n kexec file load Integrgity Measurement Architecture(IMA) subsystem
may verify the IMA signature of the kernel and initramfs, and measure
it. The command line parameters passed to the kernel in the kexec call
may also be measured by IMA. A remote attestation service can verify
the measurement through the IMA log and the TPM PCR data. This can be
achieved only if the IMA measurement log is carried over from
the current kernel to the next kernel across the kexec call.
However in the current implementation the IMA measurement logs are not
carried over on ARM64 platforms. Therefore a remote attestation service
cannot verify the authenticity of the running kernel on ARM64 platforms
when the kernel is updated through the kexec system call.
This patch series adds support for carrying forward the IMA measurement
log on kexec on ARM64. powerpc already supports carrying forward
the IMA measurement log on kexec.
This series refactors the platform independent code such that it can be
reused for ARM64 as well. A chosen node namely
"linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
the address and the size of the memory reserved to carry
the IMA measurement log.
This patch series has been tested for ARM64 platform using QEMU.
I would like help from the community for testing this change on powerpc.
Thanks.
This series is based on commit b51594df17d0 ("Merge tag 'docs-5.9-3' of
git://git.lwn.net/linux") in https://github.com/torvalds/linux
"master" branch.
Changelog:
v5:
- Merged get_addr_size_cells() and do_get_kexec_buffer() into a single
function when moving the arch independent code from powerpc to IMA
- Reverted the change to use FDT functions in powerpc code and added
back the original code in get_addr_size_cells() and
do_get_kexec_buffer() for powerpc.
- Added fdt_add_mem_rsv() for ARM64 to reserve the memory for
the IMA log buffer during kexec.
- Fixed the warning reported by kernel test bot for ARM64
arch_ima_add_kexec_buffer() - moved this function to a new file
namely arch/arm64/kernel/ima_kexec.c
v4:
- Submitting the patch series on behalf of the original author
Prakhar Srivastava <[email protected]>
- Moved FDT_PROP_IMA_KEXEC_BUFFER ("linux,ima-kexec-buffer") to
libfdt.h so that it can be shared by multiple platforms.
v3:
Breakup patches further into separate patches.
- Refactoring non architecture specific code out of powerpc
- Update powerpc related code to use fdt functions
- Update IMA buffer read related code to use of functions
- Add support to store the memory information of the IMA
measurement logs to be carried forward.
- Update the property strings to align with documented nodes
https://github.com/devicetree-org/dt-schema/pull/46
v2:
Break patches into separate patches.
- Powerpc related Refactoring
- Updating the docuemntation for chosen node
- Updating arm64 to support IMA buffer pass
v1:
Refactoring carrying over IMA measuremnet logs over Kexec. This patch
moves the non-architecture specific code out of powerpc and adds to
security/ima.(Suggested by Thiago)
Add Documentation regarding the ima-kexec-buffer node in the chosen
node documentation
v0:
Add a layer of abstraction to use the memory reserved by device tree
for ima buffer pass.
Add support for ima buffer pass using reserved memory for arm64 kexec.
Update the arch sepcific code path in kexec file load to store the
ima buffer in the reserved memory. The same reserved memory is read
on kexec or cold boot.
Lakshmi Ramasubramanian (3):
powerpc: Refactor kexec functions to move arch independent code to IMA
arm64: Store IMA log information in kimage used for kexec
arm64: Add IMA kexec buffer to DTB
arch/arm64/Kconfig | 1 +
arch/arm64/include/asm/ima.h | 18 ++++++
arch/arm64/include/asm/kexec.h | 3 +
arch/arm64/kernel/Makefile | 1 +
arch/arm64/kernel/ima_kexec.c | 34 +++++++++++
arch/arm64/kernel/machine_kexec_file.c | 15 +++++
arch/powerpc/include/asm/ima.h | 3 -
arch/powerpc/kexec/ima.c | 60 +------------------
include/linux/libfdt.h | 3 +
security/integrity/ima/ima_kexec.c | 82 ++++++++++++++++++++++++++
10 files changed, 160 insertions(+), 60 deletions(-)
create mode 100644 arch/arm64/include/asm/ima.h
create mode 100644 arch/arm64/kernel/ima_kexec.c
--
2.28.0
The functions ima_get_kexec_buffer() and ima_free_kexec_buffer() that
handle carrying forward the IMA measurement logs on kexec for powerpc
do not have architecture specific code, but they are currently defined
for powerpc only.
Move these functions to IMA subsystem so that it can be used for other
architectures as well. A later patch in this series will use these
functions for carrying forward the IMA measurement log for ARM64.
