On Tue, 2023-06-06 at 11:37 -0400, Stefan Berger wrote:
> 
> On 5/31/23 18:43, Mimi Zohar wrote:
> > On Wed, 2023-05-31 at 15:02 -0700, Tushar Sugandhi wrote:
> >> Hi Mimi,
> >>
> >> On 5/31/23 04:39, Mimi Zohar wrote:
> >>> Hi Tushar,
> >>>
> >>> On Thu, 2023-05-25 at 10:21 -0700, Tushar Sugandhi wrote:
> >>>
> >>>> The issue of IMA measurements getting lost between kexec 'load' and 
> >>>> 'execute' still exists.
> >>>> I verified it on the mainline kernel 6.4.rc3. See *Appendix A* for 
> >>>> details.
> 
> I think there's a 2nd problem.  Once the IMA measurement list is frozen (at 
> kexec 'exec' stage)
> IMA must stop extending PCRs. It can log (into the void) if it wanted to but 
> the PCR extensions
> have to stop otherwise the TPM's PCR state won't match the log in the 
> kexec'ed-to kernel. I have
> seen that on PPC64 some processes are being kicked off by kexec 'exec' that 
> end up causing TPM
> driver error message due to what seems to be a shutdown of the driver 
> subsystem at this point.
> I am not sure what an elegant method would be to stop PCR extensions. Maybe a 
> flag on the level
> of IMA would do? Or notifying the TPM driver to reject PCR extensions or just 
> any command?

Thank you for raising this concern.

Agreed "kexec exec" might trigger additional measurements.  As long as
these are known, consistent measurements, they could be pre-measured
before calling "kexec exec".

-- 
thanks,

Mimi


_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec

Reply via email to