]> git.ipfire.org Git - thirdparty/linux.git/commit
ima: kexec: define functions to copy IMA log at soft boot
authorSteven Chen <chenste@linux.microsoft.com>
Mon, 21 Apr 2025 22:25:11 +0000 (15:25 -0700)
committerMimi Zohar <zohar@linux.ibm.com>
Tue, 29 Apr 2025 19:54:54 +0000 (15:54 -0400)
commitf18e502db673c75f762d47101dafcf58f30e2733
tree7b3a8dad90aec95c0858aefef6333f65313ed36d
parent9ee8888a80fe2bd20ce929ffbc1dedd57607a778
ima: kexec: define functions to copy IMA log at soft boot

The IMA log is currently copied to the new kernel during kexec 'load'
using ima_dump_measurement_list(). However, the log copied at kexec
'load' may result in loss of IMA measurements that only occurred after
kexec "load'. Setup the needed infrastructure to move the IMA log copy
from kexec 'load' to 'execute'.

Define a new IMA hook ima_update_kexec_buffer() as a stub function.
It will be used to call ima_dump_measurement_list() during kexec 'execute'.

Implement ima_kexec_post_load() function to be invoked after the new
Kernel image has been loaded for kexec. ima_kexec_post_load() maps the
IMA buffer to a segment in the newly loaded Kernel.  It also registers
the reboot notifier_block to trigger ima_update_kexec_buffer() at
kexec 'execute'.

Set the priority of register_reboot_notifier to INT_MIN to ensure that the
IMA log copy operation will happen at the end of the operation chain, so
that all the IMA measurement records extended into the TPM are copied

Co-developed-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Signed-off-by: Steven Chen <chenste@linux.microsoft.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Acked-by: Baoquan He <bhe@redhat.com>
Tested-by: Stefan Berger <stefanb@linux.ibm.com> # ppc64/kvm
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
include/linux/ima.h
security/integrity/ima/ima_kexec.c