IMA measurements snapshot occurs at kexec 'load', but any additional measurements between 'load' and kexec 'execute' aren't carried over post kexec soft-reboot.[1] This may lead to TPM PCRs extending with events that are not reflected in the new Kernel's IMA log. By measuring the TPM update counter at kexec 'load' and at ima_init after the kexec soft-reboot, the remote attestation service can identify potentially lost events by comparing the log event count with the counter difference. Measure the TPM update counter at kexec image load. [1] https://lore.kernel.org/all/20230703215709.1195644-1-tusharsu@xxxxxxxxxxxxxxxxxxx/ ima: measure events between kexec load and execute Signed-off-by: Tushar Sugandhi <tusharsu@xxxxxxxxxxxxxxxxxxx> --- kernel/kexec_file.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index f1a0e4e3fb5c..4b6391b02c5a 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -246,6 +246,9 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd, image->cmdline_buf_len - 1); } + /* Measures TPM update counter at kexec load. */ + ima_measure_update_counter("kexec_load_tpm_update_counter"); + /* IMA needs to pass the measurement list to the next kernel. */ ima_add_kexec_buffer(image); -- 2.25.1
