Re: [PATCH v11 5/9] ima: kexec: define functions to copy IMA log at soft boot

[steven chen <chenste@linux.microsoft.com>]

On 4/8/2025 7:21 AM, Mimi Zohar wrote:
> On Wed, 2025-04-02 at 05:47 -0700, steven chen wrote:
>> The IMA log is currently copied to the new kernel during kexec 'load'
>> using ima_dump_measurement_list(). However, the log copied at kexec
>> 'load' may result in loss of IMA measurements that only occurred after
>> kexec "load'.
> Ok
>
>> Therefore, the log needs to be copied during kexec
>> 'execute'.
> The above line is unnecessary.
>
>> Setup the needed infrastructure to move the IMA log copy from
>> kexec 'load' to 'execute'.
>>
>> Define a new IMA hook ima_update_kexec_buffer() as a stub function.
>> It will be used to call ima_dump_measurement_list() during kexec 'execute'.
>>
>> Implement ima_kexec_post_load() function to be invoked after the new
>> Kernel image has been loaded for kexec. ima_kexec_post_load() maps the
>> IMA buffer to a segment in the newly loaded Kernel.  It also registers
>> the reboot notifier_block to trigger ima_update_kexec_buffer() at
>> kexec 'execute'.
>>
>> Set the priority of register_reboot_notifier to INT_MIN to ensure that the
>> IMA log copy operation will happen at the end of the operation chain, which
>> is crucial for maintaining the integrity of the logs
> Instead of ", which is crucial for maintaining the integrity of the logs"
> say something like ", so that all the IMA measurement records extended into the
> TPM are copied."

Hi Mimi,

I will update in next version.

Thanks,

Steven

>> Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
>> Cc: Eric Biederman <ebiederm@xmission.com>
>> Cc: Baoquan He <bhe@redhat.com>
>> Cc: Vivek Goyal <vgoyal@redhat.com>
>> Cc: Dave Young <dyoung@redhat.com>
>> Signed-off-by: steven chen <chenste@linux.microsoft.com>
>> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
> Thanks, Steven.  With the change to use INT_MIN, the "kexec_execute" record is
> now added to the IMA measurement list, extended into the PCR, and included in
> the IMA measurement list records copied.
>
> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>