Define FDT_PROP_IMA_KEXEC_BUFFER for the chosen node, namely
"linux,ima-kexec-buffer", that is added to the DTB to hold
the address and the size of the memory reserved to carry
the IMA measurement log.
Co-developed-by: Prakhar Srivastava <[email protected]>
Signed-off-by: Prakhar Srivastava <[email protected]>
Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
---
arch/powerpc/include/asm/ima.h | 3 --
arch/powerpc/kexec/ima.c | 60 ++--------------------
include/linux/libfdt.h | 3 ++
security/integrity/ima/ima_kexec.c | 82 ++++++++++++++++++++++++++++++
4 files changed, 88 insertions(+), 60 deletions(-)
diff --git a/arch/powerpc/include/asm/ima.h b/arch/powerpc/include/asm/ima.h
index ead488cf3981..bc27fd94de52 100644
--- a/arch/powerpc/include/asm/ima.h
+++ b/arch/powerpc/include/asm/ima.h
@@ -4,9 +4,6 @@
struct kimage;
-int ima_get_kexec_buffer(void **addr, size_t *size);
-int ima_free_kexec_buffer(void);
-
#ifdef CONFIG_IMA
void remove_ima_buffer(void *fdt, int chosen_node);
#else
diff --git a/arch/powerpc/kexec/ima.c b/arch/powerpc/kexec/ima.c
index 720e50e490b6..f5112ee4bb0b 100644
--- a/arch/powerpc/kexec/ima.c
+++ b/arch/powerpc/kexec/ima.c
@@ -46,60 +46,6 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr,
return 0;
}
-/**
- * ima_get_kexec_buffer - get IMA buffer from the previous kernel
- * @addr: On successful return, set to point to the buffer contents.
- * @size: On successful return, set to the buffer size.
- *
- * Return: 0 on success, negative errno on error.
- */
-int ima_get_kexec_buffer(void **addr, size_t *size)
-{
- int ret, len;
- unsigned long tmp_addr;
- size_t tmp_size;
- const void *prop;
-
- prop = of_get_property(of_chosen, "linux,ima-kexec-buffer", &len);
- if (!prop)
- return -ENOENT;
-
- ret = do_get_kexec_buffer(prop, len, &tmp_addr, &tmp_size);
- if (ret)
- return ret;
-
- *addr = __va(tmp_addr);
- *size = tmp_size;
-
- return 0;
-}
-
-/**
- * ima_free_kexec_buffer - free memory used by the IMA buffer
- */
-int ima_free_kexec_buffer(void)
-{
- int ret;
- unsigned long addr;
- size_t size;
- struct property *prop;
-
- prop = of_find_property(of_chosen, "linux,ima-kexec-buffer", NULL);
- if (!prop)
- return -ENOENT;
-
- ret = do_get_kexec_buffer(prop->value, prop->length, &addr, &size);
- if (ret)
- return ret;
-
- ret = of_remove_property(of_chosen, prop);
- if (ret)
- return ret;
-
- return memblock_free(addr, size);
-
-}
-
/**
* remove_ima_buffer - remove the IMA buffer property and reservation from @fdt
*
@@ -113,12 +59,12 @@ void remove_ima_buffer(void *fdt, int chosen_node)
size_t size;
const void *prop;
- prop = fdt_getprop(fdt, chosen_node, "linux,ima-kexec-buffer", &len);
+ prop = fdt_getprop(fdt, chosen_node, FDT_PROP_IMA_KEXEC_BUFFER, &len);
if (!prop)
return;
ret = do_get_kexec_buffer(prop, len, &addr, &size);
- fdt_delprop(fdt, chosen_node, "linux,ima-kexec-buffer");
+ fdt_delprop(fdt, chosen_node, FDT_PROP_IMA_KEXEC_BUFFER);
if (ret)
return;
@@ -201,7 +147,7 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node)
if (ret)
return ret;
- ret = fdt_setprop(fdt, chosen_node, "linux,ima-kexec-buffer", value,
+ ret = fdt_setprop(fdt, chosen_node, FDT_PROP_IMA_KEXEC_BUFFER, value,
entry_size);
if (ret < 0)
return -EINVAL;
diff --git a/include/linux/libfdt.h b/include/linux/libfdt.h
index 90ed4ebfa692..75fb40aa013b 100644
--- a/include/linux/libfdt.h
+++ b/include/linux/libfdt.h
@@ -5,4 +5,7 @@
#include <linux/libfdt_env.h>
#include "../../scripts/dtc/libfdt/libfdt.h"
+/* Common device tree properties */
+#define FDT_PROP_IMA_KEXEC_BUFFER "linux,ima-kexec-buffer"
+
#endif /* _INCLUDE_LIBFDT_H_ */
diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
index 121de3e04af2..d092285446c2 100644
--- a/security/integrity/ima/ima_kexec.c
+++ b/security/integrity/ima/ima_kexec.c
@@ -10,8 +10,90 @@
#include <linux/seq_file.h>
#include <linux/vmalloc.h>
#include <linux/kexec.h>
+#include <linux/of.h>
+#include <linux/memblock.h>
+#include <linux/libfdt.h>
+#include <linux/ima.h>
#include "ima.h"
+static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr,
+ size_t *size)
+{
+ int addr_cells, size_cells;
+ struct device_node *root;
+
+ root = of_find_node_by_path("/");
+ if (!root)
+ return -EINVAL;
+
+ addr_cells = of_n_addr_cells(root);
+ size_cells = of_n_size_cells(root);
+
+ of_node_put(root);
+
+ if (len < 4 * (addr_cells + size_cells))
+ return -ENOENT;
+
+ *addr = of_read_number(prop, addr_cells);
+ *size = of_read_number(prop + 4 * addr_cells, size_cells);
+
+ return 0;
+}
+
+/**
+ * ima_get_kexec_buffer - get IMA buffer from the previous kernel
+ * @addr: On successful return, set to point to the buffer contents.
