From 9282ead63eb7dccdce9430275889376d19dea59d Mon Sep 17 00:00:00 2001 From: Tushar Sugandhi Date: Mon, 3 Jan 2022 14:21:18 -0800 Subject: [PATCH 2/3] ima: update kexec buffer before executing soft reboot ima_update_kexec_buffer updates IMA buffer in kexec_image to have its contents updated. This function should be called during kexec execute so that IMA can save the measurement list. This is useful if the current kernel wants to send information to the next kernel that is up-to-date at the time of reboot. Co-developed-by: Thiago Jung Bauermann Signed-off-by: Thiago Jung Bauermann Signed-off-by: Tushar Sugandhi --- security/integrity/ima/ima_kexec.c | 38 ++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c index f799cc278a9a..577462e9f9cc 100644 --- a/security/integrity/ima/ima_kexec.c +++ b/security/integrity/ima/ima_kexec.c @@ -73,6 +73,44 @@ static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer, return ret; } +/* + * Called during kexec execute so that IMA can save the measurement list. + */ +static int ima_update_kexec_buffer(struct notifier_block *self, + unsigned long action, void *data) +{ + void *kexec_buffer = NULL; + size_t kexec_buffer_size; + int ret; + + if (!kexec_in_progress) + return NOTIFY_OK; + + kexec_buffer_size = ima_get_binary_runtime_size(); + if (kexec_buffer_size > + (kexec_segment_size - sizeof(struct ima_kexec_hdr))) { + pr_err("Binary measurement list grew too large.\n"); + goto out; + } + + ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer, + kexec_segment_size); + if (!kexec_buffer) { + pr_err("Not enough memory for the kexec measurement buffer.\n"); + goto out; + } + ret = kexec_update_segment(kexec_buffer, kexec_buffer_size, + kexec_buffer_load_addr, kexec_segment_size); + if (ret) + pr_err("Error updating kexec buffer: %d\n", ret); +out: + return NOTIFY_OK; +} + +struct notifier_block update_buffer_nb = { + .notifier_call = ima_update_kexec_buffer, +}; + /* * Called during kexec_file_load so that IMA can add a segment to the kexec * image for the measurement list for the next kernel. -- 2.25.1