| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20250304190351.96975-6-chenste@linux.microsoft.com>
Date: Tue, 4 Mar 2025 11:03:49 -0800
From: steven chen <chenste@...ux.microsoft.com>
To: zohar@...ux.ibm.com,
stefanb@...ux.ibm.com,
roberto.sassu@...weicloud.com,
roberto.sassu@...wei.com,
eric.snowberg@...cle.com,
ebiederm@...ssion.com,
paul@...l-moore.com,
code@...icks.com,
bauermann@...abnow.com,
linux-integrity@...r.kernel.org,
kexec@...ts.infradead.org,
linux-security-module@...r.kernel.org,
linux-kernel@...r.kernel.org
Cc: madvenka@...ux.microsoft.com,
nramas@...ux.microsoft.com,
James.Bottomley@...senPartnership.com,
bhe@...hat.com,
vgoyal@...hat.com,
dyoung@...hat.com
Subject: [PATCH v9 5/7] ima: kexec: move IMA log copy from kexec load to execute
ima_dump_measurement_list() is called during kexec 'load', which may
result in loss of IMA measurements during kexec soft reboot. Due to
missed measurements that only occurred after kexec 'load', this function
needs to be called during kexec 'execute'.
This patch includes the following changes:
- Implement kimage_file_post_load() function to be invoked after the new
kernel image has been loaded for kexec.
- Call kimage_file_post_load() from kexec_file_load() syscall only for
kexec soft reboot scenarios and not for KEXEC_FILE_ON_CRASH. It will
map the IMA segment, and register reboot notifier for the function
ima_update_kexec_buffer() which would copy the IMA log at kexec soft
reboot.
- Make kexec_segment_size variable local static to the file so that it
becomes accessible both during kexec 'load' and 'execute'.
- Move ima_dump_measurement_list() call from ima_add_kexec_buffer()
to ima_update_kexec_buffer().
- Copy the measurement list as much as possible.
- Remove ima_reset_kexec_file() call from ima_add_kexec_buffer(), now
that the buffer is being copied at kexec 'execute', and resetting the
file at kexec 'load' would corrupt the buffer.
Signed-off-by: Tushar Sugandhi <tusharsu@...ux.microsoft.com>
Cc: Eric Biederman <ebiederm@...ssion.com>
Cc: Baoquan He <bhe@...hat.com>
Cc: Vivek Goyal <vgoyal@...hat.com>
Cc: Dave Young <dyoung@...hat.com>
Signed-off-by: steven chen <chenste@...ux.microsoft.com>
Reviewed-by: Stefan Berger <stefanb@...ux.ibm.com>
---
kernel/kexec_file.c | 10 +++++++
security/integrity/ima/ima_kexec.c | 48 ++++++++++++++++++------------
2 files changed, 39 insertions(+), 19 deletions(-)
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 606132253c79..ab449b43aaee 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -201,6 +201,13 @@ kimage_validate_signature(struct kimage *image)
}
#endif
+static void kimage_file_post_load(struct kimage *image)
+{
+#ifdef CONFIG_IMA_KEXEC
+ ima_kexec_post_load(image);
+#endif
+}
+
/*
* In file mode list of segments is prepared by kernel. Copy relevant
* data from user space, do error checking, prepare segment list
@@ -428,6 +435,9 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
kimage_terminate(image);
+ if (!(flags & KEXEC_FILE_ON_CRASH))
+ kimage_file_post_load(image);
+
ret = machine_kexec_post_load(image);
if (ret)
goto out;
diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
index 074848dcd30f..dd49658153ca 100644
--- a/security/integrity/ima/ima_kexec.c
+++ b/security/integrity/ima/ima_kexec.c
@@ -19,6 +19,7 @@
#ifdef CONFIG_IMA_KEXEC
static struct seq_file ima_kexec_file;
static void *ima_kexec_buffer;
+static size_t kexec_segment_size;
static bool ima_kexec_update_registered;
static void ima_reset_kexec_file(struct seq_file *sf)
@@ -66,7 +67,8 @@ static int ima_alloc_kexec_file_buf(size_t segment_size)
* compare the size of IMA measurement list with the size of the allocated memory
* if the size of the allocated memory is not less than the size of IMA measurement list
* copy the measurement list to the allocated memory.
- * else return error
+ * else
+ * copy the measurement list as much as possible.
*/
static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
unsigned long segment_size)
@@ -96,8 +98,6 @@ static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
}
}
- if (ret < 0)
- goto out;
/*
* fill in reserved space with some buffer details
* (eg. version, buffer size, number of measurements)
@@ -118,7 +118,6 @@ static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
*buffer_size = ima_kexec_file.count;
*buffer = ima_kexec_file.buf;
-out:
return ret;
}
@@ -138,7 +137,6 @@ void ima_add_kexec_buffer(struct kimage *image)
/* use more understandable variable names than defined in kbuf */
void *kexec_buffer = NULL;
size_t kexec_buffer_size = 0;
- size_t kexec_segment_size;
int ret;
/*
@@ -163,13 +161,6 @@ void ima_add_kexec_buffer(struct kimage *image)
return;
}
- ret = ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
- kexec_segment_size);
- if (ret < 0) {
- pr_err("Failed to dump IMA measurements. Error:%d.\n", ret);
- return;
- }
-
kbuf.buffer = kexec_buffer;
kbuf.bufsz = kexec_buffer_size;
kbuf.memsz = kexec_segment_size;
@@ -187,12 +178,6 @@ void ima_add_kexec_buffer(struct kimage *image)
image->ima_segment_index = image->nr_segments - 1;
image->is_ima_segment_index_set = true;
- /*
- * kexec owns kexec_buffer after kexec_add_buffer() is called
- * and it will vfree() that buffer.
- */
- ima_reset_kexec_file(&ima_kexec_file);
-
kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
kbuf.mem);
}
@@ -203,7 +188,32 @@ void ima_add_kexec_buffer(struct kimage *image)
static int ima_update_kexec_buffer(struct notifier_block *self,
unsigned long action, void *data)
{
- return NOTIFY_OK;
+ void *buf = NULL;
+ size_t buf_size = 0;
+ int ret = NOTIFY_OK;
+
+ if (!kexec_in_progress) {
+ pr_info("No kexec in progress.\n");
+ return ret;
+ }
+
+ if (!ima_kexec_buffer) {
+ pr_err("Kexec buffer not set.\n");
+ return ret;
+ }
+
+ ret = ima_dump_measurement_list(&buf_size, &buf, kexec_segment_size);
+
+ if (ret)
+ pr_err("Dump measurements failed. Error:%d\n", ret);
+
+ if (buf_size != 0)
+ memcpy(ima_kexec_buffer, buf, buf_size);
+
+ kimage_unmap_segment(ima_kexec_buffer);
+ ima_kexec_buffer = NULL;
+
+ return ret;
}
struct notifier_block update_buffer_nb = {
--
2.25.1
Powered by blists - more mailing lists