ima: kexec: measure events between kexec load and execute

Carrying the IMA measurement list across kexec requires allocating a buffer and copying the measurement records. Separate allocating the buffer and copying the measurement records into separate functions in order to allocate the buffer at kexec 'load' and copy the measurements at kexec 'execute'.

This patch includes the following changes:
- Refactor ima_dump_measurement_list() to move the memory allocation to a separate function ima_alloc_kexec_file_buf() which allocates buffer of size 'kexec_segment_size' at kexec 'load'.
- Make the local variable ima_kexec_file in ima_dump_measurement_list() as local static to the file, so that it can be accessed from

    ima_alloc_kexec_file_buf().

- Make necessary changes to the function ima_add_kexec_buffer() to call the above two functions.

Suggested-by Stefan Berger <[email protected]>

Signed-off-by Tushar Sugandhi <[email protected]>

---
  security/integrity/ima/ima_kexec.c | 107 +++++++++++++++++++++--------
  1 file changed, 78 insertions(+), 29 deletions(-)

security/integrity/ima/ima_kexec.c +43 -1

index dadc1d138118..a9cb5e882e2e 100644
@@ -15,62 +15,98 @@
  #include "ima.h"
 
  #ifdef CONFIG_IMA_KEXEC
+static struct seq_file ima_kexec_file;
+
+static void ima_reset_kexec_file(struct seq_file *sf)
+{
+	sf->buf = NULL;
+	sf->size = 0;
+	sf->read_pos = 0;
+	sf->count = 0;
+}
+
+static void ima_free_kexec_file_buf(struct seq_file *sf)
+{
+	vfree(sf->buf);
+	ima_reset_kexec_file(sf);
+}
+
+static int ima_alloc_kexec_file_buf(size_t segment_size)
+{
+	/*
+	 * kexec 'load' may be called multiple times.
+	 * Free and realloc the buffer only if the segment_size is
+	 * changed from the previous kexec 'load' call.
+	 */
+	if (ima_kexec_file.buf &&
+	    ima_kexec_file.size == segment_size &&
+	    ima_kexec_file.read_pos == 0 &&
+	    ima_kexec_file.count == sizeof(struct ima_kexec_hdr))
+		return 0;
+
+	ima_free_kexec_file_buf(&ima_kexec_file);
+
+	/* segment size can't change between kexec load and execute */
+	ima_kexec_file.buf = vmalloc(segment_size);
+	if (!ima_kexec_file.buf)
+		return -ENOMEM;
+
+	ima_kexec_file.size = segment_size;
+	ima_kexec_file.read_pos = 0;
+	ima_kexec_file.count = sizeof(struct ima_kexec_hdr);	/* reserved space */
+
+	return 0;
+}
+
  static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
  				     unsigned long segment_size)
  {
  	struct ima_queue_entry *qe;
-	struct seq_file file;
  	struct ima_kexec_hdr khdr;

security/integrity/ima/ima_kexec.c +26 -22

+		pr_err("%s: Kexec file buf not allocated\n", __func__);
+		return -EINVAL;
  	}
 
-	file.size = segment_size;
-	file.read_pos = 0;
-	file.count = sizeof(khdr);	/* reserved space */
-
  	memset(&khdr, 0, sizeof(khdr));
  	khdr.version = 1;
+
+	/* Copy as many IMA measurements list records as possible */
  	list_for_each_entry_rcu(qe, &ima_measurements, later) {
-		if (file.count < file.size) {
+		if (ima_kexec_file.count < ima_kexec_file.size) {
  			khdr.count++;
-			ima_measurements_show(&file, qe);
+			ima_measurements_show(&ima_kexec_file, qe);
  		} else {
-			ret = -EINVAL;
+			pr_err("%s: IMA log file is too big for Kexec buf\n",
+			       __func__);
  			break;
  		}
  	}
 
-	if (ret < 0)
-		goto out;
-
  	/*
  	 * fill in reserved space with some buffer details
  	 * (eg. version, buffer size, number of measurements)
  	 */
-	khdr.buffer_size = file.count;
+	khdr.buffer_size = ima_kexec_file.count;
  	if (ima_canonical_fmt) {
  		khdr.version = cpu_to_le16(khdr.version);
  		khdr.count = cpu_to_le64(khdr.count);
  		khdr.buffer_size = cpu_to_le64(khdr.buffer_size);
  	}
-	memcpy(file.buf, &khdr, sizeof(khdr));
+	memcpy(ima_kexec_file.buf, &khdr, sizeof(khdr));
 
  	print_hex_dump_debug("ima dump: ", DUMP_PREFIX_NONE, 16, 1,
-			     file.buf, file.count < 100 ? file.count : 100,
+			     ima_kexec_file.buf, ima_kexec_file.count < 100 ?
+			     ima_kexec_file.count : 100,
  			     true);
 
-	*buffer_size = file.count;
-	*buffer = file.buf;
-out:
-	if (ret == -EINVAL)
-		vfree(file.buf);
-	return ret;
+	*buffer_size = ima_kexec_file.count;
+	*buffer = ima_kexec_file.buf;
+
+	return 0;
  }
 
  /*

@@ -108,13 +144,20 @@ void ima_add_kexec_buffer(struct kimage *image)
  		return;
  	}
 
-	ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
-				  kexec_segment_size);
-	if (!kexec_buffer) {
+	ret = ima_alloc_kexec_file_buf(kexec_segment_size);
+	if (ret < 0) {
  		pr_err("Not enough memory for the kexec measurement buffer.\n");
  		return;
  	}
 
+	ret = ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
+					kexec_segment_size);
+	if (ret < 0) {
+		pr_err("%s: Failed to dump IMA measurements. Error:%d.\n",
+		       __func__, ret);
+		return;
+	}
+
  	kbuf.buffer = kexec_buffer;
  	kbuf.bufsz = kexec_buffer_size;
  	kbuf.memsz = kexec_segment_size;

Carrying the IMA measurement list across kexec requires allocating a buffer and copying the measurement records. Separate allocating the buffer and copying the measurement records into separate functions in order to allocate the buffer at kexec 'load' and copy the measurements at kexec 'execute'.

This patch includes the following changes:
- Refactor ima_dump_measurement_list() to move the memory allocation to a separate function ima_alloc_kexec_file_buf() which allocates buffer of size 'kexec_segment_size' at kexec 'load'.
- Make the local variable ima_kexec_file in ima_dump_measurement_list() as local static to the file, so that it can be accessed from ima_alloc_kexec_file_buf().
- Make necessary changes to the function ima_add_kexec_buffer() to call the above two functions.

Suggested-by Stefan Berger <[email protected]>

Signed-off-by Tushar Sugandhi <[email protected]>

---
 security/integrity/ima/ima_kexec.c | 107 +++++++++++++++++++++--------
 1 file changed, 78 insertions(+), 29 deletions(-)

security/integrity/ima/ima_kexec.c +18 -0

index dadc1d138118..a9cb5e882e2e 100644
@@ -15,62 +15,98 @@
 #include "ima.h"
 
 #ifdef CONFIG_IMA_KEXEC
+static struct seq_file ima_kexec_file;
+
+static void ima_reset_kexec_file(struct seq_file *sf)
+{
+	sf->buf = NULL;
+	sf->size = 0;
+	sf->read_pos = 0;
+	sf->count = 0;
+}
+
+static void ima_free_kexec_file_buf(struct seq_file *sf)
+{
+	vfree(sf->buf);
+	ima_reset_kexec_file(sf);
+}
+
+static int ima_alloc_kexec_file_buf(size_t segment_size)
+{

security/integrity/ima/ima_kexec.c +1 -0

+	ima_kexec_file.count = sizeof(struct ima_kexec_hdr);	/* reserved

space */

security/integrity/ima/ima_kexec.c +4 -0

+
+	return 0;
+}
+
 static int ima_dump_measurement_list(unsigned long *buffer_size, void

**buffer,

security/integrity/ima/ima_kexec.c +5 -8

 				     unsigned long segment_size)
 {
 	struct ima_queue_entry *qe;
-	struct seq_file file;
 	struct ima_kexec_hdr khdr;
-	int ret = 0;
 
-	/* segment size can't change between kexec load and execute */
-	file.buf = vmalloc(segment_size);
-	if (!file.buf) {
-		ret = -ENOMEM;
-		goto out;
+	if (!ima_kexec_file.buf) {
+		*buffer_size = 0;
+		*buffer = NULL;
+		pr_err("%s: Kexec file buf not allocated\n", __func__);
+		return -EINVAL;
 	}
 
-	file.size = segment_size;

security/integrity/ima/ima_kexec.c +9 -12

 	/*
 	 * fill in reserved space with some buffer details
 	 * (eg. version, buffer size, number of measurements)
 	 */
-	khdr.buffer_size = file.count;
+	khdr.buffer_size = ima_kexec_file.count;
 	if (ima_canonical_fmt) {
 		khdr.version = cpu_to_le16(khdr.version);
 		khdr.count = cpu_to_le64(khdr.count);
 		khdr.buffer_size = cpu_to_le64(khdr.buffer_size);
 	}
-	memcpy(file.buf, &khdr, sizeof(khdr));
+	memcpy(ima_kexec_file.buf, &khdr, sizeof(khdr));
 
 	print_hex_dump_debug("ima dump: ", DUMP_PREFIX_NONE, 16, 1,
-			     file.buf, file.count < 100 ? file.count : 100,
+			     ima_kexec_file.buf, ima_kexec_file.count < 100 ?
+			     ima_kexec_file.count : 100,
 			     true);
 
-	*buffer_size = file.count;
-	*buffer = file.buf;
-out:
-	if (ret == -EINVAL)
-		vfree(file.buf);
-	return ret;
+	*buffer_size = ima_kexec_file.count;
+	*buffer = ima_kexec_file.buf;
+
+	return 0;
 }
 
 /*

@@ -108,13 +144,20 @@ void ima_add_kexec_buffer(struct kimage *image)
 		return;
 	}
 
-	ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
-				  kexec_segment_size);
-	if (!kexec_buffer) {
+	ret = ima_alloc_kexec_file_buf(kexec_segment_size);

security/integrity/ima/ima_kexec.c +9 -0

+		return;
+	}
+
 	kbuf.buffer = kexec_buffer;
 	kbuf.bufsz = kexec_buffer_size;
 	kbuf.memsz = kexec_segment_size;

@@ -129,6 +172,12 @@ void ima_add_kexec_buffer(struct kimage *image)
 	image->ima_buffer_size = kexec_segment_size;
 	image->ima_buffer = kexec_buffer;
 
+	/*
+	 * kexec owns kexec_buffer after kexec_add_buffer() is called
+	 * and it will vfree() that buffer.
+	 */
+	ima_reset_kexec_file(&ima_kexec_file);
+
 	kexec_dprintk("kexec measurement buffer for the loaded kernel at
 0x%lx.\n",
 		      kbuf.mem);

}

Currently, the mechanism to map and unmap segments to the kimage structure is not available to the subsystems outside of kexec. This functionality is needed when IMA is allocating the memory segments during kexec 'load' operation. Implement functions to map and unmap segments to kimage.

Implement kimage_map_segment() to enable mapping of IMA buffer source pages to the kimage structure post kexec 'load'. This function, accepting a kimage pointer, an address, and a size, will gather the source pages within the specified address range, create an array of page pointers, and map these to a contiguous virtual address range. The function returns the start of this range if successful, or NULL if unsuccessful.

Implement kimage_unmap_segment() for unmapping segments using vunmap(). Relocate 'for_each_kimage_entry()' macro from kexec_core.c to kexec.h for broader accessibility.

Signed-off-by Tushar Sugandhi <[email protected]>

---
  include/linux/kexec.h | 13 ++++++++++
  kernel/kexec_core.c   | 59 +++++++++++++++++++++++++++++++++++++++----
  2 files changed, 67 insertions(+), 5 deletions(-)

include/linux/kexec.h +13 -0

index 400cb6c02176..3145447eb77a 100644
@@ -486,6 +486,11 @@ static inline void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages) {
  static inline void arch_crash_handle_hotplug_event(struct kimage *image) { }
  #endif
 
+#define for_each_kimage_entry(image, ptr, entry) \
+	for (ptr = &image->head; (entry = *ptr) && !(entry & IND_DONE); \
+		ptr = (entry & IND_INDIRECTION) ? \
+			boot_phys_to_virt((entry & PAGE_MASK)) : ptr + 1)
+
  int crash_check_update_elfcorehdr(void);
 
  #ifndef crash_hotplug_cpu_support

@@ -507,6 +512,10 @@ extern bool kexec_file_dbg_print;
  	       kexec_file_dbg_print ? KERN_INFO : KERN_DEBUG,	\
  	       ##__VA_ARGS__)
 
+extern void *kimage_map_segment(struct kimage *image,
+				unsigned long addr, unsigned long size);
+extern void kimage_unmap_segment(void *buffer);
+
  #else /* !CONFIG_KEXEC_CORE */
  struct pt_regs;
  struct task_struct;

@@ -514,6 +523,10 @@ static inline void __crash_kexec(struct pt_regs *regs) { }
  static inline void crash_kexec(struct pt_regs *regs) { }
  static inline int kexec_should_crash(struct task_struct *p) { return 0; }
  static inline int kexec_crash_loaded(void) { return 0; }
+static inline void *kimage_map_segment(struct kimage *image,
+				       unsigned long addr, unsigned long size)
+{ return NULL; }
+static inline void kimage_unmap_segment(void *buffer) { }
  #define kexec_in_progress false
  #endif /* CONFIG_KEXEC_CORE */
 

kernel/kexec_core.c +47 -5

index d08fc7b5db97..612ad8783bab 100644
@@ -582,11 +582,6 @@ void kimage_terminate(struct kimage *image)
  	*image->entry = IND_DONE;
  }
 
-#define for_each_kimage_entry(image, ptr, entry) \
-	for (ptr = &image->head; (entry = *ptr) && !(entry & IND_DONE); \
-		ptr = (entry & IND_INDIRECTION) ? \
-			boot_phys_to_virt((entry & PAGE_MASK)) : ptr + 1)
-
  static void kimage_free_entry(kimage_entry_t entry)
  {
  	struct page *page;

