Carry forward IMA measurement log on kexec on ARM64
Subsystems (6)
v5 cover Carry forward IMA measurement log on kexec on ARM64
n kexec file load Integrgity Measurement Architecture(IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify the measurement through the IMA log and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call. However in the current implementation the IMA measurement logs are not carried over on ARM64 platforms. Therefore a remote attestation service cannot verify the authenticity of the running kernel on ARM64 platforms when the kernel is updated through the kexec system call.
This patch series adds support for carrying forward the IMA measurement log on kexec on ARM64. powerpc already supports carrying forward the IMA measurement log on kexec.
This series refactors the platform independent code such that it can be reused for ARM64 as well. A chosen node namely "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold the address and the size of the memory reserved to carry
the IMA measurement log.
This patch series has been tested for ARM64 platform using QEMU. I would like help from the community for testing this change on powerpc. Thanks.
This series is based on commit b51594df17d0 ("Merge tag 'docs-5.9-3' ofgit://git.lwn.net/linux") in https://github.com/torvalds/linux
"master" branch.
Changelog:
v5:
- Merged get_addr_size_cells() and do_get_kexec_buffer() into a single function when moving the arch independent code from powerpc to IMA
- Reverted the change to use FDT functions in powerpc code and added back the original code in get_addr_size_cells() and do_get_kexec_buffer() for powerpc.
- Added fdt_add_mem_rsv() for ARM64 to reserve the memory for the IMA log buffer during kexec.
- Fixed the warning reported by kernel test bot for ARM64 arch_ima_add_kexec_buffer() - moved this function to a new file namely arch/arm64/kernel/ima_kexec.c
v4:
- Submitting the patch series on behalf of the original author Prakhar Srivastava <[email protected]>
- Moved FDT_PROP_IMA_KEXEC_BUFFER ("linux,ima-kexec-buffer") to libfdt.h so that it can be shared by multiple platforms.
v3:
Breakup patches further into separate patches.
- Refactoring non architecture specific code out of powerpc
- Update powerpc related code to use fdt functions
- Update IMA buffer read related code to use of functions
- Add support to store the memory information of the IMA measurement logs to be carried forward.
- Update the property strings to align with documented nodes
https://github.com/devicetree-org/dt-schema/pull/46
v2:
Break patches into separate patches.
- Powerpc related Refactoring
- Updating the docuemntation for chosen node
- Updating arm64 to support IMA buffer pass
v1:
Refactoring carrying over IMA measuremnet logs over Kexec. This patch
moves the non-architecture specific code out of powerpc and adds to security/ima.(Suggested by Thiago)
Add Documentation regarding the ima-kexec-buffer node in the chosen
node documentation
v0:
Add a layer of abstraction to use the memory reserved by device tree
for ima buffer pass.
Add support for ima buffer pass using reserved memory for arm64 kexec.
Update the arch sepcific code path in kexec file load to store the ima buffer in the reserved memory. The same reserved memory is read on kexec or cold boot.
Lakshmi Ramasubramanian (3):
powerpc: Refactor kexec functions to move arch independent code to IMA
arm64: Store IMA log information in kimage used for kexec
arm64: Add IMA kexec buffer to DTB
arch/arm64/Kconfig | 1 + arch/arm64/include/asm/ima.h | 18 ++++++ arch/arm64/include/asm/kexec.h | 3 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/ima_kexec.c | 34 +++++++++++ arch/arm64/kernel/machine_kexec_file.c | 15 +++++ arch/powerpc/include/asm/ima.h | 3 - arch/powerpc/kexec/ima.c | 60 +------------------ include/linux/libfdt.h | 3 + security/integrity/ima/ima_kexec.c | 82 ++++++++++++++++++++++++++ 10 files changed, 160 insertions(+), 60 deletions(-) create mode 100644 arch/arm64/include/asm/ima.h create mode 100644 arch/arm64/kernel/ima_kexec.c
Signature · 1 line
2.28.0
PATCH v5 1/3 powerpc: Refactor kexec functions to move arch independent code to IMA
The functions ima_get_kexec_buffer() and ima_free_kexec_buffer() that handle carrying forward the IMA measurement logs on kexec for powerpc do not have architecture specific code, but they are currently defined for powerpc only.
Move these functions to IMA subsystem so that it can be used for other architectures as well. A later patch in this series will use these functions for carrying forward the IMA measurement log for ARM64.
Define FDT_PROP_IMA_KEXEC_BUFFER for the chosen node, namely "linux,ima-kexec-buffer", that is added to the DTB to hold the address and the size of the memory reserved to carry the IMA measurement log.
