On 8/12/22 13:10, Borislav Petkov wrote:
On Fri, Aug 12, 2022 at 12:43:02PM -0400, Stefan Berger wrote:
From: Jonathan McDowell <noodles@xxxxxx>
On kexec file load, the Integrity Measurement Architecture (IMA)
subsystem may verify the IMA signature of the kernel and initramfs, and
measure it. The command line parameters passed to the kernel in the
kexec call may also be measured by IMA.
A remote attestation service can verify a TPM quote based on the TPM
event log, the IMA measurement list and the TPM PCR data. This can
be achieved only if the IMA measurement log is carried over from the
current kernel to the next kernel across the kexec call.
PowerPC and ARM64 both achieve this using device tree with a
"linux,ima-kexec-buffer" node. x86 platforms generally don't make use of
device tree, so use the setup_data mechanism to pass the IMA buffer to
the new kernel.
Signed-off-by: Jonathan McDowell <noodles@xxxxxx>
Signed-off-by: Borislav Petkov <bp@xxxxxxx>
Reviewed-by: Mimi Zohar <zohar@xxxxxxxxxxxxx> # IMA function definitions
Link: https://lore.kernel.org/r/YmKyvlF3my1yWTvK@noodles-fedora-PC23Y6EG
Is there any particular reason to keep sending a patch which is already
upstream?
Yes, so this series can be tested by krobot. I only based this series on
5.19 so far, so if it's upstreamed since then it will go missing next
time when I base it on 5.20-rc1 or so.
