mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
synced 2025-08-27 06:50:37 +00:00
f18e502db6
The IMA log is currently copied to the new kernel during kexec 'load' using ima_dump_measurement_list(). However, the log copied at kexec 'load' may result in loss of IMA measurements that only occurred after kexec "load'. Setup the needed infrastructure to move the IMA log copy from kexec 'load' to 'execute'. Define a new IMA hook ima_update_kexec_buffer() as a stub function. It will be used to call ima_dump_measurement_list() during kexec 'execute'. Implement ima_kexec_post_load() function to be invoked after the new Kernel image has been loaded for kexec. ima_kexec_post_load() maps the IMA buffer to a segment in the newly loaded Kernel. It also registers the reboot notifier_block to trigger ima_update_kexec_buffer() at kexec 'execute'. Set the priority of register_reboot_notifier to INT_MIN to ensure that the IMA log copy operation will happen at the end of the operation chain, so that all the IMA measurement records extended into the TPM are copied Co-developed-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com> Cc: Eric Biederman <ebiederm@xmission.com> Cc: Baoquan He <bhe@redhat.com> Cc: Vivek Goyal <vgoyal@redhat.com> Cc: Dave Young <dyoung@redhat.com> Signed-off-by: Steven Chen <chenste@linux.microsoft.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Acked-by: Baoquan He <bhe@redhat.com> Tested-by: Stefan Berger <stefanb@linux.ibm.com> # ppc64/kvm Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
114 lines
2.8 KiB
C
114 lines
2.8 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright (C) 2008 IBM Corporation
|
|
* Author: Mimi Zohar <zohar@us.ibm.com>
|
|
*/
|
|
|
|
#ifndef _LINUX_IMA_H
|
|
#define _LINUX_IMA_H
|
|
|
|
#include <linux/kernel_read_file.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/security.h>
|
|
#include <linux/kexec.h>
|
|
#include <crypto/hash_info.h>
|
|
struct linux_binprm;
|
|
|
|
#ifdef CONFIG_IMA
|
|
extern enum hash_algo ima_get_current_hash_algo(void);
|
|
extern int ima_file_hash(struct file *file, char *buf, size_t buf_size);
|
|
extern int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size);
|
|
extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size);
|
|
extern int ima_measure_critical_data(const char *event_label,
|
|
const char *event_name,
|
|
const void *buf, size_t buf_len,
|
|
bool hash, u8 *digest, size_t digest_len);
|
|
|
|
#ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
|
|
extern void ima_appraise_parse_cmdline(void);
|
|
#else
|
|
static inline void ima_appraise_parse_cmdline(void) {}
|
|
#endif
|
|
|
|
#ifdef CONFIG_IMA_KEXEC
|
|
extern void ima_add_kexec_buffer(struct kimage *image);
|
|
extern void ima_kexec_post_load(struct kimage *image);
|
|
#else
|
|
static inline void ima_kexec_post_load(struct kimage *image) {}
|
|
#endif
|
|
|
|
#else
|
|
static inline enum hash_algo ima_get_current_hash_algo(void)
|
|
{
|
|
return HASH_ALGO__LAST;
|
|
}
|
|
|
|
static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {}
|
|
|
|
static inline int ima_measure_critical_data(const char *event_label,
|
|
const char *event_name,
|
|
const void *buf, size_t buf_len,
|
|
bool hash, u8 *digest,
|
|
size_t digest_len)
|
|
{
|
|
return -ENOENT;
|
|
}
|
|
|
|
#endif /* CONFIG_IMA */
|
|
|
|
#ifdef CONFIG_HAVE_IMA_KEXEC
|
|
int __init ima_free_kexec_buffer(void);
|
|
int __init ima_get_kexec_buffer(void **addr, size_t *size);
|
|
#endif
|
|
|
|
#ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
|
|
extern bool arch_ima_get_secureboot(void);
|
|
extern const char * const *arch_get_ima_policy(void);
|
|
#else
|
|
static inline bool arch_ima_get_secureboot(void)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline const char * const *arch_get_ima_policy(void)
|
|
{
|
|
return NULL;
|
|
}
|
|
#endif
|
|
|
|
#ifndef CONFIG_IMA_KEXEC
|
|
struct kimage;
|
|
|
|
static inline void ima_add_kexec_buffer(struct kimage *image)
|
|
{}
|
|
#endif
|
|
|
|
#ifdef CONFIG_IMA_APPRAISE
|
|
extern bool is_ima_appraise_enabled(void);
|
|
#else
|
|
static inline bool is_ima_appraise_enabled(void)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif /* CONFIG_IMA_APPRAISE */
|
|
|
|
#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)
|
|
extern bool ima_appraise_signature(enum kernel_read_file_id func);
|
|
#else
|
|
static inline bool ima_appraise_signature(enum kernel_read_file_id func)
|
|
{
|
|
return false;
|
|
}
|
|
#endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */
|
|
#endif /* _LINUX_IMA_H */
|