linux-kernel - Re: [PATCH] ima: Kdump kernel doesn't need IMA to do integrity measurement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <71439e57-87e2-436f-ba55-77c0539e9538@linux.microsoft.com>
Date: Tue, 13 May 2025 08:21:51 -0700
From: steven chen <chenste@...ux.microsoft.com>
To: Baoquan He <bhe@...hat.com>
Cc: zohar@...ux.ibm.com, stefanb@...ux.ibm.com,
 roberto.sassu@...weicloud.com, roberto.sassu@...wei.com,
 eric.snowberg@...cle.com, ebiederm@...ssion.com, paul@...l-moore.com,
 code@...icks.com, bauermann@...abnow.com, linux-integrity@...r.kernel.org,
 kexec@...ts.infradead.org, linux-security-module@...r.kernel.org,
 linux-kernel@...r.kernel.org, madvenka@...ux.microsoft.com,
 nramas@...ux.microsoft.com, James.Bottomley@...senpartnership.com
Subject: Re: [PATCH] ima: Kdump kernel doesn't need IMA to do integrity
 measurement

On 5/12/2025 7:25 PM, Baoquan He wrote:
> On 05/02/25 at 01:03pm, steven chen wrote:
>> From: Steven Chen <chenste@...ux.microsoft.com>
>>
>> Kdump kernel doesn't need IMA to do integrity measurement.
>> Hence the measurement list in 1st kernel doesn't need to be copied to
>> kdump kenrel.
>>
>> Here skip allocating buffer for measurement list copying if loading
>> kdump kernel. Then there won't be the later handling related to
>> ima_kexec_buffer.
>>
>> Signed-off-by: Steven Chen <chenste@...ux.microsoft.com>
>> ---
>>   security/integrity/ima/ima_kexec.c | 3 +++
>>   1 file changed, 3 insertions(+)
> I applied this patch on top of below IMA patchset, and did a test.
> [PATCH v13 0/9] ima: kexec: measure events between kexec load and execute
>
> When I loaded kdump kernel as below with '-d' specified:
>
> /sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.15.0-rc6+ ro console=ttyS0,115200N81 irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 acpi_no_memhotplug transparent_hugepage=never nokaslr hest_disable novmcoredd cma=0 hugetlb_cma=0 pcie_ports=compat disable_cpu_apicid=0 --initrd=/boot/initramfs-6.15.0-rc6+kdump.img /boot/vmlinuz-6.15.0-rc6+
>
> I can see that this patch works to skip copying measurement list to kdump
> kernel as expected..
>
> =====Without this patch===
> [48522.060422] kexec_file: kernel: 000000006fbcb87f kernel_size: 0xe99200
> [48522.067742] PEFILE: Unsigned PE binary
> [48522.094849] ima: kexec measurement buffer for the loaded kernel at 0x6efff000.
> [48522.102982] crash_core: Crash PT_LOAD ELF header. phdr=00000000cae5d7e6 vaddr=0xffff8da640100000, paddr=0x100000, sz=0x5af00000 e_phnum=67 p_offset=0x100000
> ......snip...
> =====
>
> =====With this patch applied====
> [ 2101.704125] kexec_file: kernel: 0000000046d8985c kernel_size: 0xeab200
> [ 2101.711436] PEFILE: Unsigned PE binary
> [ 2101.734752] crash_core: Crash PT_LOAD ELF header. phdr=000000006fc83a51 vaddr=0xffff899480100000, paddr=0x100000, sz=0x5af00000 e_phnum=67 p_offset=0x100000
> ......snip...
> =====>
>
> My only concern is the patch subject is not very sepcific, it better
> relfect the exact action taken in this patch, like:
>
> ima: do not copy measurement list to kdump kernel
>
> Other than above concern, please feel free to add my:
>
> Tested-by: Baoquan He <bhe@...hat.com>
> Acked-by: Baoquan He <bhe@...hat.com>
Thanks!
>> diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
>> index 38cb2500f4c3..7362f68f2d8b 100644
>> --- a/security/integrity/ima/ima_kexec.c
>> +++ b/security/integrity/ima/ima_kexec.c
>> @@ -146,6 +146,9 @@ void ima_add_kexec_buffer(struct kimage *image)
>>   	void *kexec_buffer = NULL;
>>   	int ret;
>>   
>> +	if (image->type == KEXEC_TYPE_CRASH)
>> +		return;
>> +
>>   	/*
>>   	 * Reserve extra memory for measurements added during kexec.
>>   	 */
>> -- 
>> 2.43.0
>>