Re: [PATCH v5 00/10] ima: carry the measurement list across kexec

2016-09-29 Thread Mimi Zohar
On Thu, 2016-09-29 at 16:37 -0500, Eric W. Biederman wrote: > Mimi Zohar writes: > > > The TPM PCRs are only reset on a hard reboot. In order to validate a > > TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement list > > of the running kernel must be

Re: [PATCH v5 00/10] ima: carry the measurement list across kexec

2016-09-29 Thread Mimi Zohar
On Thu, 2016-09-29 at 16:37 -0500, Eric W. Biederman wrote: > Mimi Zohar writes: > > > The TPM PCRs are only reset on a hard reboot. In order to validate a > > TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement list > > of the running kernel must be saved and then restored on

Re: [PATCH v5 00/10] ima: carry the measurement list across kexec

2016-09-29 Thread Eric W. Biederman
Mimi Zohar writes: > The TPM PCRs are only reset on a hard reboot. In order to validate a > TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement list > of the running kernel must be saved and then restored on the subsequent > boot, possibly of a

Re: [PATCH v5 00/10] ima: carry the measurement list across kexec

2016-09-29 Thread Eric W. Biederman
Mimi Zohar writes: > The TPM PCRs are only reset on a hard reboot. In order to validate a > TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement list > of the running kernel must be saved and then restored on the subsequent > boot, possibly of a different architecture. > > The

[PATCH v5 00/10] ima: carry the measurement list across kexec

2016-09-26 Thread Mimi Zohar
The TPM PCRs are only reset on a hard reboot. In order to validate a TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement list of the running kernel must be saved and then restored on the subsequent boot, possibly of a different architecture. The existing securityfs

[PATCH v5 00/10] ima: carry the measurement list across kexec

2016-09-26 Thread Mimi Zohar
The TPM PCRs are only reset on a hard reboot. In order to validate a TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement list of the running kernel must be saved and then restored on the subsequent boot, possibly of a different architecture. The existing securityfs