linux-kernel - Re: [PATCH v12 0/9] ima: kexec: measure events between kexec load and execute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b786b537-19e0-497c-b32f-c9df6e88e6b9@linux.microsoft.com>
Date: Sun, 20 Apr 2025 05:21:02 -0700
From: steven chen <chenste@...ux.microsoft.com>
To: Stefan Berger <stefanb@...ux.ibm.com>, zohar@...ux.ibm.com,
 roberto.sassu@...weicloud.com, roberto.sassu@...wei.com,
 eric.snowberg@...cle.com, ebiederm@...ssion.com, paul@...l-moore.com,
 code@...icks.com, bauermann@...abnow.com, linux-integrity@...r.kernel.org,
 kexec@...ts.infradead.org, linux-security-module@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: madvenka@...ux.microsoft.com, nramas@...ux.microsoft.com,
 James.Bottomley@...senPartnership.com, bhe@...hat.com, vgoyal@...hat.com,
 dyoung@...hat.com
Subject: Re: [PATCH v12 0/9] ima: kexec: measure events between kexec load and
 execute

On 4/16/2025 6:09 PM, Stefan Berger wrote:
>
>
> On 4/15/25 10:10 PM, steven chen wrote:
>> From: Steven Chen <chenste@...ux.microsoft.com>
>>
>> The current kernel behavior is IMA measurements snapshot is taken at
>> kexec 'load' and not at kexec 'execute'.  IMA log is then carried
>> over to the new kernel after kexec 'execute'.
>>
>> Currently, the kernel behavior during kexec load is to fetch the IMA
>> measurements log from TPM PCRs and store it in a buffer. When a kexec
>> reboot is triggered, this stored log buffer is carried over to the 
>> second
>> kernel. However, the time gap between kexec load and kexec reboot can be
>> very long. During this time window, new events extended into TPM PCRs 
>> miss
>> the chance to be carried over to the second kernel. This results in
>> mismatch between TPM PCR quotes and the actual IMA measurements list 
>> after
>> kexec soft reboot, which in turn results in remote attestation failure.
>
> Tested-by: Stefan Berger <stefanb@...ux.ibm.com> # ppc64/kvm

Hi Stefan,

Thank you very much!

Steven