On 04/09/25 at 11:40am, Mimi Zohar wrote: > On Wed, 2025-04-09 at 10:42 +0800, Baoquan He wrote: ......snip.. > > Thanks for confirming. I will consider how to fix it accordingly. Maybe > > after Steven's patches are merged. That would be great if the buffer > > allocating and storing can be skiped for kdump in Steven's patch. While > > I am worried that could disrupt the progress of Steven's patches. > > Agreed, let's get Steven's patch set upstreamed and then make the kdump > exceptions. > > - "ima: kexec: move IMA log copy from kexec load to execute" looks like it > isn't > copying the IMA measurement list records (kexec_post_load), but the memory for > the IMA measurement list is being allocated (ima_alloc_kexec_file_buf). > > - Do you really want to totally disable IMA for kdump or would disabling IMA- > measurement be sufficient? Remember there's already an option to disable IMA- > appraisal. Disabling just IMA-measurement would allow IMA-appraisal to > continue > to work. Meaning based on policy the integrity of files - executables, kernel > image, etc - could still be verified. > > Without IMA-measurement: > - No adding records to the IMA measurement list > - No IMA measurement list pseudo securityfs files > - No extending the TPM > > With IMA-appraisal: > - Integrity verification of files based on keys, keyrings > - Loading keys
Currently, Kdump has no demand to do integrity verification based on keys, keyrings, except of Coiby's LUKS support in kdump: [PATCH v8 0/7] Support kdump with LUKS encryption by reusing LUKS volume keys https://lore.kernel.org/all/[email protected]/T/#u I have talked to Coiby, he will do some investigations to see if loading keys related to IMA or IMA-appraisal functionality is related to LUKS support in kdump because the LUKS support in kdump also needs store/restore keys/keyrings between normal kernel and kdump kernel. > > Obviously my preference would be to add support to disable IMA-measurement in > a > kdump environment. > > thanks, > > Mimi >
