Re: [PATCH] ima: add a knob ima= to make IMA be able to be disabled

[Mimi Zohar <zohar@linux.ibm.com>]

On Thu, 2025-05-29 at 12:13 +0800, Pingfan Liu wrote:
> On Tue, May 27, 2025 at 10:18 PM Mimi Zohar <zohar@linux.ibm.com> wrote:
> > 
> > On Tue, 2025-05-27 at 11:25 +0800, Pingfan Liu wrote
> > > > > 
> > > > > 
> > > > > We're trying to close integrity gaps, not add new ones.  Verifying the
> > > > > UKI's
> > > > > signature addresses the integrity of the initramfs.  What about the
> > > > > integrity of
> > > > > the kdump initramfs (or for that matter the kexec initramfs)?  If the
> > > > > kdump
> > > > > initramfs was signed, IMA would be able to verify it before the kexec.
> > > 
> > > IMHO, from the higher level, if there is a requirement on the integrity of
> > > the
> > > initramfs, it should take a similar approach as UKI. And the system admin
> > > can
> > > choose whether to disable the unsafe format loader or not.
> > 
> > Yes, that is a possibility, probably a good aim, but in the case of
> > kexec/kdump
> > that isn't really necessary.  As filesystem(s) support xattrs, IMA policies
> > could be written in terms of "func=KEXEC_INITRAMFS_CHECK" to include the
> > initramfs.
> > 
> 
> Just aware that we have such a cool feature. Thanks!

> I checked the code. IIUC, the relevant code has already been in the
> kernel. And the thing left to do is to install an IMA policy, right?

Correct.  The problem up to now has been that the initramfs was created on the
fly on the target system, so it was impossible to remotely sign it by the
distro.

> 
> But there are still two things to be considered.
> -1.The UEFI partition is FAT format, which can not support xattr

The normal kexec/kdump kernel image and initramfs are stored in /boot, not the
UEFI partition.  Is that changing?

e.g. kexec -s -l /boot/vmlinuz-`uname -r` --initrd=/boot/initramfs-`uname -
r`.img --reuse-cmdline

> -2. Just like in the UKI case, the kernel fd content is not necessary
> for the kernel image itself. The initramfs fd can be used to pass some
> extra data if we use a temp file as a package. So checking the
> signatures at the initramfs level will block this usage

Sorry I lost you here.  What exactly is included in the UKI signature?  What is
this initramfs fd extra data?  Is it included in the UKI signature?  Can you
point me to some documentation?

thanks,

Mimi
> >