Re: [PATCH v3 7/7] ima: measure kexec load and exec events as critical data

[Mimi Zohar <zohar@linux.ibm.com>]

On Fri, 2024-01-05 at 12:22 -0800, Tushar Sugandhi wrote:
> >> @@ -194,6 +206,15 @@ static int ima_update_kexec_buffer(struct notifier_block *self,
> >>              return ret;
> >>      }
> >>   
> >> +    buf_size = ima_get_binary_runtime_size();
> >> +    scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
> >> +              "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;",
> >> +              kexec_segment_size, buf_size);
> >> +
> >> +    ima_measure_critical_data("ima_kexec", "kexec_execute",
> >> +                              ima_kexec_event, strlen(ima_kexec_event),
> >> +                              false, NULL, 0);
> >> +
> > 
> > Please consider including the number of measurement records as well.
> Will do. I think that would be valuable information.
> 
> Per my understanding, I will have to use the function
> ima_show_measurements_count() or ima_show_htable_value() to get the
> number of measurement records value[1]. So I will have to expose that
> function from "ima_fs.c" to "ima_kexec.c". Hope that's ok.
> 
> [1] 
> https://elixir.bootlin.com/linux/latest/sourcesecurity/integrity/ima/ima_fs.c 
> 
> 
> static ssize_t ima_show_measurements_count(struct file *filp,
>                                           char __user *buf,
>                                           size_t count, loff_t *ppos)
> {
>          return ima_show_htable_value(buf, count, ppos, &ima_htable.len);

I don't see a need to expose this function.  ima_htable is defined in ima.h. 
You can read the ima_htable.len directly, as ima_show_htable_value does.

-- 
thanks,
 
Mimi