ima: Kdump kernel doesn't need IMA to do integrity measurement

PATCH In review steven chen 3 participants 6 messages May 2, 2025 – May 13, 2025

Subsystems (6)

Security (LSM) Live update kexec handover (KHO) Keys-trusted +2 more subsystems

lore

Share & tools

lore

steven chen

author

2025-05-02 20:03 UTC #0 lore raw

PATCH 1/1 ima: Kdump kernel doesn't need IMA to do integrity measurement

From: Steven Chen <[email protected]>

Kdump kernel doesn't need IMA to do integrity measurement. Hence the measurement list in 1st kernel doesn't need to be copied to kdump kenrel.

Here skip allocating buffer for measurement list copying if loading kdump kernel. Then there won't be the later handling related to ima_kexec_buffer.

Signed-off-by Steven Chen <[email protected]>

---
 security/integrity/ima/ima_kexec.c | 3 +++
 1 file changed, 3 insertions(+)

security/integrity/ima/ima_kexec.c +3 -0

index 38cb2500f4c3..7362f68f2d8b 100644
@@ -146,6 +146,9 @@ void ima_add_kexec_buffer(struct kimage *image)
 	void *kexec_buffer = NULL;
 	int ret;
 
+	if (image->type == KEXEC_TYPE_CRASH)
+		return;
+
 	/*
 	 * Reserve extra memory for measurements added during kexec.
 	 */

Signature · 1 line

2.43.0

steven chen

author

2025-05-12 14:23 UTC #1 lore raw

Quoted 20 lines · steven chen

From: Steven Chen <[email protected]>
Kdump kernel doesn't need IMA to do integrity measurement. Hence the measurement list in 1st kernel doesn't need to be copied to kdump kenrel.
Here skip allocating buffer for measurement list copying if loading kdump kernel. Then there won't be the later handling related to ima_kexec_buffer.
Signed-off-by Steven Chen <[email protected]>
---
  security/integrity/ima/ima_kexec.c | 3 +++
  1 file changed, 3 insertions(+)
security/integrity/ima/ima_kexec.c +0 -0
index 38cb2500f4c3..7362f68f2d8b 100644

security/integrity/ima/ima_kexec.c void ima_add_kexec_buffer(struct kimage *image) · line 154

Quoted 9 lines

security/integrity/ima/ima_kexec.c +3 -0

@@ -146,6 +146,9 @@ void ima_add_kexec_buffer(struct kimage *image)
  	void *kexec_buffer = NULL;
  	int ret;
 
+	if (image->type == KEXEC_TYPE_CRASH)
+		return;
+
  	/*
  	 * Reserve extra memory for measurements added during kexec.
  	 */

Hi Baoquan,

Could you tell me when will you have time to validate kdump scenario using this patch?

This patch is based on the next-integrity branch of https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git/

Thanks,

Steven

Baoquan He

Tested-by Acked-by on v1 1/1

2025-05-13 02:25 UTC #2 lore raw

In reply to steven chen

Quoted 6 lines · steven chen

From: Steven Chen <[email protected]>
Kdump kernel doesn't need IMA to do integrity measurement. Hence the measurement list in 1st kernel doesn't need to be copied to kdump kenrel.

Quoted 8 lines

Here skip allocating buffer for measurement list copying if loading kdump kernel. Then there won't be the later handling related to ima_kexec_buffer.
Signed-off-by Steven Chen <[email protected]>
---
 security/integrity/ima/ima_kexec.c | 3 +++
 1 file changed, 3 insertions(+)

I applied this patch on top of below IMA patchset, and did a test. [PATCH v13 0/9] ima: kexec: measure events between kexec load and execute

When I loaded kdump kernel as below with '-d' specified:

/sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.15.0-rc6+ ro console=ttyS0,115200N81 irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 acpi_no_memhotplug transparent_hugepage=never nokaslr hest_disable novmcoredd cma=0 hugetlb_cma=0 pcie_ports=compat disable_cpu_apicid=0 --initrd=/boot/initramfs-6.15.0-rc6+kdump.img /boot/vmlinuz-6.15.0-rc6+

I can see that this patch works to skip copying measurement list to kdump kernel as expected..

=====Without this patch===

[48522.060422] kexec_file: kernel: 000000006fbcb87f kernel_size: 0xe99200
[48522.067742] PEFILE: Unsigned PE binary
[48522.094849] ima: kexec measurement buffer for the loaded kernel at 0x6efff000.
[48522.102982] crash_core: Crash PT_LOAD ELF header. phdr=00000000cae5d7e6 vaddr=0xffff8da640100000, paddr=0x100000, sz=0x5af00000 e_phnum=67 p_offset=0x100000

......snip...
=====

=====With this patch applied====

[ 2101.704125] kexec_file: kernel: 0000000046d8985c kernel_size: 0xeab200
[ 2101.711436] PEFILE: Unsigned PE binary
[ 2101.734752] crash_core: Crash PT_LOAD ELF header. phdr=000000006fc83a51 vaddr=0xffff899480100000, paddr=0x100000, sz=0x5af00000 e_phnum=67 p_offset=0x100000

......snip...
=====>

My only concern is the patch subject is not very sepcific, it better relfect the exact action taken in this patch, like:

ima: do not copy measurement list to kdump kernel

Other than above concern, please feel free to add my:

