linux-security-module.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: steven chen <chenste@linux.microsoft.com>
To: zohar@linux.ibm.com, stefanb@linux.ibm.com,
	roberto.sassu@huaweicloud.com, roberto.sassu@huawei.com,
	eric.snowberg@oracle.com, ebiederm@xmission.com,
	paul@paul-moore.com, code@tyhicks.com, bauermann@kolabnow.com,
	linux-integrity@vger.kernel.org, kexec@lists.infradead.org,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org
Cc: madvenka@linux.microsoft.com, nramas@linux.microsoft.com,
	James.Bottomley@HansenPartnership.com, bhe@redhat.com,
	vgoyal@redhat.com, dyoung@redhat.com
Subject: [PATCH v10 1/8] ima: rename variable the ser_file "file" to "ima_kexec_file"
Date: Mon, 17 Mar 2025 18:04:39 -0700	[thread overview]
Message-ID: <20250318010448.954-2-chenste@linux.microsoft.com> (raw)
In-Reply-To: <20250318010448.954-1-chenste@linux.microsoft.com>

The name of the local variable "file" of type seq_file defined in the
ima_dump_measurement_list function is too generic. To better reflect the
purpose of the variable, rename it to "ima_kexec_file". This change will 
help improve code readability and maintainability by making the variable's
role more explicit.

The variable ima_kexec_file is indeed the memory allocated for copying IMA
measurement records. The ima_dump_measurement_list function calculates the 
actual memory occupied by the IMA logs and compares it with the allocated 
memory. If there is enough memory, it copies all IMA measurement records; 
otherwise, it does not copy any records, which would result in a failure
of remote attestation.

Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: steven chen <chenste@linux.microsoft.com>
---
 security/integrity/ima/ima_kexec.c | 39 ++++++++++++++++++------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
index 9d45f4d26f73..8567619889d1 100644
--- a/security/integrity/ima/ima_kexec.c
+++ b/security/integrity/ima/ima_kexec.c
@@ -15,33 +15,41 @@
 #include "ima.h"
 
 #ifdef CONFIG_IMA_KEXEC
+/*
+ * Copy the measurement list to the allocated memory
+ * compare the size of IMA measurement list with the size of the allocated memory
+ *    if the size of the allocated memory is not less than the size of IMA measurement list
+ *        copy the measurement list to the allocated memory.
+ *    else
+ *        return error
+ */
 static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
 				     unsigned long segment_size)
 {
+	struct seq_file ima_kexec_file;
 	struct ima_queue_entry *qe;
-	struct seq_file file;
 	struct ima_kexec_hdr khdr;
 	int ret = 0;
 
 	/* segment size can't change between kexec load and execute */
-	file.buf = vmalloc(segment_size);
-	if (!file.buf) {
+	ima_kexec_file.buf = vmalloc(segment_size);
+	if (!ima_kexec_file.buf) {
 		ret = -ENOMEM;
 		goto out;
 	}
 
-	file.file = NULL;
-	file.size = segment_size;
-	file.read_pos = 0;
-	file.count = sizeof(khdr);	/* reserved space */
+	ima_kexec_file.file = NULL;
+	ima_kexec_file.size = segment_size;
+	ima_kexec_file.read_pos = 0;
+	ima_kexec_file.count = sizeof(khdr);	/* reserved space */
 
 	memset(&khdr, 0, sizeof(khdr));
 	khdr.version = 1;
 	/* This is an append-only list, no need to hold the RCU read lock */
 	list_for_each_entry_rcu(qe, &ima_measurements, later, true) {
-		if (file.count < file.size) {
+		if (ima_kexec_file.count < ima_kexec_file.size) {
 			khdr.count++;
-			ima_measurements_show(&file, qe);
+			ima_measurements_show(&ima_kexec_file, qe);
 		} else {
 			ret = -EINVAL;
 			break;
@@ -55,23 +63,24 @@ static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
 	 * fill in reserved space with some buffer details
 	 * (eg. version, buffer size, number of measurements)
 	 */
-	khdr.buffer_size = file.count;
+	khdr.buffer_size = ima_kexec_file.count;
 	if (ima_canonical_fmt) {
 		khdr.version = cpu_to_le16(khdr.version);
 		khdr.count = cpu_to_le64(khdr.count);
 		khdr.buffer_size = cpu_to_le64(khdr.buffer_size);
 	}
-	memcpy(file.buf, &khdr, sizeof(khdr));
+	memcpy(ima_kexec_file.buf, &khdr, sizeof(khdr));
 
