[PATCH v3 7/7] ima: measure kexec load and exec events as critical data

[Tushar Sugandhi]

On 1/7/24 06:24, Mimi Zohar wrote:
> On Fri, 2024-01-05 at 12:22 -0800, Tushar Sugandhi wrote:
>>>> @@ -194,6 +206,15 @@ static int ima_update_kexec_buffer(struct notifier_block *self,
>>>>               return ret;
>>>>       }
>>>>    
>>>> +    buf_size = ima_get_binary_runtime_size();
>>>> +    scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
>>>> +              "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;",
>>>> +              kexec_segment_size, buf_size);
>>>> +
>>>> +    ima_measure_critical_data("ima_kexec", "kexec_execute",
>>>> +                              ima_kexec_event, strlen(ima_kexec_event),
>>>> +                              false, NULL, 0);
>>>> +
>>>
>>> Please consider including the number of measurement records as well.
>> Will do. I think that would be valuable information.
>>
>> Per my understanding, I will have to use the function
>> ima_show_measurements_count() or ima_show_htable_value() to get the
>> number of measurement records value[1]. So I will have to expose that
>> function from "ima_fs.c" to "ima_kexec.c". Hope that's ok.
>>
>> [1]
>> https://elixir.bootlin.com/linux/latest/sourcesecurity/integrity/ima/ima_fs.c
>>
>>
>> static ssize_t ima_show_measurements_count(struct file *filp,
>>                                            char __user *buf,
>>                                            size_t count, loff_t *ppos)
>> {
>>           return ima_show_htable_value(buf, count, ppos, &ima_htable.len);
> 
> I don't see a need to expose this function.  ima_htable is defined in ima.h.
> You can read the ima_htable.len directly, as ima_show_htable_value does.
> 
Agreed. Thanks for the pointer.
That's what I concluded too when I was implementing this change.
I will use ima_htable.len directly.

~Tushar