@@ -909,6 +904,60 @@ int kimage_load_segment(struct kimage *image,
  	return result;
  }
 
+void *kimage_map_segment(struct kimage *image,
+			 unsigned long addr, unsigned long size)
+{
+	unsigned long eaddr = addr + size;
+	unsigned long src_page_addr, dest_page_addr;
+	unsigned int npages;
+	struct page **src_pages;
+	int i;
+	kimage_entry_t *ptr, entry;
+	void *vaddr = NULL;
+
+	/*
+	 * Collect the source pages and map them in a contiguous VA range.
+	 */
+	npages = PFN_UP(eaddr) - PFN_DOWN(addr);
+	src_pages = kmalloc_array(npages, sizeof(*src_pages), GFP_KERNEL);
+	if (!src_pages) {
+		pr_err("%s: Could not allocate ima pages array.\n", __func__);
+		return NULL;
+	}
+
+	i = 0;
+	for_each_kimage_entry(image, ptr, entry) {
+		if (entry & IND_DESTINATION)
+			dest_page_addr = entry & PAGE_MASK;
+		else if (entry & IND_SOURCE) {
+			if (dest_page_addr >= addr && dest_page_addr < eaddr) {
+				src_page_addr = entry & PAGE_MASK;
+				src_pages[i++] =
+					virt_to_page(__va(src_page_addr));
+				if (i == npages)
+					break;
+				dest_page_addr += PAGE_SIZE;
+			}
+		}
+	}
+
+	/* Sanity check. */
+	WARN_ON(i < npages);
+
+	vaddr = vmap(src_pages, npages, VM_MAP, PAGE_KERNEL);
+	kfree(src_pages);
+
+	if (!vaddr)
+		pr_err("%s: Could not map ima buffer.\n", __func__);
+
+	return vaddr;

Reviewed-by Stefan Berger <[email protected]>

Currently, the mechanism to map and unmap segments to the kimage structure is not available to the subsystems outside of kexec. This functionality is needed when IMA is allocating the memory segments during kexec 'load' operation. Implement functions to map and unmap segments to kimage.

Implement kimage_map_segment() to enable mapping of IMA buffer source pages to the kimage structure post kexec 'load'. This function, accepting a kimage pointer, an address, and a size, will gather the source pages within the specified address range, create an array of page pointers, and map these to a contiguous virtual address range. The function returns the start of this range if successful, or NULL if unsuccessful.

Implement kimage_unmap_segment() for unmapping segments using vunmap(). Relocate 'for_each_kimage_entry()' macro from kexec_core.c to kexec.h for broader accessibility.

Signed-off-by Tushar Sugandhi <[email protected]>

---
 include/linux/kexec.h | 13 ++++++++++
 kernel/kexec_core.c   | 59 +++++++++++++++++++++++++++++++++++++++----
 2 files changed, 67 insertions(+), 5 deletions(-)

include/linux/kexec.h +0 -0

index 400cb6c02176..3145447eb77a 100644

IMA log is copied to the new Kernel during kexec 'load' using ima_dump_measurement_list(). The log copy at kexec 'load' may result in loss of IMA measurements during kexec soft reboot. It needs to be copied over during kexec 'execute'. Setup the needed infrastructure to move the IMA log copy from kexec 'load' to 'execute'.

Define a new IMA hook ima_update_kexec_buffer() as a stub function. It will be used to call ima_dump_measurement_list() during kexec 'execute'.

Implement kimage_file_post_load() and ima_kexec_post_load() functions to be invoked after the new Kernel image has been loaded for kexec. ima_kexec_post_load() maps the IMA buffer to a segment in the newly loaded Kernel. It also registers the reboot notifier_block to trigger ima_update_kexec_buffer() at exec 'execute'.

Signed-off-by Tushar Sugandhi <[email protected]>

---
  include/linux/ima.h                |  3 ++
  kernel/kexec_file.c                |  5 ++++
  security/integrity/ima/ima_kexec.c | 46 ++++++++++++++++++++++++++++++
  3 files changed, 54 insertions(+)

include/linux/ima.h +3 -0

index 86b57757c7b1..006db20f852d 100644
@@ -49,6 +49,9 @@ static inline void ima_appraise_parse_cmdline(void) {}
 
  #ifdef CONFIG_IMA_KEXEC
  extern void ima_add_kexec_buffer(struct kimage *image);
+extern void ima_kexec_post_load(struct kimage *image);
+#else
+static inline void ima_kexec_post_load(struct kimage *image) {}
  #endif
 
  #else

kernel/kexec_file.c +0 -0

index 0e3689bfb0bb..fe59cb7c179d 100644

kernel/kexec_file.c +0 -0

  /*
   * In file mode list of segments is prepared by kernel. Copy relevant
   * data from user space, do error checking, prepare segment list

security/integrity/ima/ima_kexec.c +39 -0

index ccb072617c2d..1d4d6c122d82 100644
@@ -12,10 +12,14 @@
  #include <linux/kexec.h>
  #include <linux/of.h>
  #include <linux/ima.h>
+#include <linux/reboot.h>
+#include <asm/page.h>
  #include "ima.h"
 
  #ifdef CONFIG_IMA_KEXEC
  static struct seq_file ima_kexec_file;
+static void *ima_kexec_buffer;
+static bool ima_kexec_update_registered;
 
  static void ima_reset_kexec_file(struct seq_file *sf)
  {

@@ -184,6 +188,48 @@ void ima_add_kexec_buffer(struct kimage *image)
  	kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
  		      kbuf.mem);
  }
+
+/*
+ * Called during kexec execute so that IMA can update the measurement list.
+ */
+static int ima_update_kexec_buffer(struct notifier_block *self,
+				   unsigned long action, void *data)
+{
+	return NOTIFY_OK;
+}
+
+struct notifier_block update_buffer_nb = {
+	.notifier_call = ima_update_kexec_buffer,
+};
+
+/*
+ * Create a mapping for the source pages that contain the IMA buffer
+ * so we can update it later.
+ */
+void ima_kexec_post_load(struct kimage *image)
+{
+	if (ima_kexec_buffer) {
+		kimage_unmap_segment(ima_kexec_buffer);
+		ima_kexec_buffer = NULL;
+	}
+
+	if (!image->ima_buffer_addr)
+		return;
+
+	ima_kexec_buffer = kimage_map_segment(image,
+					      image->ima_buffer_addr,
+					      image->ima_buffer_size);
+	if (!ima_kexec_buffer) {
+		pr_err("%s: Could not map measurements buffer.\n", __func__);
+		return;
+	}

On 2/14/24 10:38, Tushar Sugandhi wrote:

kernel/kexec_file.c kimage_validate_signature(struct kimage *image) · line 193

Quoted 5 lines

kernel/kexec_file.c +5 -0

+void kimage_file_post_load(struct kimage *image)
+{
+    ima_kexec_post_load(image);
+}
+

We get this here at this point but it disappears later -- missing header?

kernel/kexec_file.c:189:6: warning: no previous prototype for ‘kimage_file_post_load’ [-Wmissing-prototypes]
  189 | void kimage_file_post_load(struct kimage *image)
      |      ^~~~~~~~~~~~~~~~~~~~~

Reviewed-by Stefan Berger <[email protected]>

Quoted 2 lines · Stefan Berger

On 2/14/24 10:38, Tushar Sugandhi wrote:

...
<snip/>
...

