| Message ID | 20250416021028.1403-6-chenste@linux.microsoft.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | ima: kexec: measure events between kexec load and execute | expand |
On 04/15/25 at 07:10pm, steven chen wrote: > From: Steven Chen <chenste@linux.microsoft.com> > > The IMA log is currently copied to the new kernel during kexec 'load' > using ima_dump_measurement_list(). However, the log copied at kexec > 'load' may result in loss of IMA measurements that only occurred after > kexec "load'. Setup the needed infrastructure to move the IMA log copy > from kexec 'load' to 'execute'. > > Define a new IMA hook ima_update_kexec_buffer() as a stub function. > It will be used to call ima_dump_measurement_list() during kexec 'execute'. > > Implement ima_kexec_post_load() function to be invoked after the new > Kernel image has been loaded for kexec. ima_kexec_post_load() maps the > IMA buffer to a segment in the newly loaded Kernel. It also registers > the reboot notifier_block to trigger ima_update_kexec_buffer() at > kexec 'execute'. > > Set the priority of register_reboot_notifier to INT_MIN to ensure that the > IMA log copy operation will happen at the end of the operation chain, so > that all the IMA measurement records extended into the TPM are copied > > Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> ^^^ The tag > Cc: Eric Biederman <ebiederm@xmission.com> > Cc: Baoquan He <bhe@redhat.com> > Cc: Vivek Goyal <vgoyal@redhat.com> > Cc: Dave Young <dyoung@redhat.com> > Signed-off-by: Steven Chen <chenste@linux.microsoft.com> > Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> > --- > include/linux/ima.h | 3 ++ > security/integrity/ima/ima_kexec.c | 47 ++++++++++++++++++++++++++++++ > 2 files changed, 50 insertions(+) Other than the tag, this looks good to me: Acked-by: Baoquan He <bhe@redhat.com> > > diff --git a/include/linux/ima.h b/include/linux/ima.h > index 0bae61a15b60..8e29cb4e6a01 100644 > --- a/include/linux/ima.h > +++ b/include/linux/ima.h > @@ -32,6 +32,9 @@ static inline void ima_appraise_parse_cmdline(void) {} > > #ifdef CONFIG_IMA_KEXEC > extern void ima_add_kexec_buffer(struct kimage *image); > +extern void ima_kexec_post_load(struct kimage *image); > +#else > +static inline void ima_kexec_post_load(struct kimage *image) {} > #endif > > #else > diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c > index 7e0a19c3483f..e79f6caf895b 100644 > --- a/security/integrity/ima/ima_kexec.c > +++ b/security/integrity/ima/ima_kexec.c > @@ -12,10 +12,14 @@ > #include <linux/kexec.h> > #include <linux/of.h> > #include <linux/ima.h> > +#include <linux/reboot.h> > +#include <asm/page.h> > #include "ima.h" > > #ifdef CONFIG_IMA_KEXEC > +static bool ima_kexec_update_registered; > static struct seq_file ima_kexec_file; > +static void *ima_kexec_buffer; > > static void ima_free_kexec_file_buf(struct seq_file *sf) > { > @@ -162,6 +166,49 @@ void ima_add_kexec_buffer(struct kimage *image) > kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n", > kbuf.mem); > } > + > +/* > + * Called during kexec execute so that IMA can update the measurement list. > + */ > +static int ima_update_kexec_buffer(struct notifier_block *self, > + unsigned long action, void *data) > +{ > + return NOTIFY_OK; > +} > + > +static struct notifier_block update_buffer_nb = { > + .notifier_call = ima_update_kexec_buffer, > + .priority = INT_MIN > +}; > + > +/* > + * Create a mapping for the source pages that contain the IMA buffer > + * so we can update it later. > + */ > +void ima_kexec_post_load(struct kimage *image) > +{ > + if (ima_kexec_buffer) { > + kimage_unmap_segment(ima_kexec_buffer); > + ima_kexec_buffer = NULL; > + } > + > + if (!image->ima_buffer_addr) > + return; > + > + ima_kexec_buffer = kimage_map_segment(image, > + image->ima_buffer_addr, > + image->ima_buffer_size); > + if (!ima_kexec_buffer) { > + pr_err("Could not map measurements buffer.\n"); > + return; > + } > + > + if (!ima_kexec_update_registered) { > + register_reboot_notifier(&update_buffer_nb); > + ima_kexec_update_registered = true; > + } > +} > + > #endif /* IMA_KEXEC */ > > /* > -- > 2.43.0 >
diff --git a/include/linux/ima.h b/include/linux/ima.h index 0bae61a15b60..8e29cb4e6a01 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -32,6 +32,9 @@ static inline void ima_appraise_parse_cmdline(void) {} #ifdef CONFIG_IMA_KEXEC extern void ima_add_kexec_buffer(struct kimage *image); +extern void ima_kexec_post_load(struct kimage *image); +#else +static inline void ima_kexec_post_load(struct kimage *image) {} #endif #else diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c index 7e0a19c3483f..e79f6caf895b 100644 --- a/security/integrity/ima/ima_kexec.c +++ b/security/integrity/ima/ima_kexec.c @@ -12,10 +12,14 @@ #include <linux/kexec.h> #include <linux/of.h> #include <linux/ima.h> +#include <linux/reboot.h> +#include <asm/page.h> #include "ima.h" #ifdef CONFIG_IMA_KEXEC +static bool ima_kexec_update_registered; static struct seq_file ima_kexec_file; +static void *ima_kexec_buffer; static void ima_free_kexec_file_buf(struct seq_file *sf) { @@ -162,6 +166,49 @@ void ima_add_kexec_buffer(struct kimage *image) kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n", kbuf.mem); } + +/* + * Called during kexec execute so that IMA can update the measurement list. + */ +static int ima_update_kexec_buffer(struct notifier_block *self, + unsigned long action, void *data) +{ + return NOTIFY_OK; +} + +static struct notifier_block update_buffer_nb = { + .notifier_call = ima_update_kexec_buffer, + .priority = INT_MIN +}; + +/* + * Create a mapping for the source pages that contain the IMA buffer + * so we can update it later. + */ +void ima_kexec_post_load(struct kimage *image) +{ + if (ima_kexec_buffer) { + kimage_unmap_segment(ima_kexec_buffer); + ima_kexec_buffer = NULL; + } + + if (!image->ima_buffer_addr) + return; + + ima_kexec_buffer = kimage_map_segment(image, + image->ima_buffer_addr, + image->ima_buffer_size); + if (!ima_kexec_buffer) { + pr_err("Could not map measurements buffer.\n"); + return; + } + + if (!ima_kexec_update_registered) { + register_reboot_notifier(&update_buffer_nb); + ima_kexec_update_registered = true; + } +} + #endif /* IMA_KEXEC */ /*