From nobody Fri Dec 19 07:17:36 2025 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 55490225775; Mon, 21 Apr 2025 22:25:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745274343; cv=none; b=eLNk0NcSyXrEEc2HOjBt3QPKWhlCLMbqfKQwZ/khc0G9asUSeWT+y94fRsMArnSronm8gwpFHcR7LnSFA4pxrXBaATfrS+K2dtLdjgWqL3BF5ZaSKVjw42KO5L9QlCU69KFs/W9RNzAHFkqVx/HnrrWYpKLIwIKn3bJYWcS03SE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745274343; c=relaxed/simple; bh=ep5hoCheHKVEAtuxkukKJc6B/FpwA2Gi/1bwxXEak8w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YMBVrh9+gxslXOTSoWgTif4fBJHaSGMgavxSEhqV8NfgQP3KY2Pbc4mTX9/NfoPl6Aj5FPfunfAgxQyfvTlPNzWLEWkmc0wFc/HXsQcUae3miaoB6T15/39Z4YwA5rZyLdVvh0bMUTEjkghLYTEgbUL60O4s83Qrj1eInIHNWbE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=MdoYqlCS; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="MdoYqlCS" Received: from DESKTOP-VOT081N.hsd1.ga.comcast.net (unknown [20.110.218.7]) by linux.microsoft.com (Postfix) with ESMTPSA id 1FBF6203B872; Mon, 21 Apr 2025 15:25:40 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 1FBF6203B872 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1745274342; bh=I1XbzaRAmgoeuh/TNUrZkXNkO8KOvtrE3h9mj9fnJZo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MdoYqlCShRstXxa8GSNmrhQ6gqr8BTOAfDWMqCju+T69ZgMmW381StuoxoF+KCNVi wV7P3AaH7Cx2DQ0D6r8pye8jSu8r91t+fRFIESjw0YRpukufLxxwysaKHMU5W0UA6D W1kp03tF/GiklYSQjoJF2HJVLh5XAMYmS2Fh6h5g= From: steven chen To: zohar@linux.ibm.com, stefanb@linux.ibm.com, roberto.sassu@huaweicloud.com, roberto.sassu@huawei.com, eric.snowberg@oracle.com, ebiederm@xmission.com, paul@paul-moore.com, code@tyhicks.com, bauermann@kolabnow.com, linux-integrity@vger.kernel.org, kexec@lists.infradead.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Cc: madvenka@linux.microsoft.com, nramas@linux.microsoft.com, James.Bottomley@HansenPartnership.com, bhe@redhat.com, vgoyal@redhat.com, dyoung@redhat.com Subject: [PATCH v13 5/9] ima: kexec: define functions to copy IMA log at soft boot Date: Mon, 21 Apr 2025 15:25:11 -0700 Message-ID: <20250421222516.9830-6-chenste@linux.microsoft.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20250421222516.9830-1-chenste@linux.microsoft.com> References: <20250421222516.9830-1-chenste@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Chen The IMA log is currently copied to the new kernel during kexec 'load'=20 using ima_dump_measurement_list(). However, the log copied at kexec=20 'load' may result in loss of IMA measurements that only occurred after kexec "load'. Setup the needed infrastructure to move the IMA log copy=20 from kexec 'load' to 'execute'. Define a new IMA hook ima_update_kexec_buffer() as a stub function. It will be used to call ima_dump_measurement_list() during kexec 'execute'. Implement ima_kexec_post_load() function to be invoked after the new=20 Kernel image has been loaded for kexec. ima_kexec_post_load() maps the=20 IMA buffer to a segment in the newly loaded Kernel. It also registers=20 the reboot notifier_block to trigger ima_update_kexec_buffer() at=20 kexec 'execute'. Set the priority of register_reboot_notifier to INT_MIN to ensure that the IMA log copy operation will happen at the end of the operation chain, so=20 that all the IMA measurement records extended into the TPM are copied Co-developed-by: Tushar Sugandhi Signed-off-by: Tushar Sugandhi Cc: Eric Biederman Cc: Baoquan He =20 Cc: Vivek Goyal Cc: Dave Young Signed-off-by: Steven Chen Reviewed-by: Mimi Zohar Acked-by: Baoquan He Reviewed-by: Stefan Berger --- include/linux/ima.h | 3 ++ security/integrity/ima/ima_kexec.c | 47 ++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/include/linux/ima.h b/include/linux/ima.h index 0bae61a15b60..8e29cb4e6a01 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -32,6 +32,9 @@ static inline void ima_appraise_parse_cmdline(void) {} =20 #ifdef CONFIG_IMA_KEXEC extern void ima_add_kexec_buffer(struct kimage *image); +extern void ima_kexec_post_load(struct kimage *image); +#else +static inline void ima_kexec_post_load(struct kimage *image) {} #endif =20 #else diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/im= a_kexec.c index 7e0a19c3483f..e79f6caf895b 100644 --- a/security/integrity/ima/ima_kexec.c +++ b/security/integrity/ima/ima_kexec.c @@ -12,10 +12,14 @@ #include #include #include +#include +#include #include "ima.h" =20 #ifdef CONFIG_IMA_KEXEC +static bool ima_kexec_update_registered; static struct seq_file ima_kexec_file; +static void *ima_kexec_buffer; =20 static void ima_free_kexec_file_buf(struct seq_file *sf) { @@ -162,6 +166,49 @@ void ima_add_kexec_buffer(struct kimage *image) kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n= ", kbuf.mem); } + +/* + * Called during kexec execute so that IMA can update the measurement list. + */ +static int ima_update_kexec_buffer(struct notifier_block *self, + unsigned long action, void *data) +{ + return NOTIFY_OK; +} + +static struct notifier_block update_buffer_nb =3D { + .notifier_call =3D ima_update_kexec_buffer, + .priority =3D INT_MIN +}; + +/* + * Create a mapping for the source pages that contain the IMA buffer + * so we can update it later. + */ +void ima_kexec_post_load(struct kimage *image) +{ + if (ima_kexec_buffer) { + kimage_unmap_segment(ima_kexec_buffer); + ima_kexec_buffer =3D NULL; + } + + if (!image->ima_buffer_addr) + return; + + ima_kexec_buffer =3D kimage_map_segment(image, + image->ima_buffer_addr, + image->ima_buffer_size); + if (!ima_kexec_buffer) { + pr_err("Could not map measurements buffer.\n"); + return; + } + + if (!ima_kexec_update_registered) { + register_reboot_notifier(&update_buffer_nb); + ima_kexec_update_registered =3D true; + } +} + #endif /* IMA_KEXEC */ =20 /* --=20 2.43.0