Re: [PATCH v5 8/8] ima: measure kexec load and exec events as critical data

From: Tushar Sugandhi <tusharsu@linux.microsoft.com>
To: Stefan Berger <stefanb@linux.ibm.com>,
	zohar@linux.ibm.com, roberto.sassu@huaweicloud.com,
	roberto.sassu@huawei.com, eric.snowberg@oracle.com,
	ebiederm@xmission.com, noodles@fb.com, bauermann@kolabnow.com,
	linux-integrity@vger.kernel.org, kexec@lists.infradead.org
Cc: code@tyhicks.com, nramas@linux.microsoft.com, paul@paul-moore.com
Subject: Re: [PATCH v5 8/8] ima: measure kexec load and exec events as critical data
Date: Wed, 14 Feb 2024 22:57:41 -0800	[thread overview]
Message-ID: <b6895788-01cb-4f09-9d75-0f8ac64d5409@linux.microsoft.com> (raw)
In-Reply-To: <803ac44d-1d08-46f3-a41c-01f113a21c11@linux.ibm.com>


On 2/14/24 13:00, Stefan Berger wrote:
> 
> 
> On 2/14/24 10:38, Tushar Sugandhi wrote:
>> The amount of memory allocated at kexec load, even with the extra memory
>> allocated, might not be large enough for the entire measurement list.  
>> The
>> indeterminate interval between kexec 'load' and 'execute' could 
>> exacerbate
>> this problem.
>>
>> Define two new IMA events, 'kexec_load' and 'kexec_execute', to be
>> measured as critical data at kexec 'load' and 'execute' respectively.
>> Report the allocated kexec segment size, IMA binary log size and the
>> runtime measurements count as part of those events.
>>
>> These events, and the values reported through them, serve as markers in
>> the IMA log to verify the IMA events are captured during kexec soft
>> reboot.  The presence of a 'kexec_load' event in between the last two
>> 'boot_aggregate' events in the IMA log implies this is a kexec soft
>> reboot, and not a cold-boot.  And the absence of 'kexec_execute' event
>> after kexec soft reboot implies missing events in that window which
>> results in inconsistency with TPM PCR quotes, necessitating a cold boot
>> for a successful remote attestation.
>>
>> Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
>> ---
>>   security/integrity/ima/ima_kexec.c | 34 +++++++++++++++++++++++++++++-
>>   1 file changed, 33 insertions(+), 1 deletion(-)
>>
>> diff --git a/security/integrity/ima/ima_kexec.c 
>> b/security/integrity/ima/ima_kexec.c
>> index 50903d4ce880..31495a043959 100644
>> --- a/security/integrity/ima/ima_kexec.c
>> +++ b/security/integrity/ima/ima_kexec.c
>> @@ -17,6 +17,8 @@
>>   #include "ima.h"
>>   #ifdef CONFIG_IMA_KEXEC
>> +#define IMA_KEXEC_EVENT_LEN 256
>> +
>>   static struct seq_file ima_kexec_file;
>>   static void *ima_kexec_buffer;
>>   static size_t kexec_segment_size;
>> @@ -38,6 +40,10 @@ static void ima_free_kexec_file_buf(struct seq_file 
>> *sf)
>>   static int ima_alloc_kexec_file_buf(size_t segment_size)
>>   {
>> +    char ima_kexec_event[IMA_KEXEC_EVENT_LEN];
>> +    size_t buf_size;
>> +    long len;
>> +
>>       /*
>>        * kexec 'load' may be called multiple times.
>>        * Free and realloc the buffer only if the segment_size is
>> @@ -47,7 +53,7 @@ static int ima_alloc_kexec_file_buf(size_t 
>> segment_size)
>>           ima_kexec_file.size == segment_size &&
>>           ima_kexec_file.read_pos == 0 &&
>>           ima_kexec_file.count == sizeof(struct ima_kexec_hdr))
>> -        return 0;
>> +        goto out;
>>       ima_free_kexec_file_buf(&ima_kexec_file);
>> @@ -60,6 +66,18 @@ static int ima_alloc_kexec_file_buf(size_t 
>> segment_size)
>>       ima_kexec_file.read_pos = 0;
>>       ima_kexec_file.count = sizeof(struct ima_kexec_hdr);    /* 
>> reserved space */
>> +out:
>> +    buf_size = ima_get_binary_runtime_size();
>> +    len = atomic_long_read(&ima_htable.len);
>> +
>> +    scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
>> +          "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"
>> +          "ima_runtime_measurements_count=%ld;",
>> +          segment_size, buf_size, len);
>> +
>> +    ima_measure_critical_data("ima_kexec", "kexec_load", 
>> ima_kexec_event,
>> +                  strlen(ima_kexec_event), false, NULL, 0);
>> +
>>       return 0;
>>   }
>> @@ -186,10 +204,12 @@ void ima_add_kexec_buffer(struct kimage *image)
>>   static int ima_update_kexec_buffer(struct notifier_block *self,
>>                      unsigned long action, void *data)
>>   {
>> +    char ima_kexec_event[IMA_KEXEC_EVENT_LEN];
>>       void *buf = NULL;
>>       size_t buf_size;
>>       int ret = NOTIFY_OK;
>>       bool resume = false;
>> +    long len;
>>       if (!kexec_in_progress) {
>>           pr_info("%s: No kexec in progress.\n", __func__);
>> @@ -201,6 +221,18 @@ static int ima_update_kexec_buffer(struct 
>> notifier_block *self,
>>           return ret;
>>       }
>> +    buf_size = ima_get_binary_runtime_size();
>> +    len = atomic_long_read(&ima_htable.len);
>> +
>> +    scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
>> +          "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"
>> +          "ima_runtime_measurements_count=%ld;",
>> +          kexec_segment_size, buf_size, len);
>> +
>> +    ima_measure_critical_data("ima_kexec", "kexec_execute",
>> +                  ima_kexec_event, strlen(ima_kexec_event),
>> +                  false, NULL, 0);
>> +
>>       ima_measurements_suspend();
>>       ret = ima_dump_measurement_list(&buf_size, &buf,
> 
> It's twice the same code almost in the same file. You could move it into 
> a function.
Fair enough. Will do.

~Tushar

_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec