linux-kernel - Re: [PATCH v11 5/9] ima: kexec: define functions to copy IMA log at soft boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51203aaf-b3a2-4352-b5a0-1ad6094d0243@linux.microsoft.com>
Date: Thu, 10 Apr 2025 07:13:49 -0700
From: steven chen <chenste@...ux.microsoft.com>
To: Mimi Zohar <zohar@...ux.ibm.com>, stefanb@...ux.ibm.com,
 roberto.sassu@...weicloud.com, roberto.sassu@...wei.com,
 eric.snowberg@...cle.com, ebiederm@...ssion.com, paul@...l-moore.com,
 code@...icks.com, bauermann@...abnow.com, linux-integrity@...r.kernel.org,
 kexec@...ts.infradead.org, linux-security-module@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: madvenka@...ux.microsoft.com, nramas@...ux.microsoft.com,
 James.Bottomley@...senPartnership.com, bhe@...hat.com, vgoyal@...hat.com,
 dyoung@...hat.com
Subject: Re: [PATCH v11 5/9] ima: kexec: define functions to copy IMA log at
 soft boot

On 4/8/2025 7:21 AM, Mimi Zohar wrote:
> On Wed, 2025-04-02 at 05:47 -0700, steven chen wrote:
>> The IMA log is currently copied to the new kernel during kexec 'load'
>> using ima_dump_measurement_list(). However, the log copied at kexec
>> 'load' may result in loss of IMA measurements that only occurred after
>> kexec "load'.
> Ok
>
>> Therefore, the log needs to be copied during kexec
>> 'execute'.
> The above line is unnecessary.
>
>> Setup the needed infrastructure to move the IMA log copy from
>> kexec 'load' to 'execute'.
>>
>> Define a new IMA hook ima_update_kexec_buffer() as a stub function.
>> It will be used to call ima_dump_measurement_list() during kexec 'execute'.
>>
>> Implement ima_kexec_post_load() function to be invoked after the new
>> Kernel image has been loaded for kexec. ima_kexec_post_load() maps the
>> IMA buffer to a segment in the newly loaded Kernel.  It also registers
>> the reboot notifier_block to trigger ima_update_kexec_buffer() at
>> kexec 'execute'.
>>
>> Set the priority of register_reboot_notifier to INT_MIN to ensure that the
>> IMA log copy operation will happen at the end of the operation chain, which
>> is crucial for maintaining the integrity of the logs
> Instead of ", which is crucial for maintaining the integrity of the logs"
> say something like ", so that all the IMA measurement records extended into the
> TPM are copied."

Hi Mimi,

I will update in next version.

Thanks,

Steven

>> Signed-off-by: Tushar Sugandhi <tusharsu@...ux.microsoft.com>
>> Cc: Eric Biederman <ebiederm@...ssion.com>
>> Cc: Baoquan He <bhe@...hat.com>
>> Cc: Vivek Goyal <vgoyal@...hat.com>
>> Cc: Dave Young <dyoung@...hat.com>
>> Signed-off-by: steven chen <chenste@...ux.microsoft.com>
>> Reviewed-by: Stefan Berger <stefanb@...ux.ibm.com>
> Thanks, Steven.  With the change to use INT_MIN, the "kexec_execute" record is
> now added to the IMA measurement list, extended into the PCR, and included in
> the IMA measurement list records copied.
>
> Reviewed-by: Mimi Zohar <zohar@...ux.ibm.com>