On 4/10/2025 2:54 AM, Baoquan He wrote:
On 04/02/25 at 05:47am, steven chen wrote:
The extra memory allocated for carrying the IMA measurement list across
kexec is hard-coded as half a PAGE. Make it configurable.
Define a Kconfig option, IMA_KEXEC_EXTRA_MEMORY_KB, to configure the
extra memory (in kb) to be allocated for IMA measurements added during
kexec soft reboot. Ensure the default value of the option is set such
that extra half a page of memory for additional measurements is allocated
for the additional measurements.
Update ima_add_kexec_buffer() function to allocate memory based on the
Kconfig option value, rather than the currently hard-coded one.
Suggested-by: Stefan Berger <stef...@linux.ibm.com>
Signed-off-by: Tushar Sugandhi <tusha...@linux.microsoft.com>
Signed-off-by: steven chen <chen...@linux.microsoft.com>
Reviewed-by: Stefan Berger <stef...@linux.ibm.com>
Reviewed-by: Mimi Zohar <zo...@linux.ibm.com>
---
security/integrity/ima/Kconfig | 10 ++++++++++
security/integrity/ima/ima_kexec.c | 16 +++++++++++-----
2 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index 475c32615006..d73c96c3c1c9 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -321,4 +321,14 @@ config IMA_DISABLE_HTABLE
help
This option disables htable to allow measurement of duplicate
records.
+config IMA_KEXEC_EXTRA_MEMORY_KB
+ int "Extra memory for IMA measurements added during kexec soft reboot"
+ depends on IMA_KEXEC
+ default 0
Usually a new Kconfig item which accepts a range should define the range
boundary, otherwise it's not clear to people how large or how small it
can be set. For example, can I set it as value of 1<<40? We should at
least estimate a possible upper limit for it for other people's
reference. My personal opinion.
Hi Baoquan,
How about I set range 2-40? Default set as 2, same as the fixed setting.
Thanks,
Steven
The rest looks good to me.
+ help
+ IMA_KEXEC_EXTRA_MEMORY_KB determines the extra memory to be
+ allocated (in kb) for IMA measurements added during kexec soft reboot.
+ If set to the default value of 0, an extra half page of memory for
those
+ additional measurements will be allocated.
+
endif
...snip...
