[PATHC v2 5/9] ima: on soft reboot, save the measurement list
Dave Young
dyoung at redhat.com
Wed Aug 31 18:57:12 PDT 2016
Hi, Mimi
On 08/30/16 at 06:40pm, Mimi Zohar wrote:
> From: Thiago Jung Bauermann <bauerman at linux.vnet.ibm.com>
>
> This patch uses the kexec buffer passing mechanism to pass the
> serialized IMA binary_runtime_measurements to the next kernel.
>
> Changelog v2:
> - Fix build issue by defining a stub ima_add_kexec_buffer and stub
> struct kimage when CONFIG_IMA=n and CONFIG_IMA_KEXEC=n. (Fenguang Wu)
> - removed kexec_add_handover_buffer() checksum argument.
> - added skip_checksum member to kexec_buf
> - only register reboot notifier once
>
> Changelog v1:
> - updated to call IMA functions (Mimi)
> - move code from ima_template.c to ima_kexec.c (Mimi)
>
> Signed-off-by: Thiago Jung Bauermann <bauerman at linux.vnet.ibm.com>
> Signed-off-by: Mimi Zohar <zohar at linux.vnet.ibm.com>
> ---
> include/linux/ima.h | 12 ++++++
> kernel/kexec_file.c | 4 ++
> security/integrity/ima/ima_kexec.c | 88 ++++++++++++++++++++++++++++++++++++++
> 3 files changed, 104 insertions(+)
>
> diff --git a/include/linux/ima.h b/include/linux/ima.h
> index 0eb7c2e..7f6952f 100644
> --- a/include/linux/ima.h
> +++ b/include/linux/ima.h
> @@ -11,6 +11,7 @@
> #define _LINUX_IMA_H
>
> #include <linux/fs.h>
> +#include <linux/kexec.h>
> struct linux_binprm;
>
> #ifdef CONFIG_IMA
> @@ -23,6 +24,10 @@ extern int ima_post_read_file(struct file *file, void *buf, loff_t size,
> enum kernel_read_file_id id);
> extern void ima_post_path_mknod(struct dentry *dentry);
>
> +#ifdef CONFIG_IMA_KEXEC
> +extern void ima_add_kexec_buffer(struct kimage *image);
> +#endif
> +
> #else
> static inline int ima_bprm_check(struct linux_binprm *bprm)
> {
> @@ -62,6 +67,13 @@ static inline void ima_post_path_mknod(struct dentry *dentry)
>
> #endif /* CONFIG_IMA */
>
> +#ifndef CONFIG_IMA_KEXEC
> +struct kimage;
> +
> +static inline void ima_add_kexec_buffer(struct kimage *image)
> +{}
> +#endif
> +
> #ifdef CONFIG_IMA_APPRAISE
> extern void ima_inode_post_setattr(struct dentry *dentry);
> extern int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
> index 0e90d14..9585861 100644
> --- a/kernel/kexec_file.c
> +++ b/kernel/kexec_file.c
> @@ -19,6 +19,7 @@
> #include <linux/mutex.h>
> #include <linux/list.h>
> #include <linux/fs.h>
> +#include <linux/ima.h>
> #include <crypto/hash.h>
> #include <crypto/sha.h>
> #include <linux/syscalls.h>
> @@ -200,6 +201,9 @@ kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd,
> return ret;
> image->kernel_buf_len = size;
>
> + /* IMA needs to pass the measurement list to the next kernel. */
> + ima_add_kexec_buffer(image);
> +
> /* Call arch image probe handlers */
> ret = arch_kexec_kernel_image_probe(image, image->kernel_buf,
> image->kernel_buf_len);
> diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
> index e77ca9d..0e4d0db 100644
> --- a/security/integrity/ima/ima_kexec.c
> +++ b/security/integrity/ima/ima_kexec.c
> @@ -23,6 +23,11 @@
>
> #include "ima.h"
>
> +#ifdef CONFIG_IMA_KEXEC
> +/* Physical address of the measurement buffer in the next kernel. */
> +static unsigned long kexec_buffer_load_addr;
> +static size_t kexec_segment_size;
> +
> static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
> unsigned long segment_size)
> {
> @@ -75,6 +80,89 @@ out:
> }
>
> /*
> + * Called during kexec execute so that IMA can save the measurement list.
> + */
> +static int ima_update_kexec_buffer(struct notifier_block *self,
> + unsigned long action, void *data)
> +{
> + void *kexec_buffer = NULL;
> + size_t kexec_buffer_size;
> + int ret;
> +
> + if (!kexec_in_progress)
> + return NOTIFY_OK;
> +
> + kexec_buffer_size = ima_get_binary_runtime_size();
> + if (kexec_buffer_size >
> + (kexec_segment_size - sizeof(struct ima_kexec_hdr))) {
> + pr_err("Binary measurement list grew too large.\n");
> + goto out;
> + }
> +
> + ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
> + kexec_segment_size);
> + if (!kexec_buffer) {
> + pr_err("Not enough memory for the kexec measurement buffer.\n");
> + goto out;
> + }
> + ret = kexec_update_segment(kexec_buffer, kexec_buffer_size,
> + kexec_buffer_load_addr, kexec_segment_size);
> + if (ret)
> + pr_err("Error updating kexec buffer: %d\n", ret);
> +out:
> + return NOTIFY_OK;
> +}
> +
> +struct notifier_block update_buffer_nb = {
> + .notifier_call = ima_update_kexec_buffer,
> +};
> +
> +/*
> + * Called during kexec_file_load so that IMA can add a segment to the kexec
> + * image for the measurement list for the next kernel.
> + */
> +void ima_add_kexec_buffer(struct kimage *image)
> +{
> + static int registered = 0;
> + struct kexec_buf kbuf = { .image = image, .buf_align = PAGE_SIZE,
> + .buf_min = 0, .buf_max = ULONG_MAX,
> + .top_down = true, .skip_checksum = true };
> + int ret;
> +
> + if (!kexec_can_hand_over_buffer())
> + return;
> +
> + kexec_segment_size = ALIGN(ima_get_binary_runtime_size() + PAGE_SIZE,
> + PAGE_SIZE);
> +
> + if (kexec_segment_size >= (ULONG_MAX - sizeof(long))) {
> + pr_err("Binary measurement list too large.\n");
> + return;
> + }
Now we added a limitation that total segment size can not be larger than
half of totalram. see kernel/kexec_core.c sanity_check_segment_list()
So can it fail early here if kexec_segment_size is over half of total
ram?
> +
> + /* Ask not to checksum the segment, we will update it later. */
> + kbuf.buffer = NULL;
> + kbuf.bufsz = 0;
> + kbuf.memsz = kexec_segment_size;
> + ret = kexec_add_handover_buffer(&kbuf);
> + if (ret) {
> + pr_err("Error passing over kexec measurement buffer.\n");
> + return;
> + }
> + kexec_buffer_load_addr = kbuf.mem;
> +
> + pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
> + kexec_buffer_load_addr);
> +
> + if (registered)
> + return;
> +
> + register_reboot_notifier(&update_buffer_nb);
> + registered = 1;
> +}
> +#endif /* IMA_KEXEC */
> +
> +/*
> * Restore the measurement list from the previous kernel.
> */
> void ima_load_kexec_buffer(void)
> --
> 2.1.0
>
Thanks
Dave
More information about the kexec
mailing list