On 11/3/20 7:18 AM, Mimi Zohar wrote:
Hi Mimi,
On Fri, 2020-10-30 at 10:44 -0700, Lakshmi Ramasubramanian wrote:
On kexec file load Integrity Measurement Architecture (IMA) subsystem
may verify the IMA signature of the kernel and initramfs, and measure
it. The command line parameters passed to the kernel in the kexec call
may also be measured by IMA. A remote attestation service can verify
the measurement through the IMA log and the TPM PCR data. This can be
achieved only if the IMA measurement log is carried over from
the current kernel to the next kernel across the kexec call.
Nice, but you might want to tweak it a bit. This is just a suggestion.
"A remote attestation service can verify a TPM quote based on the TPM
event log, the IMA measurement list, and the TPM PCR data".
Sure - will make this change.
However in the current implementation the IMA measurement logs are not
carried over on ARM64 platforms. Therefore a remote attestation service
cannot verify the authenticity of the running kernel on ARM64 platforms
when the kernel is updated through the kexec system call.
The paragraphs above and below are redundant. The first paragraph
already explained why carrying the measurement across kexec is needed.
Perhaps drop the above paragraph.
Sure.
This patch series adds support for carrying forward the IMA measurement
log on kexec on ARM64. powerpc already supports carrying forward
the IMA measurement log on kexec.
And invert these sentences, starting the paragraph with "Powerpc
already" and ending with ARM64.
Sure.
This series refactors the platform independent code defined for powerpc
such that it can be reused for ARM64 as well. A chosen node namely
"linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
the address and the size of the memory reserved to carry
the IMA measurement log.
^This patch set moves ..."
Sure - will make this change.
Thanks again for reviewing the patches. Will post the updated patch set
shortly.
-lakshmi
