linux-kernel - Re: [PATCH v7 2/4] powerpc: Refactor kexec functions to move arch independent code to ima

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b8e04f61016b558ad62c4ac0aba183bab521664c.camel@linux.ibm.com>
Date:   Tue, 20 Oct 2020 23:50:41 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>,
        bauerman@...ux.ibm.com, robh@...nel.org,
        gregkh@...uxfoundation.org, james.morse@....com,
        catalin.marinas@....com, sashal@...nel.org, will@...nel.org,
        mpe@...erman.id.au, benh@...nel.crashing.org, paulus@...ba.org,
        robh+dt@...nel.org, frowand.list@...il.com,
        vincenzo.frascino@....com, mark.rutland@....com,
        dmitry.kasatkin@...il.com, jmorris@...ei.org, serge@...lyn.com,
        pasha.tatashin@...een.com, allison@...utok.net,
        kstewart@...uxfoundation.org, takahiro.akashi@...aro.org,
        tglx@...utronix.de, masahiroy@...nel.org, bhsharma@...hat.com,
        mbrugger@...e.com, hsinyi@...omium.org, tao.li@...o.com,
        christophe.leroy@....fr
Cc:     linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org,
        devicetree@...r.kernel.org, prsriva@...ux.microsoft.com,
        balajib@...ux.microsoft.com
Subject: Re: [PATCH v7 2/4] powerpc: Refactor kexec functions to move arch
 independent code to ima

Hi Lakshmi,

On Tue, 2020-10-20 at 19:38 -0700, Lakshmi Ramasubramanian wrote:
> On 10/20/20 1:01 PM, Mimi Zohar wrote:
> > On Wed, 2020-09-30 at 13:59 -0700, Lakshmi Ramasubramanian wrote:
> >> The functions ima_get_kexec_buffer() and ima_free_kexec_buffer(),
> >> that handle carrying forward the IMA measurement logs on kexec for
> >> powerpc do not have architecture specific code, but they are currently
> >> defined for powerpc only.
> >>
> >> Move ima_get_kexec_buffer() and ima_free_kexec_buffer() to IMA
> >> subsystem. A later patch in this series will use these functions for
> >> carrying forward the IMA measurement log for ARM64.
> >>
> >> With the above refactoring arch/powerpc/kexec/ima.c contains only
> >> functions used when CONFIG_IMA_KEXEC is enabled. Update Makefile
> >> in arch/powerpc/kexec to include arch/powerpc/kexec/ima.c only
> >> when CONFIG_IMA_KEXEC is enabled.
> >>
> >> Move ima_dump_measurement_list() and ima_add_kexec_buffer() to
> >> a new file namely ima_kexec_fdt.c in IMA. Update
> >> security/integrity/ima/Makefile to include ima_kexec_fdt.c only
> >> when CONFIG_IMA_KEXEC is enabled.
> >>
> >> Co-developed-by: Prakhar Srivastava <prsriva@...ux.microsoft.com>
> >> Signed-off-by: Prakhar Srivastava <prsriva@...ux.microsoft.com>
> >> Signed-off-by: Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>
> > 
> > The existing support for carrying the IMA measurement list across kexec
> > is limited to powerpc.  This patch set is adding similar support for
> > arm64, making as much of the existing code as generic as possible.
> > However ima_dump_measurement_list() is already generic, but for some
> > reason this patch moves it to ima_kexec_fdt.c.  ima_kexec_fdt.c should
> > be limited to device tree specific code.
> 
> I wanted to split the functions defined under CONFIG_HAVE_IMA_KEXEC and 
> CONFIG_IMA_KEXEC to separate files so that we can get rid of #ifdef in C 
> file and instead conditionally compile the C files (using Makefile).
> 
> ima_dump_measurement_list() need to be defined only when 
> CONFIG_IMA_KEXEC is defined. I moved it to ima_kexec_fdt.c

In this case, everything in ima_kexec.c relates to carrying or
restoring the measurement list.  It's a logical unit.  Separating them
doesn't make sense.

> 
> Instead of ima_kexec_fdt.c, where ima_dump_measurement_list() and 
> ima_add_kexec_buffer() are defined, perhaps I can change the file name 
> to "ima_kexec_buffer.c". Would that be better?

I don't understand why adding support for carrying the IMA measurement
across kexec on ARM64, should require any changes in the IMA loading
and restoring the measurement list code itself.  Please minimize the
changes.

thanks,

Mimi