Linux-Security-Module Archive on lore.kernel.org
 help / color / Atom feed
From: Dave Young <dyoung@redhat.com>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: Prakhar Srivastava <prsriva02@gmail.com>,
	linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, roberto.sassu@huawei.com,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	vgoyal@redhat.com, kexec <kexec@lists.infradead.org>
Subject: Re: [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args
Date: Thu, 13 Jun 2019 16:26:27 +0800
Message-ID: <20190613082627.GA30288@dhcp-128-65.nay.redhat.com> (raw)
In-Reply-To: <1560378703.4578.91.camel@linux.ibm.com>

On 06/12/19 at 06:31pm, Mimi Zohar wrote:
> [Cc: kexec mailing list]
> 
> Hi Eric, Dave,
> 
> On Wed, 2019-06-12 at 15:15 -0700, Prakhar Srivastava wrote:
> > During soft reboot(kexec_file_load) boot cmdline args
> > are not measured.Thus the new kernel on load boots with
> > an assumption of cold reboot.
> > 
> > This patch makes a call to the ima hook ima_kexec_cmdline,
> > added in "Define a new IMA hook to measure the boot command
> > line arguments"
> > to measure the boot cmdline args into the ima log.
> > 
> > - call ima_kexec_cmdline from kexec_file_load.
> > - move the call ima_add_kexec_buffer after the cmdline
> > args have been measured.
> > 
> > Signed-off-by: Prakhar Srivastava <prsriva02@gmail.com>
> Cc: Eric W. Biederman <ebiederm@xmission.com>
> Cc: Dave Young <dyoung@redhat.com>
> 
> Any chance we could get some Acks?

The ima_* is blackbox functions to me, looks like this patch is trying
to measure kexec cmdline buffer and save in some ima logs and then add all the
measure results including those for kernel/initrd to a kexec_buf and pass to 2nd
kernel.

It should be good and only take effect when IMA enabled. If all the
assumptions are right:

Acked-by: Dave Young <dyoung@redhat.com>
> 
> thanks,
> 
> Mimi
> 
> > ---
> >  kernel/kexec_file.c | 9 ++++++---
> >  1 file changed, 6 insertions(+), 3 deletions(-)
> > 
> > diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> > index 072b6ee55e3f..b0c724e5d86c 100644
> > --- a/kernel/kexec_file.c
> > +++ b/kernel/kexec_file.c
> > @@ -198,9 +198,6 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd,
> >  		return ret;
> >  	image->kernel_buf_len = size;
> >  
> > -	/* IMA needs to pass the measurement list to the next kernel. */
> > -	ima_add_kexec_buffer(image);
> > -
> >  	/* Call arch image probe handlers */
> >  	ret = arch_kexec_kernel_image_probe(image, image->kernel_buf,
> >  					    image->kernel_buf_len);
> > @@ -241,8 +238,14 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd,
> >  			ret = -EINVAL;
> >  			goto out;
> >  		}
> > +
> > +		ima_kexec_cmdline(image->cmdline_buf,
> > +				  image->cmdline_buf_len - 1);
> >  	}
> >  
> > +	/* IMA needs to pass the measurement list to the next kernel. */
> > +	ima_add_kexec_buffer(image);
> > +
> >  	/* Call arch image load handlers */
> >  	ldata = arch_kexec_kernel_image_load(image);
> >  
> 
> 
> _______________________________________________
> kexec mailing list
> kexec@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/kexec

Thanks
Dave

  reply index

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-06-12 22:15 [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Prakhar Srivastava
2019-06-12 22:15 ` [PATCH V8 1/3] Define a new IMA hook to measure the boot command line arguments Prakhar Srivastava
2019-06-13 19:10   ` James Morris
2019-06-13 19:22   ` Mimi Zohar
2019-06-14 17:48     ` prakhar srivastava
2019-06-12 22:15 ` [PATCH V8 2/3] Define a new ima template field buf Prakhar Srivastava
2019-06-13 19:15   ` James Morris
2019-06-13 19:59   ` Mimi Zohar
2019-06-14 10:57     ` Mimi Zohar
2019-06-14 14:14       ` Mimi Zohar
2019-06-14 17:52         ` prakhar srivastava
2019-06-12 22:15 ` [PATCH V8 3/3] Call ima_kexec_cmdline to measure the cmdline args Prakhar Srivastava
2019-06-12 22:31   ` Mimi Zohar
2019-06-13  8:26     ` Dave Young [this message]
2019-06-13 20:07       ` Mimi Zohar
2019-06-13 19:16   ` James Morris
2019-06-13 20:20   ` Mimi Zohar
2019-06-13 20:48 ` [PATCH V8 0/3] Add support for measuring the boot command line during kexec_file_load Mimi Zohar
2019-06-14 17:39   ` prakhar srivastava

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190613082627.GA30288@dhcp-128-65.nay.redhat.com \
    --to=dyoung@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=kexec@lists.infradead.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=prsriva02@gmail.com \
    --cc=roberto.sassu@huawei.com \
    --cc=vgoyal@redhat.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org linux-security-module@archiver.kernel.org
	public-inbox-index linux-security-module

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/ public-inbox