From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: Dave Young <dyoung@redhat.com>
Cc: kexec@lists.infradead.org, linux-kernel@vger.kernel.org,
linux-ima-devel@lists.sourceforge.net,
linux-security-module <linux-security-module@vger.kernel.org>,
Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>,
Andrew Morton <akpm@linux-foundation.org>,
linuxppc-dev@lists.ozlabs.org
Subject: Re: [PATHC v2 5/9] ima: on soft reboot, save the measurement list
Date: Fri, 02 Sep 2016 09:22:59 -0400 [thread overview]
Message-ID: <1472822579.3669.13.camel@linux.vnet.ibm.com> (raw)
In-Reply-To: <20160901015712.GA3425@dhcp-128-65.nay.redhat.com>
Hi Dave,
On Thu, 2016-09-01 at 09:57 +0800, Dave Young wrote:
> On 08/30/16 at 06:40pm, Mimi Zohar wrote:
> > + * Called during kexec_file_load so that IMA can add a segment to the kexec
> > + * image for the measurement list for the next kernel.
> > + */
> > +void ima_add_kexec_buffer(struct kimage *image)
> > +{
> > + static int registered = 0;
> > + struct kexec_buf kbuf = { .image = image, .buf_align = PAGE_SIZE,
> > + .buf_min = 0, .buf_max = ULONG_MAX,
> > + .top_down = true, .skip_checksum = true };
> > + int ret;
> > +
> > + if (!kexec_can_hand_over_buffer())
> > + return;
> > +
> > + kexec_segment_size = ALIGN(ima_get_binary_runtime_size() + PAGE_SIZE,
> > + PAGE_SIZE);
> > +
> > + if (kexec_segment_size >= (ULONG_MAX - sizeof(long))) {
> > + pr_err("Binary measurement list too large.\n");
> > + return;
> > + }
>
> Now we added a limitation that total segment size can not be larger than
> half of totalram. see kernel/kexec_core.c sanity_check_segment_list()
>
> So can it fail early here if kexec_segment_size is over half of total
> ram?
Sure, I'll include this change in the next post.
Mimi
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
next prev parent reply other threads:[~2016-09-02 13:23 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-30 22:40 [PATHC v2 0/9] ima: carry the measurement list across kexec Mimi Zohar
2016-08-30 22:40 ` [PATHC v2 1/9] ima: on soft reboot, restore the measurement list Mimi Zohar
2016-08-30 22:40 ` [PATHC v2 2/9] ima: permit duplicate measurement list entries Mimi Zohar
2016-08-30 22:40 ` [PATHC v2 3/9] ima: maintain memory size needed for serializing the measurement list Mimi Zohar
2016-08-30 22:40 ` [PATHC v2 4/9] ima: serialize the binary_runtime_measurements Mimi Zohar
2016-08-30 22:40 ` [PATHC v2 5/9] ima: on soft reboot, save the measurement list Mimi Zohar
2016-09-01 1:57 ` Dave Young
2016-09-02 13:22 ` Mimi Zohar [this message]
2016-08-30 22:40 ` [PATHC v2 6/9] ima: store the builtin/custom template definitions in a list Mimi Zohar
2016-08-30 22:40 ` [PATHC v2 7/9] ima: support restoring multiple template formats Mimi Zohar
2016-08-30 22:40 ` [PATHC v2 8/9] ima: define a canonical binary_runtime_measurements list format Mimi Zohar
2016-08-30 22:40 ` [PATHC v2 9/9] ima: platform-independent hash value Mimi Zohar
2016-08-31 20:50 ` [PATHC v2 0/9] ima: carry the measurement list across kexec Andrew Morton
2016-08-31 22:38 ` Mimi Zohar
2016-09-15 15:44 ` Mimi Zohar
2016-09-16 19:47 ` Eric W. Biederman
2016-09-16 21:03 ` Eric W. Biederman
2016-09-16 23:32 ` Thiago Jung Bauermann
2016-09-17 5:17 ` Eric W. Biederman
2016-09-18 21:25 ` Thiago Jung Bauermann
2016-09-20 16:07 ` Eric W. Biederman
2016-09-26 18:31 ` Thiago Jung Bauermann
2016-09-29 21:43 ` Eric W. Biederman
2016-09-29 22:21 ` Thiago Jung Bauermann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1472822579.3669.13.camel@linux.vnet.ibm.com \
--to=zohar@linux.vnet.ibm.com \
--cc=akpm@linux-foundation.org \
--cc=bauerman@linux.vnet.ibm.com \
--cc=dyoung@redhat.com \
--cc=kexec@lists.infradead.org \
--cc=linux-ima-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).