linux-kernel - Re: [PATCH v3] ima: Suspend PCR extends and log appends when rebooting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <539ec9eb95fbb5fd0a092ffb9b3c1adb1031de5c.camel@linux.ibm.com>
Date: Mon, 18 Nov 2024 19:56:53 -0500
From: Mimi Zohar <zohar@...ux.ibm.com>
To: Stefan Berger <stefanb@...ux.vnet.ibm.com>,
        linux-integrity@...r.kernel.org, linux-security-module@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, roberto.sassu@...wei.com,
        Stefan Berger
	 <stefanb@...ux.ibm.com>,
        Tushar Sugandhi <tusharsu@...ux.microsoft.com>
Subject: Re: [PATCH v3] ima: Suspend PCR extends and log appends when
 rebooting

On Mon, 2024-11-18 at 09:57 -0500, Stefan Berger wrote:
> From: Stefan Berger <stefanb@...ux.ibm.com>
> 
> To avoid the following types of error messages due to a failure by the TPM
> driver to use the TPM, suspend TPM PCR extensions and the appending of
> entries to the IMA log once IMA's reboot notifier has been called. This
> avoids trying to use the TPM after the TPM subsystem has been shut down.
> 
> [111707.685315][    T1] ima: Error Communicating to TPM chip, result: -19
> [111707.685960][    T1] ima: Error Communicating to TPM chip, result: -19
> 
> Synchronization with the ima_extend_list_mutex to set
> ima_measurements_suspended ensures that the TPM subsystem is not shut down
> when IMA holds the mutex while appending to the log and extending the PCR.
> The alternative of reading the system_state variable would not provide this
> guarantee.
> 
> This error could be observed on a ppc64 machine running SuSE Linux where
> processes are still accessing files after devices have been shut down.
> 
> Suspending the IMA log and PCR extensions shortly before reboot does not
> seem to open a significant measurement gap since neither TPM quoting would
> work for attestation nor that new log entries could be written to anywhere
> after devices have been shut down. However, there's a time window between
> the invocation of the reboot notifier and the shutdown of devices. This
> includes all subsequently invoked reboot notifiers as well as
> kernel_restart_prepare() where __usermodehelper_disable() waits for all
> running_helpers to exit. During this time window IMA could now miss log
> entries even though attestation would still work. The reboot of the system
> shortly after may make this small gap insignificant.
> 
> Signed-off-by: Tushar Sugandhi <tusharsu@...ux.microsoft.com>
> Signed-off-by: Stefan Berger <stefanb@...ux.ibm.com>

Thank you for updating the patch description and the comment below.  The patch
is now queued in next-integrity-testing.

Mimi

> ---

[...] 
> 						       int pcr)
> @@ -168,6 +175,18 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
>  	int result = 0, tpmresult = 0;
>  
>  	mutex_lock(&ima_extend_list_mutex);
> +
> +	/*
> +	 * Avoid appending to the measurement log when the TPM subsystem has
> +	 * been shut down while preparing for system reboot.
> +	 */
> +	if (ima_measurements_suspended) {
> +		audit_cause = "measurements_suspended";
> +		audit_info = 0;
> +		result = -ENODEV;
> +		goto out;
> +	}
> +
>  	if (!violation && !IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE)) {
>  		if (ima_lookup_digest_entry(digest, entry->pcr)) {
>  			audit_cause = "hash_exists";
> @@ -211,6 +230,31 @@ int ima_restore_measurement_entry(struct ima_template_entry *entry)
>  	return result;
>  }