On Thu, Sep 24, 2026 at 7:27 PM Mimi Zohar <[email protected]> wrote: > > The lack of KEXEC_CMDLINE appraisal is an architectural constraint of IMA's > inode-based appraisal model. The kexec command line is a plain buffer passed > directly to kexec_file_load() via syscall. Unlike the kernel image or > initramfs, > it is not a file. There is no natural way to associate a signature with it, > whether via xattr or as an appended signature. This is not an intentional > security decision but a consequence of how IMA appraisal works. > > The threat model concern you raise is valid — a caller with access to > kexec_file_load() can supply an unauthenticated command line that weakens the > target kernel's enforcement state, even when the kernel and initramfs are > appraised. This gap is real and currently unaddressed. > > IMA continuity across kexec has not been discussed. Appraising the kernel > image > and initramfs does not guarantee the target kernel will enforce an equivalent > IMA policy after boot. > > We would welcome proposals for addressing these gaps.
Thank you, Mimi. This clarifies the current security guarantees and limitations and gives us a clearer direction for investigating a solution. I’ll continue working on this and hope to follow up with some concrete proposals.