Quoted 8 lines

kernel/kexec_file.c kimage_validate_signature(struct kimage *image) · line 193

Quoted 5 lines

kernel/kexec_file.c +5 -0

+void kimage_file_post_load(struct kimage *image)
+{
+    ima_kexec_post_load(image);
+}
+

We get this here at this point but it disappears later -- missing header?

Quoted 6 lines

kernel/kexec_file.c:189:6: warning: no previous prototype for ‘kimage_file_post_load’ [-Wmissing-prototypes]
189 | void kimage_file_post_load(struct kimage *image)

       |      ^~~~~~~~~~~~~~~~~~~~~

Thanks Stefan.
I was also getting it.
But couldn't figure out why. And I was puzzled why it was going away.

Since kimage_file_post_load() is called from the same file in patch 5/8, I don't see a need of declaring it in a header file like include/linux/kexec.h.

Making kimage_file_post_load() local static resolves the warning. But then it throws "defined but not used" warning. I will have to call it from kexec_file_load syscall in this patch (4/8) instead 5/8 to resolve that warning.

I will make the function a stub function in this patch and make it call ima_kexec_post_load(image) in the next patch to avoid any potential bisect safe issues.

It aligns with the goals of patch 4/8 and 5/8 anyways.

security/integrity/ima/ima_kexec.c +12 -0

+static void kimage_file_post_load(struct kimage *image)
+{
+	/*
+	 * this will call ima_kexec_post_load(image) to map the segment
+	 * and register the reboot notifier for moving the IMA log at
+	 * kexec execute
+	 */
+}
+

@@ -410,6 +410,9 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, 
 int, initrd_fd,
         kimage_terminate(image);
+    if (!(flags & KEXEC_FILE_ON_CRASH))
+        kimage_file_post_load(image);
+
 
...

...<snip/>
...

Quoted 1 line

Reviewed-by Stefan Berger <[email protected]>

Thanks for the tag. I will apply it on the next version.

~Tushar

security/integrity/ima/ima_kexec.c +5 -0

index ccb072617c2d..1d4d6c122d82 100644
@@ -12,10 +12,14 @@
 #include <linux/kexec.h>
 #include <linux/of.h>
 #include <linux/ima.h>
+#include <linux/reboot.h>
+#include <asm/page.h>
 #include "ima.h"
 
 #ifdef CONFIG_IMA_KEXEC
 static struct seq_file ima_kexec_file;
+static void *ima_kexec_buffer;
+static bool ima_kexec_update_registered;
 
 static void ima_reset_kexec_file(struct seq_file *sf)
 {

@@ -184,6 +188,48 @@ void ima_add_kexec_buffer(struct kimage *image)
 	kexec_dprintk("kexec measurement buffer for the loaded kernel at
 0x%lx.\n",
 		      kbuf.mem);
 }
+

security/integrity/ima/ima_kexec.c +22 -0

+	if (ima_kexec_buffer) {
+		kimage_unmap_segment(ima_kexec_buffer);
+		ima_kexec_buffer = NULL;
+	}
+
+	if (!image->ima_buffer_addr)
+		return;
+
+	ima_kexec_buffer = kimage_map_segment(image,
+					      image->ima_buffer_addr,
+					      image->ima_buffer_size);
+	if (!ima_kexec_buffer) {
+		pr_err("%s: Could not map measurements buffer.\n", __func__);
+		return;
+	}
+
+	if (!ima_kexec_update_registered) {
+		register_reboot_notifier(&update_buffer_nb);
+		ima_kexec_update_registered = true;
+	}
+}
+
 #endif /* IMA_KEXEC */
 

/*

IMA log is copied to the new Kernel during kexec 'load' using ima_dump_measurement_list(). The log copy at kexec 'load' may result in loss of IMA measurements during kexec soft reboot. It needs to be copied over during kexec 'execute'. Setup the needed infrastructure to move the IMA log copy from kexec 'load' to 'execute'.

Define a new IMA hook ima_update_kexec_buffer() as a stub function. It will be used to call ima_dump_measurement_list() during kexec 'execute'.

Implement kimage_file_post_load() and ima_kexec_post_load() functions to be invoked after the new Kernel image has been loaded for kexec. ima_kexec_post_load() maps the IMA buffer to a segment in the newly loaded Kernel. It also registers the reboot notifier_block to trigger ima_update_kexec_buffer() at exec 'execute'.

Signed-off-by Tushar Sugandhi <[email protected]>

---
 include/linux/ima.h                |  3 ++
 kernel/kexec_file.c                |  5 ++++
 security/integrity/ima/ima_kexec.c | 46 ++++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+)

include/linux/ima.h +3 -0

index 86b57757c7b1..006db20f852d 100644
@@ -49,6 +49,9 @@ static inline void ima_appraise_parse_cmdline(void) {}
 
 #ifdef CONFIG_IMA_KEXEC
 extern void ima_add_kexec_buffer(struct kimage *image);
+extern void ima_kexec_post_load(struct kimage *image);
+#else
+static inline void ima_kexec_post_load(struct kimage *image) {}
 #endif
 
 #else

kernel/kexec_file.c +5 -0

index 0e3689bfb0bb..fe59cb7c179d 100644
@@ -186,6 +186,11 @@ kimage_validate_signature(struct kimage *image)
 }
 #endif
 
+void kimage_file_post_load(struct kimage *image)
+{
+	ima_kexec_post_load(image);
+}
+
 /*
  * In file mode list of segments is prepared by kernel. Copy relevant
  * data from user space, do error checking, prepare segment list

security/integrity/ima/ima_kexec.c +32 -0

index ccb072617c2d..1d4d6c122d82 100644
@@ -12,10 +12,14 @@
 #include <linux/kexec.h>
 #include <linux/of.h>
 #include <linux/ima.h>
+#include <linux/reboot.h>
+#include <asm/page.h>
 #include "ima.h"
 
 #ifdef CONFIG_IMA_KEXEC
 static struct seq_file ima_kexec_file;
+static void *ima_kexec_buffer;
+static bool ima_kexec_update_registered;
 
 static void ima_reset_kexec_file(struct seq_file *sf)
 {

@@ -184,6 +188,48 @@ void ima_add_kexec_buffer(struct kimage *image)
 	kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
 		      kbuf.mem);
 }
+
+/*
+ * Called during kexec execute so that IMA can update the measurement list.
+ */
+static int ima_update_kexec_buffer(struct notifier_block *self,
+				   unsigned long action, void *data)
+{
+	return NOTIFY_OK;
+}
+
+struct notifier_block update_buffer_nb = {
+	.notifier_call = ima_update_kexec_buffer,
+};
+
+/*
+ * Create a mapping for the source pages that contain the IMA buffer
+ * so we can update it later.
+ */
+void ima_kexec_post_load(struct kimage *image)
+{
+	if (ima_kexec_buffer) {
+		kimage_unmap_segment(ima_kexec_buffer);
+		ima_kexec_buffer = NULL;
+	}
+
+	if (!image->ima_buffer_addr)
+		return;
+

ima_dump_measurement_list() is called during kexec 'load', which may result in loss of IMA measurements during kexec soft reboot. It needs to be called during kexec 'execute'.

