On kexec file load Integrgity Measurement Architecture(IMA) subsystem
may verify the IMA signature of the kernel and initramfs, and measure
it. The command line parameters passed to the kernel in the kexec call
may also be measured by IMA. A remote attestation service can verify
the measurement through the IMA log and the TPM PCR data. This can be
achieved only if the IMA measurement log is carried over from
the current kernel to the next kernel across the kexec call.
However in the current implementation the IMA measurement logs are not
carried over on ARM64 platforms. Therefore a remote attestation service
cannot verify the authenticity of the running kernel on ARM64 platforms
when the kernel is updated through the kexec system call.
This patch series adds support for carrying forward the IMA measurement
log on kexec on ARM64. powerpc already supports carrying forward
the IMA measurement log on kexec.
This series refactors the platform independent code such that it can be
reused for ARM64 as well. A chosen node namely
"linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
the address and the size of the memory reserved to carry
the IMA measurement log.
This patch series has been tested for ARM64 platform using QEMU.
I would like help from the community for testing this change on powerpc.
Thanks.
This series is based on commit 18445bf405cb ("Merge tag 'spi-fix-v5.9-rc1'
of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi") in
https://github.com/torvalds/linux "master" branch.
Changelog:
v4:
- Submitting the patch series on behalf of the original author
Prakhar Srivastava <prsriva@xxxxxxxxxxxxxxxxxxx>
- Moved FDT_PROP_IMA_KEXEC_BUFFER ("linux,ima-kexec-buffer") to
libfdt.h so that it can be shared by multiple platforms.
v3:
Breakup patches further into separate patches.
- Refactoring non architecture specific code out of powerpc
- Update powerpc related code to use fdt functions
- Update IMA buffer read related code to use of functions
- Add support to store the memory information of the IMA
measurement logs to be carried forward.
- Update the property strings to align with documented nodes
https://github.com/devicetree-org/dt-schema/pull/46
v2:
Break patches into separate patches.
- Powerpc related Refactoring
- Updating the docuemntation for chosen node
- Updating arm64 to support IMA buffer pass
v1:
Refactoring carrying over IMA measuremnet logs over Kexec. This patch
moves the non-architecture specific code out of powerpc and adds to
security/ima.(Suggested by Thiago)
Add Documentation regarding the ima-kexec-buffer node in the chosen
node documentation
v0:
Add a layer of abstraction to use the memory reserved by device tree
for ima buffer pass.
Add support for ima buffer pass using reserved memory for arm64 kexec.
Update the arch sepcific code path in kexec file load to store the
ima buffer in the reserved memory. The same reserved memory is read
on kexec or cold boot.
Lakshmi Ramasubramanian (5):
powerpc: Refactor kexec functions to move arch independent code to IMA
powerpc: Use libfdt functions to fetch IMA buffer properties
IMA: Refactor do_get_kexec_buffer() to call of_ functions directly
arm64: Store IMA log information in kimage used for kexec
arm64: Add IMA kexec buffer to DTB
arch/arm64/Kconfig | 1 +
arch/arm64/include/asm/ima.h | 17 ++++
arch/arm64/include/asm/kexec.h | 3 +
arch/arm64/kernel/machine_kexec_file.c | 28 ++++++
arch/powerpc/include/asm/ima.h | 3 -
arch/powerpc/kexec/ima.c | 123 ++++++-------------------
include/linux/libfdt.h | 3 +
security/integrity/ima/ima_kexec.c | 81 ++++++++++++++++
8 files changed, 161 insertions(+), 98 deletions(-)
create mode 100644 arch/arm64/include/asm/ima.h
--
2.28.0
