From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 34C09C021AF for ; Tue, 18 Feb 2025 22:56:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=XopabJcN99JlAds47ms8/GbZn7vwPhIDL8SD4IqyxXw=; b=3fJnFd2LEg4qT0MZrZ8zjWZLo3 jCBDTdPF2ibU/+Jb8We5sPiOuGWyx4VSQXSkO4G3Lj1GKeewWQSfQIs5dB+WXgeN0Tj8bQOJsGlqd ty8VgparwT1Np8+OKDnX6QoYGlQ1BAGGf2/x1QOb5tLqJ0NWz7Tl4avwNjJMFmIvNXnFBfDFhy/bA JtVxl4ikXkHo7KyBjuIatgkxLHnWB4pXlvBDzOJswrcf97T9PiW0Z+Bktv4E11kaeBsG965POVwjH xVUZO9VN0CznuVLZsgRtarHmpQwg8nIVHcY7uoQJEao1gvrZLHAAXcMG17zRT3WBN9LAIhCpuZedo iEkDIFcQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1tkWW4-0000000ACXz-3hCb; Tue, 18 Feb 2025 22:56:36 +0000 Received: from desiato.infradead.org ([2001:8b0:10b:1:d65d:64ff:fe57:4e05]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1tkWUn-0000000ACH9-3jKj for kexec@bombadil.infradead.org; Tue, 18 Feb 2025 22:55:17 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=Content-Transfer-Encoding:MIME-Version :References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To: Content-Type:Content-ID:Content-Description; bh=XopabJcN99JlAds47ms8/GbZn7vwPhIDL8SD4IqyxXw=; b=UZKDAoQB9NpJLWdseYNWvols5p stBwLOlphju94RDXZUcU0c4dui/VN7T9EDj5s5R2PAi5EFttFJusfMHVz+rji5K+96fmKC6+6PvXR 6pxHLM9YefeYY+jBXsKYIPyItsLMFv9OA4jX6r1JgQYrLPqfKdhIsw2saLBj1wDsH6dVrMSMAx6az 6sHVK9MktI7AFY0PQWjPwxVx+e4uvEf4MIc7C6oo7Le4ib0b1Xsh+dNlKerIs1OIiNTicIfKxoNz4 arhTExc8ea9v4TjaG/IzqyHIro/pkKkWYrUcUu+BtdWZyCk5oKEuNNnwZm9szD/7ugmV4HZEUgggA EYUGvoIQ==; Received: from linux.microsoft.com ([13.77.154.182]) by desiato.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1tkWUk-000000024JI-2r4A for kexec@lists.infradead.org; Tue, 18 Feb 2025 22:55:16 +0000 Received: from localhost.localdomain (unknown [167.220.59.4]) by linux.microsoft.com (Postfix) with ESMTPSA id 5A95820376F0; Tue, 18 Feb 2025 14:55:10 -0800 (PST) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 5A95820376F0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1739919310; bh=XopabJcN99JlAds47ms8/GbZn7vwPhIDL8SD4IqyxXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wtmj4HpViSHS7mZc0ZgJaELavwL5pFBVsHrvtnYs+ib8EZh6HLPDRIsO9tF/KBQRu 1d7ToFPlQLcw7hIUpcr7l2Lr+1NnLL/hi3oC/f9TBWXh6B1d3zbtXceQjC/xW4LCy0 0lEFSOW698VkUhm5mN5OaQ7JfdZNDQ2pcNMZJEnQ= From: steven chen To: zohar@linux.ibm.com, stefanb@linux.ibm.com, roberto.sassu@huaweicloud.com, roberto.sassu@huawei.com, eric.snowberg@oracle.com, ebiederm@xmission.com, paul@paul-moore.com, code@tyhicks.com, bauermann@kolabnow.com, linux-integrity@vger.kernel.org, kexec@lists.infradead.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: madvenka@linux.microsoft.com, nramas@linux.microsoft.com, James.Bottomley@HansenPartnership.com, bhe@redhat.com, vgoyal@redhat.com, dyoung@redhat.com Subject: [PATCH v8 4/7] ima: kexec: define functions to copy IMA log at soft boot Date: Tue, 18 Feb 2025 14:54:59 -0800 Message-Id: <20250218225502.747963-5-chenste@linux.microsoft.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20250218225502.747963-1-chenste@linux.microsoft.com> References: <20250218225502.747963-1-chenste@linux.microsoft.