On Fri, 2024-01-05 at 12:22 -0800, Tushar Sugandhi wrote:
> >> @@ -194,6 +206,15 @@ static int ima_update_kexec_buffer(struct notifier_block *self,
> >> return ret;
> >> }
> >>
> >> + buf_size = ima_get_binary_runtime_size();
> >> + scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
> >> + "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;",
> >> + kexec_segment_size, buf_size);
> >> +
> >> + ima_measure_critical_data("ima_kexec", "kexec_execute",
> >> + ima_kexec_event, strlen(ima_kexec_event),
> >> + false, NULL, 0);
> >> +
> >
> > Please consider including the number of measurement records as well.
> Will do. I think that would be valuable information.
>
> Per my understanding, I will have to use the function
> ima_show_measurements_count() or ima_show_htable_value() to get the
> number of measurement records value[1]. So I will have to expose that
> function from "ima_fs.c" to "ima_kexec.c". Hope that's ok.
>
> [1]
> https://elixir.bootlin.com/linux/latest/sourcesecurity/integrity/ima/ima_fs.c
>
>
> static ssize_t ima_show_measurements_count(struct file *filp,
> char __user *buf,
> size_t count, loff_t *ppos)
> {
> return ima_show_htable_value(buf, count, ppos, &ima_htable.len);
I don't see a need to expose this function. ima_htable is defined in ima.h.
You can read the ima_htable.len directly, as ima_show_htable_value does.
--
thanks,
Mimi