--- arch/powerpc/include/asm/ima.h | 3 -- arch/powerpc/kexec/ima.c | 60 ++-------------------- include/linux/libfdt.h | 3 ++ security/integrity/ima/ima_kexec.c | 82 ++++++++++++++++++++++++++++++ 4 files changed, 88 insertions(+), 60 deletions(-)
arch/powerpc/include/asm/ima.h +0 -3
@@ -4,9 +4,6 @@struct kimage ; -int ima_get_kexec_buffer (void **addr,size_t *size); -int ima_free_kexec_buffer (void ); -#ifdef CONFIG_IMA void remove_ima_buffer (void *fdt,int chosen_node);#else
arch/powerpc/kexec/ima.c +3 -57
82 lines not on this page · raw message
include/linux/libfdt.h +3 -0
@@ -5,4 +5,7 @@#include <linux/libfdt_env.h> #include "../../scripts/dtc/libfdt/libfdt.h" +/* Common device tree properties */ +#define FDT_PROP_IMA_KEXEC_BUFFER "linux,ima-kexec-buffer" +#endif /* _INCLUDE_LIBFDT_H_ */
security/integrity/ima/ima_kexec.c +82 -0
90 lines not on this page · raw message
Signature · 1 line
2.28.0
Re: [PATCH v5 1/3] powerpc: Refactor kexec functions to move arch independent code to IMA
Quoted 9 lines · Lakshmi Ramasubramanian
The functions
ima_get_kexec_buffer()andima_free_kexec_buffer()that handle carrying forward the IMA measurement logs on kexec for powerpc do not have architecture specific code, but they are currently defined for powerpc only.Move these functions to IMA subsystem so that it can be used for other architectures as well. A later patch in this series will use these functions for carrying forward the IMA measurement log for ARM64.
Quoted 8 lines
Define
FDT_PROP_IMA_KEXEC_BUFFERfor the chosen node, namely "linux,ima-kexec-buffer", that is added to the DTB to hold the address and the size of the memory reserved to carry the IMA measurement log.Co-developed-by Prakhar Srivastava <[email protected]>Signed-off-by Prakhar Srivastava <[email protected]>Signed-off-by Lakshmi Ramasubramanian <[email protected]>
do_get_kexec_buffer() is still duplicated in generic code and powerpc code. It's a small and simple function though, so not really a problem.
I think you'll need to move over remove_ima_buffer() if you agree with the comment I'll make on patch 3, in which case the powerpc-specific do_get_kexec_buffer() can be removed.
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center
PATCH v5 2/3 arm64: Store IMA log information in kimage used for kexec
In reply to Lakshmi RamasubramanianAddress and size of the buffer containing the IMA measurement log need to be passed from the current kernel to the next kernel on kexec.
Add address and size fields to "struct kimage_arch" for ARM64 platform to hold the address and size of the IMA measurement log buffer. Define an architecture specific function for ARM64 namely arch_ima_add_kexec_buffer() that will set the address and size of the current kernel's IMA buffer to be passed to the next kernel on kexec.
--- arch/arm64/include/asm/ima.h | 18 ++++++++++++++++++ arch/arm64/include/asm/kexec.h | 3 +++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/ima_kexec.c | 34 ++++++++++++++++++++++++++++++++++ 4 files changed, 56 insertions(+) create mode 100644 arch/arm64/include/asm/ima.h create mode 100644 arch/arm64/kernel/ima_kexec.c
arch/arm64/include/asm/ima.h new file +18 -0
@@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* +* Copyright (C) 2019 Microsoft Corporation +* +* Author: Prakhar Srivastava <[email protected]> +* +*/ +#ifndef _ASM_ARCH_IMA_H +#define _ASM_ARCH_IMA_H + +struct kimage ; + +#ifdef CONFIG_IMA_KEXEC +int arch_ima_add_kexec_buffer (struct kimage *image,unsigned long load_addr, +size_t size); +#endif /* CONFIG_IMA_KEXEC */ + +#endif /* _ASM_ARCH_IMA_H */
arch/arm64/include/asm/kexec.h +3 -0
@@ -100,6 +100,9 @@ struct kimage_arch {void *elf_headers;unsigned long elf_headers_mem;unsigned long elf_headers_sz; + +phys_addr_t ima_buffer_addr; +size_t ima_buffer_size; };extern const struct kexec_file_ops kexec_image_ops;