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20250218_225515_299305_E8E21C40 X-CRM114-Status: GOOD ( 13.78 ) X-BeenThere: kexec@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "kexec" Errors-To: kexec-bounces+kexec=archiver.kernel.org@lists.infradead.org IMA log is copied to the new Kernel during kexec 'load' using ima_dump_measurement_list(). The log copy at kexec 'load' may result in loss of IMA measurements during kexec soft reboot. It needs to be copied over during kexec 'execute'. Setup the needed infrastructure to move the IMA log copy from kexec 'load' to 'execute'. Define a new IMA hook ima_update_kexec_buffer() as a stub function. It will be used to call ima_dump_measurement_list() during kexec 'execute'. Implement ima_kexec_post_load() function to be invoked after the new Kernel image has been loaded for kexec. ima_kexec_post_load() maps the IMA buffer to a segment in the newly loaded Kernel. It also registers the reboot notifier_block to trigger ima_update_kexec_buffer() at exec 'execute'. Signed-off-by: Tushar Sugandhi Signed-off-by: steven chen --- include/linux/ima.h | 3 ++ security/integrity/ima/ima_kexec.c | 46 ++++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/include/linux/ima.h b/include/linux/ima.h index 0bae61a15b60..8e29cb4e6a01 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -32,6 +32,9 @@ static inline void ima_appraise_parse_cmdline(void) {} #ifdef CONFIG_IMA_KEXEC extern void ima_add_kexec_buffer(struct kimage *image); +extern void ima_kexec_post_load(struct kimage *image); +#else +static inline void ima_kexec_post_load(struct kimage *image) {} #endif #else diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c index 704676fa6615..0fa65f91414b 100644 --- a/security/integrity/ima/ima_kexec.c +++ b/security/integrity/ima/ima_kexec.c @@ -12,10 +12,14 @@ #include #include #include +#include +#include #include "ima.h" #ifdef CONFIG_IMA_KEXEC static struct seq_file ima_kexec_file; +static void *ima_kexec_buffer; +static bool ima_kexec_update_registered; static void ima_reset_kexec_file(struct seq_file *sf) { @@ -183,6 +187,48 @@ void ima_add_kexec_buffer(struct kimage *image) kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n", kbuf.mem); } + +/* + * Called during kexec execute so that IMA can update the measurement list. + */ +static int ima_update_kexec_buffer(struct notifier_block *self, + unsigned long action, void *data) +{ + return NOTIFY_OK; +} + +struct notifier_block update_buffer_nb = { + .notifier_call = ima_update_kexec_buffer, +}; + +/* + * Create a mapping for the source pages that contain the IMA buffer + * so we can update it later. + */ +void ima_kexec_post_load(struct kimage *image) +{ + if (ima_kexec_buffer) { + kimage_unmap_segment(ima_kexec_buffer); + ima_kexec_buffer = NULL; + } + + if (!image->ima_buffer_addr) + return; + + ima_kexec_buffer = kimage_map_segment(image, + image->ima_buffer_addr, + image->ima_buffer_size); + if (!ima_kexec_buffer) { + pr_err("Could not map measurements buffer.\n"); + return; + } + + if (!ima_kexec_update_registered) { + register_reboot_notifier(&update_buffer_nb); + ima_kexec_update_registered = true; + } +} + #endif /* IMA_KEXEC */ /* -- 2.25.1