If the new measurements are added to the list while the kexec buffer is
being copied during kexec execute, the buffer may get corrupted, or it can
go out of sync with TPM PCRs. This could potentially lead to breaking the
integrity of the measurements after the kexec soft reboot to the new
kernel.
Introduce a check in the ima_add_template_entry function not to measure
events and return from the function early when the suspend_ima_measurements
flag is set.
This ensures the consistency of the IMA measurement list during the copying
of the kexec buffer. When the suspend_ima_measurements flag is set, any
new measurements will be ignored until the flag is unset. This allows the
buffer to be safely copied without worrying about concurrent modifications
to the measurement list. This is crucial for maintaining the integrity of
the measurements during a kexec soft reboot.
Signed-off-by: Tushar Sugandhi <tusharsu@xxxxxxxxxxxxxxxxxxx>
---
security/integrity/ima/ima_queue.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index cb9abc02a304..5946a26a2849 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -195,6 +195,19 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
}
}
+ /*
+ * suspend_ima_measurements will be set if the system is
+ * undergoing kexec soft boot to a new kernel.
+ * suspending measurements in this short window ensures the
+ * consistency of the IMA measurement list during copying
+ * of the kexec buffer.
+ */
+ if (atomic_read(&suspend_ima_measurements)) {
+ audit_cause = "measurements_suspended";
+ audit_info = 0;
+ goto out;
+ }
+
result = ima_add_digest_entry(entry,
!IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE));
if (result < 0) {
--
2.25.1
