linux-kernel - Re: [PATCH v11 5/9] ima: kexec: define functions to copy IMA log at soft boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <90fff5f793fb48659e20fa69cb5895867f51e021.camel@linux.ibm.com>
Date: Tue, 08 Apr 2025 10:21:29 -0400
From: Mimi Zohar <zohar@...ux.ibm.com>
To: steven chen <chenste@...ux.microsoft.com>, stefanb@...ux.ibm.com,
        roberto.sassu@...weicloud.com, roberto.sassu@...wei.com,
        eric.snowberg@...cle.com, ebiederm@...ssion.com, paul@...l-moore.com,
        code@...icks.com, bauermann@...abnow.com,
        linux-integrity@...r.kernel.org, kexec@...ts.infradead.org,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: madvenka@...ux.microsoft.com, nramas@...ux.microsoft.com,
        James.Bottomley@...senPartnership.com, bhe@...hat.com,
        vgoyal@...hat.com, dyoung@...hat.com
Subject: Re: [PATCH v11 5/9] ima: kexec: define functions to copy IMA log at
 soft boot

On Wed, 2025-04-02 at 05:47 -0700, steven chen wrote:
> The IMA log is currently copied to the new kernel during kexec 'load' 
> using ima_dump_measurement_list(). However, the log copied at kexec 
> 'load' may result in loss of IMA measurements that only occurred after
> kexec "load'.

Ok

> Therefore, the log needs to be copied during kexec 
> 'execute'. 

The above line is unnecessary.

> Setup the needed infrastructure to move the IMA log copy from
> kexec 'load' to 'execute'.
> 
> Define a new IMA hook ima_update_kexec_buffer() as a stub function.
> It will be used to call ima_dump_measurement_list() during kexec 'execute'.
> 
> Implement ima_kexec_post_load() function to be invoked after the new 
> Kernel image has been loaded for kexec. ima_kexec_post_load() maps the 
> IMA buffer to a segment in the newly loaded Kernel.  It also registers 
> the reboot notifier_block to trigger ima_update_kexec_buffer() at 
> kexec 'execute'.
> 
> Set the priority of register_reboot_notifier to INT_MIN to ensure that the
> IMA log copy operation will happen at the end of the operation chain, which
> is crucial for maintaining the integrity of the logs

Instead of ", which is crucial for maintaining the integrity of the logs"
say something like ", so that all the IMA measurement records extended into the
TPM are copied."

> 
> Signed-off-by: Tushar Sugandhi <tusharsu@...ux.microsoft.com>
> Cc: Eric Biederman <ebiederm@...ssion.com>
> Cc: Baoquan He <bhe@...hat.com> 
> Cc: Vivek Goyal <vgoyal@...hat.com>
> Cc: Dave Young <dyoung@...hat.com>
> Signed-off-by: steven chen <chenste@...ux.microsoft.com>
> Reviewed-by: Stefan Berger <stefanb@...ux.ibm.com>

Thanks, Steven.  With the change to use INT_MIN, the "kexec_execute" record is
now added to the IMA measurement list, extended into the PCR, and included in
the IMA measurement list records copied.

Reviewed-by: Mimi Zohar <zohar@...ux.ibm.com>