arch/arm64/kernel/Makefile +1 -0
@@ -62,6 +62,7 @@ obj-$(CONFIG_ARM_SDE_INTERFACE) += sdei.o obj-$(CONFIG_ARM64_SSBD) += ssbd.o obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o +obj-$(CONFIG_IMA_KEXEC) += ima_kexec.o obj-y += vdso/ probes/ obj-$(CONFIG_COMPAT_VDSO) += vdso32/
arch/arm64/kernel/ima_kexec.c new file +34 -0
@@ -0,0 +1,34 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* +* Copyright (C) 2019 Microsoft Corporation +* +* Author: Prakhar Srivastava <[email protected]> +* +* File: ima_kexec.c +* Defines IMA kexec functions. +*/ + +#include <linux/kernel.h> +#include <linux/kexec.h> +#include <linux/types.h> +#include <asm/ima.h> + +/** +* arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer +* +* @image: kimage structure to set ima buffer information in for kexec +* @load_addr: Start address of the IMA buffer +* @size: size of the IMA buffer +* +* Architectures should use this function to pass on the IMA buffer +* information to the next kernel. +* +* Return: 0 on success, negative errno on error. +*/ +int arch_ima_add_kexec_buffer (struct kimage *image,unsigned long load_addr, +size_t size) +{ + image->arch.ima_buffer_addr = load_addr; + image->arch.ima_buffer_size = size; +return 0 ; +}
Signature · 1 line
2.28.0
Re: [PATCH v5 2/3] arm64: Store IMA log information in kimage used for kexec
Quoted 9 lines · Lakshmi Ramasubramanian
Address and size of the buffer containing the IMA measurement log need to be passed from the current kernel to the next kernel on kexec.
Add address and size fields to "struct
kimage_arch" for ARM64 platform to hold the address and size of the IMA measurement log buffer. Define an architecture specific function for ARM64 namelyarch_ima_add_kexec_buffer()that will set the address and size of the current kernel's IMA buffer to be passed to the next kernel on kexec.
Quoted 4 lines
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center
PATCH v5 3/3 arm64: Add IMA kexec buffer to DTB
In reply to Lakshmi RamasubramanianThe address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node for the log to be carried over to the next kernel on the kexec call.
Add the IMA measurement log buffer properties to the device tree for ARM64 and reserve the memory for storing the IMA log. Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate that the IMA measurement log information is present in the device tree.
--- arch/arm64/Kconfig | 1 + arch/arm64/kernel/machine_kexec_file.c | 15 +++++++++++++++ 2 files changed, 16 insertions(+)
arch/arm64/Kconfig +1 -0
@@ -1077,6 +1077,7 @@ config KEXEC config KEXEC_FILE bool "kexec file based system call" select KEXEC_CORE + select HAVE_IMA_KEXEC help This is new version of kexec system call. This system call is file based and takes file descriptors as system call argument
arch/arm64/kernel/machine_kexec_file.c +15 -0
@@ -136,6 +136,21 @@ static int setup_dtb(struct kimage *image, FDT_PROP_KASLR_SEED); } +/* add ima-kexec-buffer */ +if (image->arch.ima_buffer_size >0 ) { + ret =fdt_appendprop_addrrange (dtb,0 , off, +FDT_PROP_IMA_KEXEC_BUFFER , + image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); +if (ret) +return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL ); + + ret =fdt_add_mem_rsv (dtb, image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); +if (ret) + goto out; + } +/* add rng-seed */ if (rng_is_initialized ()) {void *rng_seed;
Signature · 1 line
2.28.0
Re: [PATCH v5 3/3] arm64: Add IMA kexec buffer to DTB
Quoted 46 lines · Lakshmi Ramasubramanian
The address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node for the log to be carried over to the next kernel on the kexec call.
