| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <0f60b35e-eff6-20c6-363d-82f0b10a1c1f@linux.microsoft.com>
Date: Sun, 6 Dec 2020 18:03:10 -0800
From: Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>
To: Thiago Jung Bauermann <bauerman@...ux.ibm.com>
Cc: zohar@...ux.ibm.com, robh@...nel.org, gregkh@...uxfoundation.org,
james.morse@....com, catalin.marinas@....com, sashal@...nel.org,
will@...nel.org, mpe@...erman.id.au, benh@...nel.crashing.org,
paulus@...ba.org, robh+dt@...nel.org, frowand.list@...il.com,
vincenzo.frascino@....com, mark.rutland@....com,
dmitry.kasatkin@...il.com, jmorris@...ei.org, serge@...lyn.com,
pasha.tatashin@...een.com, allison@...utok.net,
kstewart@...uxfoundation.org, takahiro.akashi@...aro.org,
tglx@...utronix.de, masahiroy@...nel.org, bhsharma@...hat.com,
mbrugger@...e.com, hsinyi@...omium.org, tao.li@...o.com,
christophe.leroy@....fr, linux-integrity@...r.kernel.org,
linux-kernel@...r.kernel.org, devicetree@...r.kernel.org,
prsriva@...ux.microsoft.com, balajib@...ux.microsoft.com
Subject: Re: [PATCH v10 7/8] powerpc: Move arch_ima_add_kexec_buffer to ima
On 12/5/20 1:36 PM, Thiago Jung Bauermann wrote:
>
> Lakshmi Ramasubramanian <nramas@...ux.microsoft.com> writes:
>
>> arch_ima_add_kexec_buffer() sets the address and size of the IMA
>> measurement log in the architecture specific field in struct kimage.
>> This function does not have architecture specific code, but is
>> currently limited to powerpc.
>>
>> Move arch_ima_add_kexec_buffer() to
>> security/integrity/ima/ima_kexec.c so that it is accessible for
>> other architectures as well.
>>
>> Signed-off-by: Lakshmi Ramasubramanian <nramas@...ux.microsoft.com>
>
> Not sure if the maintainers will agree with me (see below), but FWIW:
>
> Reviewed-by: Thiago Jung Bauermann <bauerman@...ux.ibm.com>
>
>> ---
>> arch/powerpc/include/asm/ima.h | 3 ---
>> arch/powerpc/kexec/ima.c | 21 ---------------------
>> security/integrity/ima/ima_kexec.c | 22 ++++++++++++++++++++++
>> 3 files changed, 22 insertions(+), 24 deletions(-)
>>
>> diff --git a/arch/powerpc/include/asm/ima.h b/arch/powerpc/include/asm/ima.h
>> index d8444d27f0d8..d6ab5d944dcd 100644
>> --- a/arch/powerpc/include/asm/ima.h
>> +++ b/arch/powerpc/include/asm/ima.h
>> @@ -7,9 +7,6 @@
>> struct kimage;
>>
>> #ifdef CONFIG_IMA_KEXEC
>> -int arch_ima_add_kexec_buffer(struct kimage *image, unsigned long load_addr,
>> - size_t size);
>> -
>> int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node);
>> #else
>> static inline int setup_ima_buffer(const struct kimage *image, void *fdt,
>> diff --git a/arch/powerpc/kexec/ima.c b/arch/powerpc/kexec/ima.c
>> index bf7084c0c4da..b2793be353a9 100644
>> --- a/arch/powerpc/kexec/ima.c
>> +++ b/arch/powerpc/kexec/ima.c
>> @@ -13,27 +13,6 @@
>> #include <linux/libfdt.h>
>> #include <asm/ima.h>
>>
>> -/**
>> - * arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer
>> - *
>> - * @image: kimage struct to set IMA buffer data
>> - * @load_addr: Starting address where IMA buffer is loaded at
>> - * @size: Number of bytes in the IMA buffer
>> - *
>> - * Architectures should use this function to pass on the IMA buffer
>> - * information to the next kernel.
>> - *
>> - * Return: 0 on success, negative errno on error.
>> - */
>> -int arch_ima_add_kexec_buffer(struct kimage *image, unsigned long load_addr,
>> - size_t size)
>> -{
>> - image->arch.ima_buffer_addr = load_addr;
>> - image->arch.ima_buffer_size = size;
>> -
>> - return 0;
>> -}
>> -
>> static int write_number(void *p, u64 value, int cells)
>> {
>> if (cells == 1) {
>> diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
>> index 4d354593aecf..5263dafe8f4d 100644
>> --- a/security/integrity/ima/ima_kexec.c
>> +++ b/security/integrity/ima/ima_kexec.c
>> @@ -74,6 +74,28 @@ static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
>> return ret;
>> }
>>
>> +/**
>> + * arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer
>> + *
>> + * @image: kimage struct to set IMA buffer data
>> + * @load_addr: Starting address where IMA buffer is loaded at
>> + * @size: Number of bytes in the IMA buffer
>> + *
>> + * Architectures should use this function to pass on the IMA buffer
>> + * information to the next kernel.
>> + *
>> + * Return: 0 on success, negative errno on error.
>> + */
>> +static int arch_ima_add_kexec_buffer(struct kimage *image,
>> + unsigned long load_addr,
>> + size_t size)
>> +{
>> + image->arch.ima_buffer_addr = load_addr;
>> + image->arch.ima_buffer_size = size;
>> +
>> + return 0;
>> +}
>> +
>
> Both powerpc and arm64 use the definition above for
> arch_ima_add_kexec_buffer(), so it makes sense to share them as you do
> in this patch. This file isn't the best one to put arch-specific code
> which happens to be identical among architectures, but I can't think of
> somewhere else to put it.
>
> For now this isn't an issue since powerpc and arm64 are the only arches
> implementing tihs feature. If a third arch implemented it and also used
> the same function definition as above, it wouldn't be an issue either so
> perhaps this is good enough for the time being? :-)
If Mimi doesn't have any objection, I'll leave this function in this
file. The other option is to move this function also to
"drivers/of/kexec.c".
Please let me know.
>
> With this patch, the `#include <asm/ima.h>` in
> security/integrity/ima/ima.h can be removed. It was there just to
> provide a declaration of arch_ima_add_kexec_buffer().
>
Sure - will remove this #include.
thanks,
-lakshmi
Powered by blists - more mailing lists