This patch includes the following changes:
- Call kimage_file_post_load() from kexec_file_load() syscall only for kexec soft reboot scenarios and not for KEXEC_FILE_ON_CRASH. It will map the IMA segment, and register reboot notifier for the function ima_update_kexec_buffer() which would copy the IMA log at kexec soft reboot.
- Make kexec_segment_size variable local static to the file, for it to be accessible both during kexec 'load' and 'execute'.
- Move ima_dump_measurement_list() call from ima_add_kexec_buffer() to ima_update_kexec_buffer().
- Remove ima_reset_kexec_file() call from ima_add_kexec_buffer(), now that the buffer is being copied at kexec 'execute', and resetting the file at kexec 'load' will corrupt the buffer.

Signed-off-by Tushar Sugandhi <[email protected]>

---
  kernel/kexec_file.c                |  3 ++
  security/integrity/ima/ima_kexec.c | 45 +++++++++++++++++++-----------
  2 files changed, 32 insertions(+), 16 deletions(-)

kernel/kexec_file.c +3 -0

index fe59cb7c179d..2d5df320c34f 100644
@@ -410,6 +410,9 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
 
  	kimage_terminate(image);
 
+	if (!(flags & KEXEC_FILE_ON_CRASH))
+		kimage_file_post_load(image);
+
  	ret = machine_kexec_post_load(image);
  	if (ret)
  		goto out;

security/integrity/ima/ima_kexec.c +9 -16

index 1d4d6c122d82..98fc9b9782a2 100644
@@ -19,6 +19,7 @@
  #ifdef CONFIG_IMA_KEXEC
  static struct seq_file ima_kexec_file;
  static void *ima_kexec_buffer;
+static size_t kexec_segment_size;
  static bool ima_kexec_update_registered;
 
  static void ima_reset_kexec_file(struct seq_file *sf)

@@ -129,7 +130,6 @@ void ima_add_kexec_buffer(struct kimage *image)
  	/* use more understandable variable names than defined in kbuf */
  	void *kexec_buffer = NULL;
  	size_t kexec_buffer_size;
-	size_t kexec_segment_size;
  	int ret;
 
  	/*

@@ -154,14 +154,6 @@ void ima_add_kexec_buffer(struct kimage *image)
  		return;
  	}
 
-	ret = ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
-					kexec_segment_size);
-	if (ret < 0) {
-		pr_err("%s: Failed to dump IMA measurements. Error:%d.\n",
-		       __func__, ret);
-		return;
-	}
-
  	kbuf.buffer = kexec_buffer;
  	kbuf.bufsz = kexec_buffer_size;
  	kbuf.memsz = kexec_segment_size;

@@ -179,12 +171,6 @@ void ima_add_kexec_buffer(struct kimage *image)
  	image->ima_segment_index = image->nr_segments - 1;
  	image->is_ima_segment_index_set = true;
 
-	/*
-	 * kexec owns kexec_buffer after kexec_add_buffer() is called
-	 * and it will vfree() that buffer.
-	 */
-	ima_reset_kexec_file(&ima_kexec_file);
-
  	kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
  		      kbuf.mem);
  }

@@ -195,7 +181,34 @@ void ima_add_kexec_buffer(struct kimage *image)
  static int ima_update_kexec_buffer(struct notifier_block *self,
  				   unsigned long action, void *data)
  {
-	return NOTIFY_OK;
+	void *buf = NULL;
+	size_t buf_size;
+	int ret = NOTIFY_OK;
+
+	if (!kexec_in_progress) {
+		pr_info("%s: No kexec in progress.\n", __func__);
+		return ret;
+	}

security/integrity/ima/ima_kexec.c +3 -1

@@ -195,7 +181,34 @@ void ima_add_kexec_buffer(struct kimage *image)
 static int ima_update_kexec_buffer(struct notifier_block *self,
 				   unsigned long action, void *data)
 {
-	return NOTIFY_OK;
+	void *buf = NULL;
+	size_t buf_size;
+	int ret = NOTIFY_OK;

security/integrity/ima/ima_kexec.c +7 -0

+	ret = ima_dump_measurement_list(&buf_size, &buf,
+					kexec_segment_size);
+
+	if (!buf) {
+		pr_err("%s: Dump measurements failed. Error:%d\n",
+		       __func__, ret);
+		goto out;

ima_dump_measurement_list() is called during kexec 'load', which may result in loss of IMA measurements during kexec soft reboot. It needs to be called during kexec 'execute'.

This patch includes the following changes:
- Call kimage_file_post_load() from kexec_file_load() syscall only for kexec soft reboot scenarios and not for KEXEC_FILE_ON_CRASH. It will map the IMA segment, and register reboot notifier for the function ima_update_kexec_buffer() which would copy the IMA log at kexec soft reboot.
- Make kexec_segment_size variable local static to the file, for it to be accessible both during kexec 'load' and 'execute'.
- Move ima_dump_measurement_list() call from ima_add_kexec_buffer() to ima_update_kexec_buffer().
- Remove ima_reset_kexec_file() call from ima_add_kexec_buffer(), now that the buffer is being copied at kexec 'execute', and resetting the file at kexec 'load' will corrupt the buffer.

Signed-off-by Tushar Sugandhi <[email protected]>

---
 kernel/kexec_file.c                |  3 ++
 security/integrity/ima/ima_kexec.c | 45 +++++++++++++++++++-----------
 2 files changed, 32 insertions(+), 16 deletions(-)

kernel/kexec_file.c +3 -0

index fe59cb7c179d..2d5df320c34f 100644
@@ -410,6 +410,9 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
 
 	kimage_terminate(image);
 
+	if (!(flags & KEXEC_FILE_ON_CRASH))
+		kimage_file_post_load(image);
+
 	ret = machine_kexec_post_load(image);
 	if (ret)
 		goto out;

security/integrity/ima/ima_kexec.c +1 -1

index 1d4d6c122d82..98fc9b9782a2 100644
@@ -19,6 +19,7 @@
 #ifdef CONFIG_IMA_KEXEC
 static struct seq_file ima_kexec_file;
 static void *ima_kexec_buffer;
+static size_t kexec_segment_size;
 static bool ima_kexec_update_registered;
 
 static void ima_reset_kexec_file(struct seq_file *sf)

@@ -129,7 +130,6 @@ void ima_add_kexec_buffer(struct kimage *image)
 	/* use more understandable variable names than defined in kbuf */
 	void *kexec_buffer = NULL;
 	size_t kexec_buffer_size;
-	size_t kexec_segment_size;
 	int ret;
 
 	/*

@@ -154,14 +154,6 @@ void ima_add_kexec_buffer(struct kimage *image)
 		return;

New measurements added to the IMA log while the log is being copied during the kexec 'execute' may not get copied over.

