Re: [PATCH v11 5/9] ima: kexec: define functions to copy IMA log at soft boot

[steven chen]

On 4/8/2025 7:21 AM, Mimi Zohar wrote:
> On Wed, 2025-04-02 at 05:47 -0700, steven chen wrote:
> > The IMA log is currently copied to the new kernel during kexec 'load'
> > using ima_dump_measurement_list(). However, the log copied at kexec
> > 'load' may result in loss of IMA measurements that only occurred after
> > kexec "load'.
> Ok
>
> > Therefore, the log needs to be copied during kexec
> > 'execute'.
> The above line is unnecessary.
>
> > Setup the needed infrastructure to move the IMA log copy from
> > kexec 'load' to 'execute'.
> >
> > Define a new IMA hook ima_update_kexec_buffer() as a stub function.
> > It will be used to call ima_dump_measurement_list() during kexec 'execute'.
> >
> > Implement ima_kexec_post_load() function to be invoked after the new
> > Kernel image has been loaded for kexec. ima_kexec_post_load() maps the
> > IMA buffer to a segment in the newly loaded Kernel.  It also registers
> > the reboot notifier_block to trigger ima_update_kexec_buffer() at
> > kexec 'execute'.
> >
> > Set the priority of register_reboot_notifier to INT_MIN to ensure that the
> > IMA log copy operation will happen at the end of the operation chain, which
> > is crucial for maintaining the integrity of the logs
> Instead of ", which is crucial for maintaining the integrity of the logs"
> say something like ", so that all the IMA measurement records extended into the
> TPM are copied."

Hi Mimi,

I will update in next version.

Thanks,

Steven

> > Signed-off-by: Tushar Sugandhi <tusharsu@xxxxxxxxxxxxxxxxxxx>
> > Cc: Eric Biederman <ebiederm@xxxxxxxxxxxx>
> > Cc: Baoquan He <bhe@xxxxxxxxxx>
> > Cc: Vivek Goyal <vgoyal@xxxxxxxxxx>
> > Cc: Dave Young <dyoung@xxxxxxxxxx>
> > Signed-off-by: steven chen <chenste@xxxxxxxxxxxxxxxxxxx>
> > Reviewed-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
> Thanks, Steven.  With the change to use INT_MIN, the "kexec_execute" record is
> now added to the IMA measurement list, extended into the PCR, and included in
> the IMA measurement list records copied.
>
> Reviewed-by: Mimi Zohar <zohar@xxxxxxxxxxxxx>