If the new measurements are added to the IMA log while it is being
being copied to the kexec buffer during kexec 'execute', it can miss
copying those new measurements to the kexec buffer, and the buffer can go
out of sync with TPM PCRs. This could result in breaking the integrity
of the measurements after the kexec soft reboot to the new Kernel.
Add a check in the ima_add_template_entry() function not to measure
events and return from the function early when 'suspend_ima_measurements'
flag is set.
This ensures the consistency of the IMA measurement list while copying
them to the kexec buffer. When the 'suspend_ima_measurements' flag is
set, any new measurements will be ignored until the flag is unset. This
allows the buffer to be safely copied without worrying about concurrent
modifications to the measurement list. This is crucial for maintaining
the integrity of the measurements during a kexec soft reboot.
Signed-off-by: Tushar Sugandhi <tusharsu@xxxxxxxxxxxxxxxxxxx>
---
security/integrity/ima/ima_queue.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
index 9e7d1196006e..498b6b92f3f0 100644
--- a/security/integrity/ima/ima_queue.c
+++ b/security/integrity/ima/ima_queue.c
@@ -194,6 +194,19 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
}
}
+ /*
+ * suspend_ima_measurements will be set if the system is
+ * undergoing kexec soft boot to a new kernel.
+ * suspending measurements in this short window ensures the
+ * consistency of the IMA measurement list during copying
+ * of the kexec buffer.
+ */
+ if (atomic_read(&suspend_ima_measurements)) {
+ audit_cause = "measurements_suspended";
+ audit_info = 0;
+ goto out;
+ }
+
result = ima_add_digest_entry(entry,
!IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE));
if (result < 0) {
--
2.25.1