This can cause the
measurement log to be out of sync with the TPM PCRs that IMA extends, which could result in breaking the integrity of the measurements after kexec soft reboot.

Implement and call the functions ima_measurements_suspend() and ima_measurements_resume() from ima_update_kexec_buffer().

Add a check in the ima_add_template_entry() function not to measure events when 'suspend_ima_measurements' flag is set.

This ensures the integrity of the IMA log while it is being copied over to the new Kernel during kexec 'execute'.

Reviewed-by Stefan Berger <[email protected]>

Signed-off-by Tushar Sugandhi <[email protected]>

---
 security/integrity/ima/ima.h       |  2 ++
 security/integrity/ima/ima_kexec.c |  7 +++++++
 security/integrity/ima/ima_queue.c | 32 ++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+)

security/integrity/ima/ima.h +2 -0

index c29db699c996..49a6047dd8eb 100644
@@ -161,6 +161,8 @@ bool ima_template_has_modsig(const struct
 ima_template_desc *ima_template);
 int ima_restore_measurement_entry(struct ima_template_entry *entry);
 int ima_restore_measurement_list(loff_t bufsize, void *buf);
 int ima_measurements_show(struct seq_file *m, void *v);
+void ima_measurements_suspend(void);
+void ima_measurements_resume(void);
 unsigned long ima_get_binary_runtime_size(void);
 int ima_init_template(void);

void ima_init_template_list(void);

security/integrity/ima/ima_kexec.c +1 -0

index 98fc9b9782a2..dbeeb7f1355e 100644
@@ -184,6 +184,7 @@ static int ima_update_kexec_buffer(struct notifier_block
 *self,
 	void *buf = NULL;
 	size_t buf_size;
 	int ret = NOTIFY_OK;
+	bool resume = false;
 
 	if (!kexec_in_progress) {

security/integrity/ima/ima_kexec.c +0 -0

 		pr_info("%s: No kexec in progress.\n", __func__);

@@ -195,12 +196,15 @@ static int ima_update_kexec_buffer(struct notifier_block
 *self,
 		return ret;
 	}

security/integrity/ima/ima_kexec.c +0 -0

 	return ret;
 }

security/integrity/ima/ima_queue.c +19 -0

index 532da87ce519..5946a26a2849 100644
@@ -44,6 +44,11 @@ struct ima_h_table ima_htable = {
  */
 static DEFINE_MUTEX(ima_extend_list_mutex);
 
+/*
+ * Used internally by the kernel to suspend-resume ima measurements.
+ */
+static atomic_t suspend_ima_measurements;
+
 /* lookup up the digest value in the hash table, and return the entry */
 static struct ima_queue_entry *ima_lookup_digest_entry(u8 *digest_value,
 						       int pcr)

@@ -148,6 +153,20 @@ static int ima_pcr_extend(struct tpm_digest *digests_arg,
 int pcr)
 	return result;
 }
 
+void ima_measurements_suspend(void)
+{
+	mutex_lock(&ima_extend_list_mutex);
+	atomic_set(&suspend_ima_measurements, 1);
+	mutex_unlock(&ima_extend_list_mutex);
+}
+
+void ima_measurements_resume(void)
+{
+	mutex_lock(&ima_extend_list_mutex);
+	atomic_set(&suspend_ima_measurements, 0);
+	mutex_unlock(&ima_extend_list_mutex);
+}
+
 /*
  * Add template entry to the measurement list and hash table, and

* extend the pcr.

security/integrity/ima/ima_queue.c +0 -0

@@ -176,6 +195,19 @@ int ima_add_template_entry(struct ima_template_entry
 *entry, int violation,

security/integrity/ima/ima_queue.c +6 -0

+	if (atomic_read(&suspend_ima_measurements)) {
+		audit_cause = "measurements_suspended";
+		audit_info = 0;
+		goto out;
+	}
+
 	result = ima_add_digest_entry(entry,
 				      !IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE));

if (result < 0) {

security/integrity/ima/ima_queue.c int ima_add_template_entry(struct ima_template_entry · line 205

Quoted 13 lines

security/integrity/ima/ima_queue.c +7 -0

@@ -176,6 +195,19 @@ int ima_add_template_entry(struct ima_template_entry
 *entry, int violation,
 		}
 	}
 
+	/*
+	 * suspend_ima_measurements will be set if the system is
+	 * undergoing kexec soft boot to a new kernel.
+	 * suspending measurements in this short window ensures the
+	 * consistency of the IMA measurement list during copying
+	 * of the kexec buffer.
+	 */

Either remove the 2nd sentence "suspending measurements in this short window ..." or explain what is meant by "short window".

security/integrity/ima/ima_queue.c int ima_add_template_entry(struct ima_template_entry *entry, int violation, · line 208

Quoted 4 lines

security/integrity/ima/ima_queue.c +4 -0

+	if (atomic_read(&suspend_ima_measurements)) {
+		audit_cause = "measurements_suspended";
+		audit_info = 0;
+		goto out;

Quoted 5 lines

security/integrity/ima/ima_queue.c +2 -0

+	}
+
 	result = ima_add_digest_entry(entry,
 				      !IS_ENABLED(CONFIG_IMA_DISABLE_HTABLE));

if (result < 0) {

Quoted 17 lines

security/integrity/ima/ima_queue.c int ima_add_template_entry(struct ima_template_entry · line 205

Quoted 12 lines

security/integrity/ima/ima_queue.c +7 -0

@@ -176,6 +195,19 @@ int ima_add_template_entry(struct ima_template_entry
 *entry, int violation,
 		}
 	}
 
+	/*
+	 * suspend_ima_measurements will be set if the system is
+	 * undergoing kexec soft boot to a new kernel.
+	 * suspending measurements in this short window ensures the
+	 * consistency of the IMA measurement list during copying
+	 * of the kexec buffer.
+	 */  

Either remove the 2nd sentence "suspending measurements in this short window ..." or explain what is meant by "short window".

Quoted 4 lines

security/integrity/ima/ima_queue.c int ima_add_template_entry(struct ima_template_entry *entry, int violation, · line 208

Quoted 4 lines

security/integrity/ima/ima_queue.c +4 -0

+	if (atomic_read(&suspend_ima_measurements)) {
+		audit_cause = "measurements_suspended";
+		audit_info = 0;
+		goto out;  

After the suggested changes, understanding how many measurements are not being added to the measurement list and not being extended into the TPM would be really interesting.

The extra memory allocated for carrying the IMA measurement list across kexec is hard-coded as half a PAGE. Make it configurable.

Define a Kconfig option, IMA_KEXEC_EXTRA_MEMORY_KB, to configure the extra memory (in kb) to be allocated for IMA measurements added during kexec soft reboot. Ensure the default value of the option is set such that extra half a page of memory for additional measurements is allocated for the additional measurements.

Update ima_add_kexec_buffer() function to allocate memory based on the Kconfig option value, rather than the currently hard-coded one.

