Re: TPM: hibernate with IMA PCR 10

From: Mimi Zohar <zohar@linux.ibm.com>
To: Evan Green <evgreen@chromium.org>, Jarkko Sakkinen <jarkko@kernel.org>
Cc: Matthew Garrett <mgarrett@aurora.tech>,
	Ken Goldman <kgold@linux.ibm.com>,
	LKML <linux-kernel@vger.kernel.org>,
	Daniil Lunev <dlunev@google.com>,
	"James E.J. Bottomley" <jejb@linux.ibm.com>,
	linux-integrity@vger.kernel.org, Jonathan Corbet <corbet@lwn.net>,
	"Rafael J. Wysocki" <rjw@rjwysocki.net>,
	Gwendal Grignou <gwendal@chromium.org>,
	Linux PM <linux-pm@vger.kernel.org>,
	Len Brown <len.brown@intel.com>, Pavel Machek <pavel@ucw.cz>,
	"Rafael J. Wysocki" <rafael@kernel.org>
Subject: Re: TPM: hibernate with IMA PCR 10
Date: Wed, 07 Sep 2022 19:57:27 -0400	[thread overview]
Message-ID: <96360ec16b21d8b37461a5de083ff794f3604300.camel@linux.ibm.com> (raw)
In-Reply-To: <CAE=gft68it0VtFfddCiSQYfz2+Fmoc+6ZK-ounDrjuRJ8nsOLw@mail.gmail.com>

On Wed, 2022-09-07 at 13:47 -0700, Evan Green wrote:
> On Tue, Aug 30, 2022 at 7:48 PM Jarkko Sakkinen <jarkko@kernel.org> wrote:
> >
> > On Mon, Aug 29, 2022 at 02:51:50PM -0700, Matthew Garrett wrote:
> > > On Mon, Aug 29, 2022 at 2:45 PM Ken Goldman <kgold@linux.ibm.com> wrote:
> > > >
> > > > On 5/4/2022 7:20 PM, Evan Green wrote:
> > > > > Enabling the kernel to be able to do encryption and integrity checks on
> > > > > the hibernate image prevents a malicious userspace from escalating to
> > > > > kernel execution via hibernation resume.  [snip]
> > > >
> > > > I have a related question.
> > > >
> > > > When a TPM powers up from hibernation, PCR 10 is reset.  When a
> > > > hibernate image is restored:
> > > >
> > > > 1. Is there a design for how PCR 10 is restored?
> > >
> > > I don't see anything that does that at present.
> > >
> > > > 2. How are /sys/kernel/security/ima/[pseudofiles] saved and
> > > > restored?
> > >
> > > They're part of the running kernel state, so should re-appear without
> > > any special casing. However, in the absence of anything repopulating
> > > PCR 10, they'll no longer match the in-TPM value.
> >
> > This feature could still be supported, if IMA is disabled
> > in the kernel configuration, which I see a non-issue as
> > long as config flag checks are there.
> 
> Right, from what I understand about IMA, the TPM's PCR getting out of
> sync with the in-kernel measurement list across a hibernate (because
> TPM is reset) or kexec() (because in-memory list gets reset) is
> already a problem. This series doesn't really address that, in that it
> doesn't really make that situation better or worse.

For kexec, the PCRs are not reset, so the IMA measurment list needs to
be carried across kexec and restored.  This is now being done on most
architectures.  Afterwards, the IMA measurement list does match the
PCRs.

Hibernation introduces a different situation, where the the PCRs are
reset, but the measurement list is restored, resulting in their not
matching.

-- 
thanks,

Mimi