Tested-by Baoquan He <[email protected]>

Acked-by Baoquan He <[email protected]>

Quoted 17 lines

security/integrity/ima/ima_kexec.c +3 -0

index 38cb2500f4c3..7362f68f2d8b 100644
@@ -146,6 +146,9 @@ void ima_add_kexec_buffer(struct kimage *image)
 	void *kexec_buffer = NULL;
 	int ret;
 
+	if (image->type == KEXEC_TYPE_CRASH)
+		return;
+
 	/*
 	 * Reserve extra memory for measurements added during kexec.
 	 */

Signature · 1 line

2.43.0

steven chen

author

2025-05-13 15:21 UTC #3 lore raw

Quoted 43 lines · Baoquan He

Quoted 6 lines · steven chen
From: Steven Chen <[email protected]>
Kdump kernel doesn't need IMA to do integrity measurement. Hence the measurement list in 1st kernel doesn't need to be copied to kdump kenrel.
Quoted 8 lines
Here skip allocating buffer for measurement list copying if loading kdump kernel. Then there won't be the later handling related to ima_kexec_buffer.
Signed-off-by Steven Chen <[email protected]>
---
  security/integrity/ima/ima_kexec.c | 3 +++
  1 file changed, 3 insertions(+)
I applied this patch on top of below IMA patchset, and did a test. [PATCH v13 0/9] ima: kexec: measure events between kexec load and execute
When I loaded kdump kernel as below with '-d' specified:
/sbin/kexec -s -d -p --command-line=BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.15.0-rc6+ ro console=ttyS0,115200N81 irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 acpi_no_memhotplug transparent_hugepage=never nokaslr hest_disable novmcoredd cma=0 hugetlb_cma=0 pcie_ports=compat disable_cpu_apicid=0 --initrd=/boot/initramfs-6.15.0-rc6+kdump.img /boot/vmlinuz-6.15.0-rc6+
I can see that this patch works to skip copying measurement list to kdump kernel as expected..
=====Without this patch===
[48522.060422] kexec_file: kernel: 000000006fbcb87f kernel_size: 0xe99200
[48522.067742] PEFILE: Unsigned PE binary
[48522.094849] ima: kexec measurement buffer for the loaded kernel at 0x6efff000.
[48522.102982] crash_core: Crash PT_LOAD ELF header. phdr=00000000cae5d7e6 vaddr=0xffff8da640100000, paddr=0x100000, sz=0x5af00000 e_phnum=67 p_offset=0x100000
......snip...
=====
=====With this patch applied====
[ 2101.704125] kexec_file: kernel: 0000000046d8985c kernel_size: 0xeab200
[ 2101.711436] PEFILE: Unsigned PE binary
[ 2101.734752] crash_core: Crash PT_LOAD ELF header. phdr=000000006fc83a51 vaddr=0xffff899480100000, paddr=0x100000, sz=0x5af00000 e_phnum=67 p_offset=0x100000
......snip...
=====>
My only concern is the patch subject is not very sepcific, it better relfect the exact action taken in this patch, like:

Quoted 6 lines

ima: do not copy measurement list to kdump kernel
Other than above concern, please feel free to add my:
Tested-by Baoquan He <[email protected]>
Acked-by Baoquan He <[email protected]>

Thanks!

Quoted 17 lines

security/integrity/ima/ima_kexec.c +3 -0

index 38cb2500f4c3..7362f68f2d8b 100644
@@ -146,6 +146,9 @@ void ima_add_kexec_buffer(struct kimage *image)
  	void *kexec_buffer = NULL;
  	int ret;
 
+	if (image->type == KEXEC_TYPE_CRASH)
+		return;
+
  	/*
  	 * Reserve extra memory for measurements added during kexec.
  	 */

Signature · 1 line

2.43.0

Mimi Zohar

maintainer

2025-05-13 11:42 UTC #4 lore raw

In reply to steven chen

Hi Steven,

Quoted 5 lines · steven chen

From: Steven Chen <[email protected]>
Kdump kernel doesn't need IMA to do integrity measurement. Hence the measurement list in 1st kernel doesn't need to be copied to kdump kenrel.

^kernel

Please use "scripts/checkpatch.pl --codespell" to check for typos.

Mimi

Quoted 6 lines

Here skip allocating buffer for measurement list copying if loading kdump kernel. Then there won't be the later handling related to ima_kexec_buffer.
Signed-off-by Steven Chen <[email protected]>

steven chen

author

2025-05-13 15:31 UTC #5 lore raw

Quoted 5 lines · Mimi Zohar

Hi Steven,
Quoted 2 lines · steven chen
From: Steven Chen <[email protected]>

Quoted 8 lines

Quoted 3 lines
Kdump kernel doesn't need IMA to do integrity measurement. Hence the measurement list in 1st kernel doesn't need to be copied to kdump kenrel.
^kernel
Please use "scripts/checkpatch.pl --codespell" to check for typos.
Mimi

Will update. Thanks!

Quoted 5 lines

Quoted 5 lines
Here skip allocating buffer for measurement list copying if loading kdump kernel. Then there won't be the later handling related to ima_kexec_buffer.
Signed-off-by Steven Chen <[email protected]>