On Mon, 2025-02-03 at 15:20 -0800, steven chen wrote: > The amount of memory allocated at kexec load, even with the extra memory > allocated, might not be large enough for the entire measurement list. The > indeterminate interval between kexec 'load' and 'execute' could exacerbate > this problem. > > Define two new IMA events, 'kexec_load' and 'kexec_execute', to be > measured as critical data at kexec 'load' and 'execute' respectively. > Report the allocated kexec segment size, IMA binary log size and the > runtime measurements count as part of those events. > > These events, and the values reported through them, serve as markers in > the IMA log to verify the IMA events are captured during kexec soft > reboot. The presence of a 'kexec_load' event in between the last two > 'boot_aggregate' events in the IMA log implies this is a kexec soft > reboot, and not a cold-boot. And the absence of 'kexec_execute' event > after kexec soft reboot implies missing events in that window which > results in inconsistency with TPM PCR quotes, necessitating a cold boot > for a successful remote attestation.
As a reminder, please include directions for verifying the buffer data hash against the buffer data. The directions would be similar to those in commit 6b4da8c0e7f ("IMA: Define a new template field buf"). > > Reviewed-by: Stefan Berger <stef...@linux.ibm.com> > Author: Tushar Sugandhi <tusha...@linux.microsoft.com> > Signed-off-by: Tushar Sugandhi <tusha...@linux.microsoft.com> > Signed-off-by: steven chen <chen...@linux.microsoft.com> > --- > security/integrity/ima/ima_kexec.c | 23 +++++++++++++++++++++++ > 1 file changed, 23 insertions(+) > > diff --git a/security/integrity/ima/ima_kexec.c > b/security/integrity/ima/ima_kexec.c > index c9c916f69ca7..0342ddfa9342 100644 > --- a/security/integrity/ima/ima_kexec.c > +++ b/security/integrity/ima/ima_kexec.c > @@ -17,6 +17,8 @@ > #include "ima.h" > > #ifdef CONFIG_IMA_KEXEC > +#define IMA_KEXEC_EVENT_LEN 256 > + > static struct seq_file ima_kexec_file; > static void *ima_kexec_buffer; > static size_t kexec_segment_size; > @@ -36,6 +38,24 @@ static void ima_free_kexec_file_buf(struct seq_file *sf) > ima_reset_kexec_file(sf); > } > > +static void ima_measure_kexec_event(const char *event_name) > +{ > + char ima_kexec_event[IMA_KEXEC_EVENT_LEN]; > + size_t buf_size = 0; > + long len; > + > + buf_size = ima_get_binary_runtime_size(); > + len = atomic_long_read(&ima_htable.len); > + > + scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN, > + "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;" > + "ima_runtime_measurements_count=%ld;", > + kexec_segment_size, buf_size, len); >From scripts/checkpatch.pl, "Alignment should match open parenthesis". > + > + ima_measure_critical_data("ima_kexec", event_name, ima_kexec_event, > + strlen(ima_kexec_event), false, NULL, > 0); >From the kernel-doc scnprintf(), returns the number of bytes. There should be >no need to calculate it using strlen(). > +} > + > static int ima_alloc_kexec_file_buf(size_t segment_size) > { > /* > @@ -60,6 +80,7 @@ static int ima_alloc_kexec_file_buf(size_t segment_size) > out: > ima_kexec_file.read_pos = 0; > ima_kexec_file.count = sizeof(struct ima_kexec_hdr); /* reserved > space > */ > + ima_measure_kexec_event("kexec_load"); > > return 0; > } > @@ -201,6 +222,8 @@ static int ima_update_kexec_buffer(struct notifier_block > *self, > return ret; > } > > + ima_measure_kexec_event("kexec_execute"); > + > ret = ima_dump_measurement_list(&buf_size, &buf, > kexec_segment_size); > After fixing up and applying this patch set to 6.14.0-rc1, I'm not seeing the "kexec_execute". Even after changing the default extra memory, I'm still not seeing the measurement. Mimi