On 04/02/25 at 05:47am, steven chen wrote: > The extra memory allocated for carrying the IMA measurement list across > kexec is hard-coded as half a PAGE. Make it configurable. > > Define a Kconfig option, IMA_KEXEC_EXTRA_MEMORY_KB, to configure the > extra memory (in kb) to be allocated for IMA measurements added during > kexec soft reboot. Ensure the default value of the option is set such > that extra half a page of memory for additional measurements is allocated > for the additional measurements. > > Update ima_add_kexec_buffer() function to allocate memory based on the > Kconfig option value, rather than the currently hard-coded one. > > Suggested-by: Stefan Berger <stef...@linux.ibm.com> > Signed-off-by: Tushar Sugandhi <tusha...@linux.microsoft.com> > Signed-off-by: steven chen <chen...@linux.microsoft.com> > Reviewed-by: Stefan Berger <stef...@linux.ibm.com> > Reviewed-by: Mimi Zohar <zo...@linux.ibm.com> > --- > security/integrity/ima/Kconfig | 10 ++++++++++ > security/integrity/ima/ima_kexec.c | 16 +++++++++++----- > 2 files changed, 21 insertions(+), 5 deletions(-) > > diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig > index 475c32615006..d73c96c3c1c9 100644 > --- a/security/integrity/ima/Kconfig > +++ b/security/integrity/ima/Kconfig > @@ -321,4 +321,14 @@ config IMA_DISABLE_HTABLE > help > This option disables htable to allow measurement of duplicate > records. > > +config IMA_KEXEC_EXTRA_MEMORY_KB > + int "Extra memory for IMA measurements added during kexec soft reboot" > + depends on IMA_KEXEC > + default 0
Usually a new Kconfig item which accepts a range should define the range boundary, otherwise it's not clear to people how large or how small it can be set. For example, can I set it as value of 1<<40? We should at least estimate a possible upper limit for it for other people's reference. My personal opinion. The rest looks good to me. > + help > + IMA_KEXEC_EXTRA_MEMORY_KB determines the extra memory to be > + allocated (in kb) for IMA measurements added during kexec soft reboot. > + If set to the default value of 0, an extra half page of memory for > those > + additional measurements will be allocated. > + > endif ...snip...
