On 1/24/24 08:11, Mimi Zohar wrote:
On Mon, 2024-01-22 at 10:38 -0800, Tushar Sugandhi wrote:
ima_dump_measurement_list() is called during kexec 'load', which may
result in loss of IMA measurements during kexec soft reboot. It needs
to be called during kexec 'execute'.
The below changes need to be part of the same patch to ensure this
patch series remains bisect-safe by ensuring the IMA log gets copied over
during kexec soft reboot both before and after this patch.
Implement ima_update_kexec_buffer() to be called during kexec 'execute'.
Move ima_dump_measurement_list() from ima_add_kexec_buffer() to
ima_update_kexec_buffer(). Make the necessary variables local static to
the file, so that they are accessible during both kexec 'load' - where
the memory is allocated and mapped to a segment in the new Kernel, and
during 'execute' - where the IMA log gets copied over.
Implement kimage_file_post_load() and ima_kexec_post_load() to be invoked
after the new Kernel image has been loaded for kexec.
ima_kexec_post_load() will map the IMA buffer to a segment in the newly
loaded Kernel. It will also register the reboot notifier_block to trigger
ima_update_kexec_buffer() at exec 'execute'.
This defines two new IMA hooks - ima_kexec_post_load() and
ima_update_kexec_buffer(). They shouldn't be hidden here in the move of copying
the measurement list from kexec load to execute.
If "ima_update_kexec_buffer()" was initially defined as a stub function, the
infrastructure could be set up ahead of time. This patch could then be limited
to just moving the copy from kexec "load" to "execute", by replacing the stub
function with the real function.
Agreed. Making ima_kexec_post_load() and ima_update_kexec_buffer() as
stubs/hooks did cross my mind. Thanks for confirming that.
I will split this patch (4/7) into two.
First will define the stubs, setup the infrastructure.
And second will move the copy from 'load' to 'execute'.
~Tushar
Modify kexec_file_load() syscall to call kimage_file_post_load() after the
image has been loaded and prepared for kexec. Call it only on kexec soft
reboot and not for KEXEC_FILE_ON_CRASH.