Suggested-by Stefan Berger <[email protected]>

Reviewed-by Stefan Berger <[email protected]>

Signed-off-by Tushar Sugandhi <[email protected]>

---
 security/integrity/ima/Kconfig     |  9 +++++++++
 security/integrity/ima/ima_kexec.c | 15 ++++++++++-----
 2 files changed, 19 insertions(+), 5 deletions(-)

security/integrity/ima/Kconfig +0 -0

index b98bfe9efd0c..4c0fc53d6aa3 100644
@@ -320,4 +320,13 @@ config IMA_DISABLE_HTABLE
 	help
 	   This option disables htable to allow measurement of duplicate

records.

security/integrity/ima/Kconfig +9 -0

+config IMA_KEXEC_EXTRA_MEMORY_KB
+	int
+	depends on IMA_KEXEC
+	default 0
+	help
+	  IMA_KEXEC_EXTRA_MEMORY_KB determines the extra memory to be
+	  allocated (in kb) for IMA measurements added during kexec soft reboot.
+	  If set to the default value, an extra half a page of memory for those
+	  additional measurements will be allocated.
 endif

security/integrity/ima/ima_kexec.c +1 -0

index dbeeb7f1355e..50903d4ce880 100644
@@ -126,6 +126,7 @@ void ima_add_kexec_buffer(struct kimage *image)
 				  .buf_min = 0, .buf_max = ULONG_MAX,
 				  .top_down = true };
 	unsigned long binary_runtime_size;
+	unsigned long extra_size;
 
 	/* use more understandable variable names than defined in kbuf */
 	void *kexec_buffer = NULL;

@@ -133,15 +134,19 @@ void ima_add_kexec_buffer(struct kimage *image)
 	int ret;
 
 	/*

The amount of memory allocated at kexec load, even with the extra memory allocated, might not be large enough for the entire measurement list. The indeterminate interval between kexec 'load' and 'execute' could exacerbate this problem.

Define two new IMA events, 'kexec_load' and 'kexec_execute', to be measured as critical data at kexec 'load' and 'execute' respectively. Report the allocated kexec segment size, IMA binary log size and the runtime measurements count as part of those events.

These events, and the values reported through them, serve as markers in the IMA log to verify the IMA events are captured during kexec soft reboot. The presence of a 'kexec_load' event in between the last two 'boot_aggregate' events in the IMA log implies this is a kexec soft reboot, and not a cold-boot. And the absence of 'kexec_execute' event after kexec soft reboot implies missing events in that window which results in inconsistency with TPM PCR quotes, necessitating a cold boot for a successful remote attestation.

Signed-off-by Tushar Sugandhi <[email protected]>

---
  security/integrity/ima/ima_kexec.c | 34 +++++++++++++++++++++++++++++-
  1 file changed, 33 insertions(+), 1 deletion(-)

security/integrity/ima/ima_kexec.c +26 -1

index 50903d4ce880..31495a043959 100644
@@ -17,6 +17,8 @@
  #include "ima.h"
 
  #ifdef CONFIG_IMA_KEXEC
+#define IMA_KEXEC_EVENT_LEN 256
+
  static struct seq_file ima_kexec_file;
  static void *ima_kexec_buffer;
  static size_t kexec_segment_size;

@@ -38,6 +40,10 @@ static void ima_free_kexec_file_buf(struct seq_file *sf)
 
  static int ima_alloc_kexec_file_buf(size_t segment_size)
  {
+	char ima_kexec_event[IMA_KEXEC_EVENT_LEN];
+	size_t buf_size;
+	long len;
+
  	/*
  	 * kexec 'load' may be called multiple times.
  	 * Free and realloc the buffer only if the segment_size is

@@ -47,7 +53,7 @@ static int ima_alloc_kexec_file_buf(size_t segment_size)
  	    ima_kexec_file.size == segment_size &&
  	    ima_kexec_file.read_pos == 0 &&
  	    ima_kexec_file.count == sizeof(struct ima_kexec_hdr))
-		return 0;
+		goto out;
 
  	ima_free_kexec_file_buf(&ima_kexec_file);
 

@@ -60,6 +66,18 @@ static int ima_alloc_kexec_file_buf(size_t segment_size)
  	ima_kexec_file.read_pos = 0;
  	ima_kexec_file.count = sizeof(struct ima_kexec_hdr);	/* reserved space */
 
+out:
+	buf_size = ima_get_binary_runtime_size();
+	len = atomic_long_read(&ima_htable.len);
+
+	scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
+		  "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"
+		  "ima_runtime_measurements_count=%ld;",
+		  segment_size, buf_size, len);
+
+	ima_measure_critical_data("ima_kexec", "kexec_load", ima_kexec_event,
+				  strlen(ima_kexec_event), false, NULL, 0);
+
  	return 0;
  }
 

@@ -186,10 +204,12 @@ void ima_add_kexec_buffer(struct kimage *image)
  static int ima_update_kexec_buffer(struct notifier_block *self,
  				   unsigned long action, void *data)
  {
+	char ima_kexec_event[IMA_KEXEC_EVENT_LEN];
  	void *buf = NULL;
  	size_t buf_size;
  	int ret = NOTIFY_OK;
  	bool resume = false;
+	long len;
 
  	if (!kexec_in_progress) {
  		pr_info("%s: No kexec in progress.\n", __func__);

@@ -201,6 +221,18 @@ static int ima_update_kexec_buffer(struct notifier_block *self,
  		return ret;
  	}
 
+	buf_size = ima_get_binary_runtime_size();
+	len = atomic_long_read(&ima_htable.len);
+
+	scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
+		  "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"

Quoted 98 lines · Tushar Sugandhi

The amount of memory allocated at kexec load, even with the extra memory allocated, might not be large enough for the entire measurement list. The indeterminate interval between kexec 'load' and 'execute' could exacerbate this problem.

Define two new IMA events, 'kexec_load' and 'kexec_execute', to be measured as critical data at kexec 'load' and 'execute' respectively. Report the allocated kexec segment size, IMA binary log size and the runtime measurements count as part of those events.

These events, and the values reported through them, serve as markers in the IMA log to verify the IMA events are captured during kexec soft reboot.  The presence of a 'kexec_load' event in between the last two 'boot_aggregate' events in the IMA log implies this is a kexec soft reboot, and not a cold-boot.  And the absence of 'kexec_execute' event after kexec soft reboot implies missing events in that window which results in inconsistency with TPM PCR quotes, necessitating a cold boot for a successful remote attestation.

