Hello Dave, Thanks for your considerations on this feature. Am Mittwoch, 22 Juni 2016, 09:20:46 schrieb Dave Young: > On 06/20/16 at 10:44pm, Thiago Jung Bauermann wrote: > > This feature was implemented because the Integrity Measurement > > Architecture subsystem needs to preserve its measurement list accross > > the kexec reboot. This is so that IMA can implement trusted boot > > support on the OpenPower platform, because on such systems an > > intermediary Linux instance running as part of the firmware is used to > > boot the target operating system via kexec. Using this mechanism, IMA > > on this intermediary instance can hand over to the target OS the > > measurements of the components that were used to boot it. > We have CONFIG_KEXEC_VERIFY_SIG, why not verifying the kernel to be > loaded instead? I feel IMA should rebuild its measurement instead of > passing it to another kernel. In trusted boot, each stage of the boot process (firmware, boot loader, target OS) measures the following stage before passing control to it, and records that measurement cumulatively so that the target OS can look back and see measurements of all the components that were used from the earliest boot stages until the target OS was loaded (including a measurement of the OS itself). If IMA had to rebuild the measurements, it would mean that one stage is measuring itself. This violates this design property of the trusted boot process (i.e., each boot stage is measured by the one before it) so it's not really an option. It has to receive the measurements from the boot stage that ran before it. > Kexec reboot is also a reboot. If we have > to preserve something get from firmware we can do it, but other than > that I think it sounds not a good idea. OpenPower uses a Linux kernel (and initrd with a tiny system image) as a boot loader, so in this platform a kexec reboot is not a reboot. It is part of the boot process itself as the way of passing control from the boot loader to the target OS. > > This series applies on top of v2 of the "kexec_file_load implementation > > > for PowerPC" patch series at: > The kexec_file_load patches should be addressed first, no? Yes. I posted this series for two reasons: 1. The PowerPC maintainer asked why he would want to have the kexec_file_load system call, and this feature is one of the reasons. I wanted to show that it is not an hypothetical feature, there is a functioning implementation. 2. I want to start discussion on this feature with the community early, so that I can incorporate feedback and have it ready to be accepted (or closer to ready at least) by the time the kexec_file_load patches are accepted. []'s Thiago Jung Bauermann IBM Linux Technology Center
