On Tue, 2023-06-06 at 11:37 -0400, Stefan Berger wrote: > > On 5/31/23 18:43, Mimi Zohar wrote: > > On Wed, 2023-05-31 at 15:02 -0700, Tushar Sugandhi wrote: > >> Hi Mimi, > >> > >> On 5/31/23 04:39, Mimi Zohar wrote: > >>> Hi Tushar, > >>> > >>> On Thu, 2023-05-25 at 10:21 -0700, Tushar Sugandhi wrote: > >>> > >>>> The issue of IMA measurements getting lost between kexec 'load' and > >>>> 'execute' still exists. > >>>> I verified it on the mainline kernel 6.4.rc3. See *Appendix A* for > >>>> details. > > I think there's a 2nd problem. Once the IMA measurement list is frozen (at > kexec 'exec' stage) > IMA must stop extending PCRs. It can log (into the void) if it wanted to but > the PCR extensions > have to stop otherwise the TPM's PCR state won't match the log in the > kexec'ed-to kernel. I have > seen that on PPC64 some processes are being kicked off by kexec 'exec' that > end up causing TPM > driver error message due to what seems to be a shutdown of the driver > subsystem at this point. > I am not sure what an elegant method would be to stop PCR extensions. Maybe a > flag on the level > of IMA would do? Or notifying the TPM driver to reject PCR extensions or just > any command?
Thank you for raising this concern. Agreed "kexec exec" might trigger additional measurements. As long as these are known, consistent measurements, they could be pre-measured before calling "kexec exec". -- thanks, Mimi _______________________________________________ kexec mailing list [email protected] http://lists.infradead.org/mailman/listinfo/kexec