Signed-off-by Tushar Sugandhi <[email protected]>

---
  security/integrity/ima/ima_kexec.c | 34 +++++++++++++++++++++++++++++-

  1 file changed, 33 insertions(+), 1 deletion(-)

security/integrity/ima/ima_kexec.c +6 -0

index 50903d4ce880..31495a043959 100644
@@ -17,6 +17,8 @@
   #include "ima.h"
   #ifdef CONFIG_IMA_KEXEC
+#define IMA_KEXEC_EVENT_LEN 256
+
   static struct seq_file ima_kexec_file;
   static void *ima_kexec_buffer;
   static size_t kexec_segment_size;

@@ -38,6 +40,10 @@ static void ima_free_kexec_file_buf(struct seq_file 
 *sf)
   static int ima_alloc_kexec_file_buf(size_t segment_size)
   {
+    char ima_kexec_event[IMA_KEXEC_EVENT_LEN];
+    size_t buf_size;
+    long len;
+
       /*
        * kexec 'load' may be called multiple times.
        * Free and realloc the buffer only if the segment_size is

@@ -47,7 +53,7 @@ static int ima_alloc_kexec_file_buf(size_t 
 segment_size)

          ima_kexec_file.size == segment_size && ima_kexec_file.read_pos == 0 && ima_kexec_file.count == sizeof(struct ima_kexec_hdr)) -        return 0;
+        goto out; ima_free_kexec_file_buf(&ima_kexec_file);

security/integrity/ima/ima_kexec.c +0 -0

@@ -60,6 +66,18 @@ static int ima_alloc_kexec_file_buf(size_t 
 segment_size)
       ima_kexec_file.read_pos = 0;

      ima_kexec_file.count = sizeof(struct ima_kexec_hdr);    /* reserved space */

security/integrity/ima/ima_kexec.c +10 -0

+out:
+    buf_size = ima_get_binary_runtime_size();
+    len = atomic_long_read(&ima_htable.len);
+
+    scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
+          "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"
+          "ima_runtime_measurements_count=%ld;",
+          segment_size, buf_size, len);
+
+    ima_measure_critical_data("ima_kexec", "kexec_load", 

ima_kexec_event,
+                  strlen(ima_kexec_event), false, NULL, 0); +
      return 0;
  }

security/integrity/ima/ima_kexec.c +10 -0

@@ -186,10 +204,12 @@ void ima_add_kexec_buffer(struct kimage *image)
   static int ima_update_kexec_buffer(struct notifier_block *self,
                      unsigned long action, void *data)
   {
+    char ima_kexec_event[IMA_KEXEC_EVENT_LEN];
       void *buf = NULL;
       size_t buf_size;
       int ret = NOTIFY_OK;
       bool resume = false;
+    long len;
       if (!kexec_in_progress) {
           pr_info("%s: No kexec in progress.\n", __func__);

@@ -201,6 +221,18 @@ static int ima_update_kexec_buffer(struct 
 notifier_block *self,
           return ret;
       }
+    buf_size = ima_get_binary_runtime_size();
+    len = atomic_long_read(&ima_htable.len);
+
+    scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
+          "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"
+          "ima_runtime_measurements_count=%ld;",
+          kexec_segment_size, buf_size, len);
+

security/integrity/ima/ima_kexec.c static int ima_update_kexec_buffer(struct notifier_block *self, · line 238

Quoted 6 lines

security/integrity/ima/ima_kexec.c +4 -0

+    ima_measure_critical_data("ima_kexec", "kexec_execute",
+                  ima_kexec_event, strlen(ima_kexec_event),
+                  false, NULL, 0);
+
       ima_measurements_suspend();
       ret = ima_dump_measurement_list(&buf_size, &buf,

It's twice the same code almost in the same file. You could move it into a function.

The amount of memory allocated at kexec load, even with the extra memory allocated, might not be large enough for the entire measurement list. The indeterminate interval between kexec 'load' and 'execute' could exacerbate this problem.

Define two new IMA events, 'kexec_load' and 'kexec_execute', to be measured as critical data at kexec 'load' and 'execute' respectively. Report the allocated kexec segment size, IMA binary log size and the runtime measurements count as part of those events.

These events, and the values reported through them, serve as markers in the IMA log to verify the IMA events are captured during kexec soft reboot. The presence of a 'kexec_load' event in between the last two 'boot_aggregate' events in the IMA log implies this is a kexec soft reboot, and not a cold-boot. And the absence of 'kexec_execute' event after kexec soft reboot implies missing events in that window which results in inconsistency with TPM PCR quotes, necessitating a cold boot for a successful remote attestation.

Signed-off-by Tushar Sugandhi <[email protected]>

Quoted 19 lines · Tushar Sugandhi

The amount of memory allocated at kexec load, even with the extra memory allocated, might not be large enough for the entire measurement list. The indeterminate interval between kexec 'load' and 'execute' could exacerbate this problem.

Define two new IMA events, 'kexec_load' and 'kexec_execute', to be measured as critical data at kexec 'load' and 'execute' respectively. Report the allocated kexec segment size, IMA binary log size and the runtime measurements count as part of those events.

These events, and the values reported through them, serve as markers in the IMA log to verify the IMA events are captured during kexec soft reboot.  The presence of a 'kexec_load' event in between the last two 'boot_aggregate' events in the IMA log implies this is a kexec soft reboot, and not a cold-boot.  And the absence of 'kexec_execute' event after kexec soft reboot implies missing events in that window which results in inconsistency with TPM PCR quotes, necessitating a cold boot for a successful remote attestation.

Quoted 1 line

Signed-off-by Tushar Sugandhi <[email protected]>

I successfully tested this series on ppc64. I will give you a Tested-by tag in the next round.

   Stefan

The current Kernel behavior is IMA measurements snapshot is taken at kexec 'load' and not at kexec 'execute'. IMA log is then carried over to the new Kernel after kexec 'execute'.

New events can be measured during/after the IMA log snapshot at kexec 'load' and before the system boots to the new Kernel. In this scenario, the TPM PCRs are extended with these events, but they are not carried over to the new Kernel after kexec soft reboot since the snapshot is already taken. This results in mismatch between TPM PCR quotes and the actual IMA measurements list after kexec soft reboot, which in turn results in remote attestation failure.

To solve this problem -
- allocate the necessary buffer at kexec 'load' time,
- populate the buffer with the IMA measurements at kexec 'execute' time,
- and measure two new IMA events 'kexec_load' and 'kexec_execute' as critical data to help detect missing events after kexec soft reboot.

The solution details include:
- refactoring the existing code to allocate a buffer to hold IMA measurements at kexec 'load', and dump the measurements at kexec 'execute'

- IMA functionality to suspend and resume measurements as needed during buffer copy at kexec 'execute',

- kexec functionality for mapping the segments from the current Kernel to the subsequent one,

- necessary changes to the kexec_file_load syscall, enabling it to call the ima functions,

- registering a reboot notifier which gets called during kexec 'execute',

- introducing a new Kconfig option to configure the extra memory to be allocated for passing IMA log from the current Kernel to the next,

- introducing two new events to be measured by IMA during kexec, to help diagnose if the IMA log was copied fully or partially, from the current Kernel to the next,

- excluding IMA segment while calculating and storing digest in function kexec_calculate_store_digests(), since IMA segment can be modified after the digest is computed during kexec 'load'. This will ensure that the segment is not added to the 'purgatory_sha_regions', and thus not verified by verify_sha256_digest().

The changes proposed in this series ensure the integrity of the IMA measurements is preserved across kexec soft reboots, thus significantly improving the security of the Kernel post kexec soft reboots.

There were previous attempts to fix this issue [1], [2], [3]. But they were not merged into the mainline Kernel.

We took inspiration from the past work [1] and [2] while working on this patch series.

V4 of this series is available here[6] for reference.