Add the IMA measurement log buffer properties to the device tree for ARM64 and reserve the memory for storing the IMA log. Update
CONFIG_KEXEC_FILEto selectCONFIG_HAVE_IMA_KEXECto indicate that the IMA measurement log information is present in the device tree.Co-developed-by Prakhar Srivastava <[email protected]>Signed-off-by Prakhar Srivastava <[email protected]>Signed-off-by Lakshmi Ramasubramanian <[email protected]>--- arch/arm64/Kconfig | 1 + arch/arm64/kernel/machine_kexec_file.c | 15 +++++++++++++++ 2 files changed, 16 insertions(+)arch/arm64/Kconfig +1
-0@@ -1077,6 +1077,7 @@ config KEXEC config KEXEC_FILE bool "kexec file based system call" select KEXEC_CORE + select HAVE_IMA_KEXEC help This is new version of kexec system call. This system call is file based and takes file descriptors as system call argumentarch/arm64/kernel/machine_kexec_file.c +8
-0@@ -136,6 +136,21 @@ static int setup_dtb(struct kimage *image, FDT_PROP_KASLR_SEED); } +/* add ima-kexec-buffer */ +if (image->arch.ima_buffer_size >0 ) { + ret =fdt_appendprop_addrrange (dtb,0 , off, +FDT_PROP_IMA_KEXEC_BUFFER , + image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); +if (ret) +return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL );
arch/arm64/kernel/machine_kexec_file.c static int setup_dtb(struct kimage *image, · line 156
Quoted 10 lines
arch/arm64/kernel/machine_kexec_file.c +7
-0+ + ret =fdt_add_mem_rsv (dtb, image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); +if (ret) + goto out; + } +/* add rng-seed */ if (rng_is_initialized ()) {void *rng_seed;
I just noticed one more thing this code isn't doing compared to the powerpc version (sorry to bring these issues piecemeal, I didn't realize this before):
You're not checking whether there already is a device tree property and corresponding memory reservation for an IMA kexec buffer that the currently running kernel might have received from a previous kernel. In that case, this code will do the wrong thing because fdt_appendprop_addrrange() will append the range to the existing property, which is not what you want. You'll also have a memory reservation entry for a stale IMA kexec buffer, which just wastes memory.
So one thing you need to do, whether or not there's an IMA kexec buffer to be passed to the next kernel, is to remove any existing FDT_PROP_IMA_KEXEC_BUFFER property and also its corresponding memory reservation, so that you avoid accumulating stale memory reservations for non-existing IMA kexec buffers from previous kexecs.
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center
Re: [PATCH v5 3/3] arm64: Add IMA kexec buffer to DTB
Quoted 73 lines · Thiago Jung Bauermann
Quoted 46 lines · Lakshmi Ramasubramanian
The address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node for the log to be carried over to the next kernel on the kexec call.
Add the IMA measurement log buffer properties to the device tree for ARM64 and reserve the memory for storing the IMA log. Update
CONFIG_KEXEC_FILEto selectCONFIG_HAVE_IMA_KEXECto indicate that the IMA measurement log information is present in the device tree.Co-developed-by Prakhar Srivastava <[email protected]>Signed-off-by Prakhar Srivastava <[email protected]>Signed-off-by Lakshmi Ramasubramanian <[email protected]>--- arch/arm64/Kconfig | 1 + arch/arm64/kernel/machine_kexec_file.c | 15 +++++++++++++++ 2 files changed, 16 insertions(+)arch/arm64/Kconfig +1
-0@@ -1077,6 +1077,7 @@ config KEXEC config KEXEC_FILE bool "kexec file based system call" select KEXEC_CORE + select HAVE_IMA_KEXEC help This is new version of kexec system call. This system call is file based and takes file descriptors as system call argumentarch/arm64/kernel/machine_kexec_file.c +8
-0@@ -136,6 +136,21 @@ static int setup_dtb(struct kimage *image, FDT_PROP_KASLR_SEED); } +/* add ima-kexec-buffer */ +if (image->arch.ima_buffer_size >0 ) { + ret =fdt_appendprop_addrrange (dtb,0 , off, +FDT_PROP_IMA_KEXEC_BUFFER , + image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); +if (ret) +return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL );arch/arm64/kernel/machine_kexec_file.c static int setup_dtb(struct kimage *image, · line 156
Quoted 10 lines
arch/arm64/kernel/machine_kexec_file.c +7
-0+ + ret =fdt_add_mem_rsv (dtb, image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); +if (ret) + goto out; + } +/* add rng-seed */ if (rng_is_initialized ()) {void *rng_seed;I just noticed one more thing this code isn't doing compared to the powerpc version (sorry to bring these issues piecemeal, I didn't realize this before):
You're not checking whether there already is a device tree property and corresponding memory reservation for an IMA kexec buffer that the currently running kernel might have received from a previous kernel. In that case, this code will do the wrong thing because
fdt_appendprop_addrrange()will append the range to the existing property, which is not what you want. You'll also have a memory reservation entry for a stale IMA kexec buffer, which just wastes memory.
Quoted 6 lines
So one thing you need to do, whether or not there's an IMA kexec buffer to be passed to the next kernel, is to remove any existing
FDT_PROP_IMA_KEXEC_BUFFERproperty and also its corresponding memory reservation, so that you avoid accumulating stale memory reservations for non-existing IMA kexec buffers from previous kexecs.
That's good catch Thiago. Thanks for the feedback. I'll make this change and update.
thanks,
-lakshmi