 	print_hex_dump_debug("ima dump: ", DUMP_PREFIX_NONE, 16, 1,
-			     file.buf, file.count < 100 ? file.count : 100,
+			     ima_kexec_file.buf, ima_kexec_file.count < 100 ?
+			     ima_kexec_file.count : 100,
 			     true);
 
-	*buffer_size = file.count;
-	*buffer = file.buf;
+	*buffer_size = ima_kexec_file.count;
+	*buffer = ima_kexec_file.buf;
 out:
 	if (ret == -EINVAL)
-		vfree(file.buf);
+		vfree(ima_kexec_file.buf);
 	return ret;
 }
 
-- 
2.25.1


  reply	other threads:[~2025-03-18  1:05 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-03-18  1:04 [PATCH v10 0/8] ima: kexec: measure events between kexec load and execute steven chen
2025-03-18  1:04 ` steven chen [this message]
2025-03-18 15:10   ` [PATCH v10 1/8] ima: rename variable the ser_file "file" to "ima_kexec_file" Stefan Berger
2025-03-19  2:43     ` Baoquan He
2025-03-21 16:15       ` steven chen
2025-03-19 13:42   ` Mimi Zohar
2025-03-21 16:16     ` steven chen
2025-03-18  1:04 ` [PATCH v10 2/8] ima: define and call ima_alloc_kexec_file_buf() steven chen
2025-03-19  8:09   ` Baoquan He
2025-03-19 16:27     ` Mimi Zohar
2025-03-20  1:51       ` Baoquan He
2025-03-20 13:06         ` Mimi Zohar
2025-03-21 16:18           ` steven chen
2025-03-18  1:04 ` [PATCH v10 3/8] kexec: define functions to map and unmap segments steven chen
2025-03-19 10:12   ` Baoquan He
2025-03-18  1:04 ` [PATCH v10 4/8] ima: kexec: skip IMA segment validation after kexec soft reboot steven chen
2025-03-19 10:16   ` Baoquan He
2025-03-18  1:04 ` [PATCH v10 5/8] ima: kexec: define functions to copy IMA log at soft boot steven chen
2025-03-18  1:04 ` [PATCH v10 6/8] ima: kexec: move IMA log copy from kexec load to execute steven chen
2025-03-19 20:53   ` Mimi Zohar
2025-03-21 16:20     ` steven chen
2025-03-20  2:06   ` Baoquan He
2025-03-21 16:23     ` steven chen
2025-03-24 11:00       ` Baoquan He
2025-03-25 22:27         ` steven chen
2025-03-26  2:27           ` Baoquan He
2025-03-26 22:46             ` steven chen
2025-03-26 23:44               ` Mimi Zohar
2025-03-18  1:04 ` [PATCH v10 7/8] ima: make the kexec extra memory configurable steven chen
2025-03-20  2:52   ` Baoquan He
2025-03-21 16:46     ` steven chen
2025-03-18  1:04 ` [PATCH v10 8/8] ima: measure kexec load and exec events as critical data steven chen
2025-03-20  2:59   ` Mimi Zohar
2025-03-21 16:49     ` steven chen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250318010448.954-2-chenste@linux.microsoft.com \
    --to=chenste@linux.microsoft.com \
    --cc=James.Bottomley@HansenPartnership.com \
    --cc=bauermann@kolabnow.com \
    --cc=bhe@redhat.com \
    --cc=code@tyhicks.com \
    --cc=dyoung@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=eric.snowberg@oracle.com \
    --cc=kexec@lists.infradead.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=madvenka@linux.microsoft.com \
    --cc=nramas@linux.microsoft.com \
    --cc=paul@paul-moore.com \
    --cc=roberto.sassu@huawei.com \
    --cc=roberto.sassu@huaweicloud.com \
    --cc=stefanb@linux.ibm.com \
    --cc=vgoyal@redhat.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).