-endianness.patch
> powerpc-implement-kexec_file_load.patch
> powerpc-add-code-to-work-with-device-trees-in-kexec_file_load.patch
> powerpc-add-support-for-loading-elf-kernels-with-kexec_file_load.patch
> powerpc-add-support-for-loading-elf-kernels-with-kexec_file_load-fix.patch
> powerpc-add-purgatory-for-kexec_file_load-implementation.patch
> powerpc-add-purgatory-for-kexec_file_load-implementation-fix.patch
> powerpc-enable-config_kexec_file-in-powerpc-server-defconfigs.patch
> #
> kexec_file-include-the-purgatory-segment-in-the-kexec-image-checksum.patch
> kexec_file-add-buffer-hand-over-support-for-the-next-kernel.patch
> powerpc-kexec_file-add-buffer-hand-over-support-for-the-next-kernel.patch
> kexec_file-add-mechanism-to-update-kexec-segments.patch

Eric