On Thu, 2025-04-10 at 09:59 -0700, steven chen wrote: > On 4/10/2025 2:54 AM, Baoquan He wrote: > > On 04/02/25 at 05:47am, steven chen wrote: > > > The extra memory allocated for carrying the IMA measurement list across > > > kexec is hard-coded as half a PAGE. Make it configurable. > > > > > > Define a Kconfig option, IMA_KEXEC_EXTRA_MEMORY_KB, to configure the > > > extra memory (in kb) to be allocated for IMA measurements added during > > > kexec soft reboot. Ensure the default value of the option is set such > > > that extra half a page of memory for additional measurements is allocated > > > for the additional measurements. > > > > > > Update ima_add_kexec_buffer() function to allocate memory based on the > > > Kconfig option value, rather than the currently hard-coded one. > > > > > > Suggested-by: Stefan Berger <[email protected]> > > > Signed-off-by: Tushar Sugandhi <[email protected]> > > > Signed-off-by: steven chen <[email protected]> > > > Reviewed-by: Stefan Berger <[email protected]> > > > Reviewed-by: Mimi Zohar <[email protected]> > > > --- > > > security/integrity/ima/Kconfig | 10 ++++++++++ > > > security/integrity/ima/ima_kexec.c | 16 +++++++++++----- > > > 2 files changed, 21 insertions(+), 5 deletions(-) > > > > > > diff --git a/security/integrity/ima/Kconfig > > > b/security/integrity/ima/Kconfig > > > index 475c32615006..d73c96c3c1c9 100644 > > > --- a/security/integrity/ima/Kconfig > > > +++ b/security/integrity/ima/Kconfig > > > @@ -321,4 +321,14 @@ config IMA_DISABLE_HTABLE > > > help > > > This option disables htable to allow measurement of > > > duplicate records. > > > > > > +config IMA_KEXEC_EXTRA_MEMORY_KB > > > + int "Extra memory for IMA measurements added during kexec soft reboot" > > > + depends on IMA_KEXEC > > > + default 0 > > Usually a new Kconfig item which accepts a range should define the range > > boundary, otherwise it's not clear to people how large or how small it > > can be set. For example, can I set it as value of 1<<40? We should at > > least estimate a possible upper limit for it for other people's > > reference. My personal opinion. > > Hi Baoquan, > > How about I set range 2-40? Default set as 2, same as the fixed setting.
0, the current default, sets the "extra" memory to the existing "extra half a page of memory for the additional measurements". For backwards compatibility, please do not change this. The requirement for a larger "extra" measurement is coming from Microsoft. If this isn't any longer a requirement, we could drop this patch. Lakshmi, do you have any thoughts on this? thanks, Mimi > > > The rest looks good to me. > > > > > > > + help > > > + IMA_KEXEC_EXTRA_MEMORY_KB determines the extra memory to be > > > + allocated (in kb) for IMA measurements added during kexec soft reboot. > > > + If set to the default value of 0, an extra half page of memory for > > > those > > > + additional measurements will be allocated. > > > + > > > endif > > ...snip... > > >
