Re: [PATCH v6 3/7] ima: kexec: skip IMA segment validation after kexec soft reboot

Stefan Berger
2025-01-28T15:24:58Z

On 1/24/25 5:55 PM, steven chen wrote:
> kexec_calculate_store_digests() calculates and stores the digest of the
> segment at kexec_file_load syscall where the IMA segment is also
> allocated. With this series, the IMA segment will be updated with the
> measurement log at kexec soft reboot. Therefore, it may fail digest

... log at kexec execute stage when the soft reboot is initiated.

> verification in verify_sha256_digest() after kexec soft reboot into the
> new Kernel. Therefore, the digest calculation/verification of the IMA

kernel

> segment needs to be skipped.
>
> Skip IMA segment from calculating and storing digest in function
> kexec_calculate_store_digests() so that it is not added to the
> 'purgatory_sha_regions'.
>
> Since verify_sha256_digest() only verifies 'purgatory_sha_regions',
> no change is needed in verify_sha256_digest() in this context.
>
> With this change, the IMA segment is not included in the digest
> calculation, storage, and verification.
>
> Author: Tushar Sugandhi <tusharsu@linux.microsoft.com>
> Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
> Signed-off-by: steven chen <chenste@linux.microsoft.com>
> ---
> include/linux/kexec.h | 3 +++
> kernel/kexec_file.c | 10 ++++++++++
> security/integrity/ima/ima_kexec.c | 3 +++
> 3 files changed, 16 insertions(+)
>
> diff --git a/include/linux/kexec.h b/include/linux/kexec.h
> index f8413ea5c8c8..f3246e881ac8 100644
> --- a/include/linux/kexec.h
> +++ b/include/linux/kexec.h
> @@ -362,6 +362,9 @@ struct kimage {
>
> phys_addr_t ima_buffer_addr;
> size_t ima_buffer_size;
> +
> + unsigned long ima_segment_index;
> + bool is_ima_segment_index_set;
> #endif>
> /* Core ELF header buffer */
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 3eedb8c226ad..4ff3ba0f3e8e 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -764,6 +764,16 @@ static int kexec_calculate_store_digests(struct kimage *image)
> if (ksegment->kbuf == pi->purgatory_buf)
> continue;
>
> +#ifdef CONFIG_IMA_KEXEC
> + /*
> + * Skip the segment if ima_segment_index is set and matches
> + * the current index
> + */
> + if (image->is_ima_segment_index_set &&
> + i == image->ima_segment_index)
> + continue;
> +#endif
> +
> ret = crypto_shash_update(desc, ksegment->kbuf,
> ksegment->bufsz);
> if (ret)
> diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
> index b60a902460e2..283860d20521 100644
> --- a/security/integrity/ima/ima_kexec.c
> +++ b/security/integrity/ima/ima_kexec.c
> @@ -162,6 +162,7 @@ void ima_add_kexec_buffer(struct kimage *image)
> kbuf.buffer = kexec_buffer;
> kbuf.bufsz = kexec_buffer_size;
> kbuf.memsz = kexec_segment_size;
> + image->is_ima_segment_index_set = false;
> ret = kexec_add_buffer(&kbuf);
> if (ret) {
> pr_err("Error passing over kexec measurement buffer.\n");
> @@ -172,6 +173,8 @@ void ima_add_kexec_buffer(struct kimage *image)
> image->ima_buffer_addr = kbuf.mem;
> image->ima_buffer_size = kexec_segment_size;
> image->ima_buffer = kexec_buffer;
> + image->ima_segment_index = image->nr_segments - 1;
> + image->is_ima_segment_index_set = true;
>
> /*
> * kexec owns kexec_buffer after kexec_add_buffer() is called

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>