+ * @size: On successful return, set to the buffer size.
+ *
+ * Return: 0 on success, negative errno on error.
+ */
+static int ima_get_kexec_buffer(void **addr, size_t *size)
+{
+ int ret, len;
+ unsigned long tmp_addr;
+ size_t tmp_size;
+ const void *prop;
+
+ prop = of_get_property(of_chosen, FDT_PROP_IMA_KEXEC_BUFFER, &len);
+ if (!prop)
+ return -ENOENT;
+
+ ret = do_get_kexec_buffer(prop, len, &tmp_addr, &tmp_size);
+ if (ret)
+ return ret;
+
+ *addr = __va(tmp_addr);
+ *size = tmp_size;
+
+ return 0;
+}
+
+/**
+ * ima_free_kexec_buffer - free memory used by the IMA buffer
+ */
+static int ima_free_kexec_buffer(void)
+{
+ int ret;
+ unsigned long addr;
+ size_t size;
+ struct property *prop;
+
+ prop = of_find_property(of_chosen, FDT_PROP_IMA_KEXEC_BUFFER, NULL);
+ if (!prop)
+ return -ENOENT;
+
+ ret = do_get_kexec_buffer(prop->value, prop->length, &addr, &size);
+ if (ret)
+ return ret;
+
+ ret = of_remove_property(of_chosen, prop);
+ if (ret)
+ return ret;
+
+ return memblock_free(addr, size);
+
+}
+
#ifdef CONFIG_IMA_KEXEC
static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
unsigned long segment_size)
--
2.28.0
The address and size of the current kernel's IMA measurement log
need to be added to the device tree's IMA kexec buffer node for
the log to be carried over to the next kernel on the kexec call.
Add the IMA measurement log buffer properties to the device tree for
ARM64 and reserve the memory for storing the IMA log.
Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to
indicate that the IMA measurement log information is present in
the device tree.
Co-developed-by: Prakhar Srivastava <[email protected]>
Signed-off-by: Prakhar Srivastava <[email protected]>
Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
---
arch/arm64/Kconfig | 1 +
arch/arm64/kernel/machine_kexec_file.c | 15 +++++++++++++++
2 files changed, 16 insertions(+)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 6d232837cbee..9f03c8245e5b 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1077,6 +1077,7 @@ config KEXEC
config KEXEC_FILE
bool "kexec file based system call"
select KEXEC_CORE
+ select HAVE_IMA_KEXEC
help
This is new version of kexec system call. This system call is
file based and takes file descriptors as system call argument
diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
index 361a1143e09e..0fe3d629eefe 100644
--- a/arch/arm64/kernel/machine_kexec_file.c
+++ b/arch/arm64/kernel/machine_kexec_file.c
@@ -136,6 +136,21 @@ static int setup_dtb(struct kimage *image,
FDT_PROP_KASLR_SEED);
}
+ /* add ima-kexec-buffer */
+ if (image->arch.ima_buffer_size > 0) {
+ ret = fdt_appendprop_addrrange(dtb, 0, off,
+ FDT_PROP_IMA_KEXEC_BUFFER,
+ image->arch.ima_buffer_addr,
+ image->arch.ima_buffer_size);
+ if (ret)
+ return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL);
+
+ ret = fdt_add_mem_rsv(dtb, image->arch.ima_buffer_addr,
+ image->arch.ima_buffer_size);
+ if (ret)
+ goto out;
+ }
+
/* add rng-seed */
if (rng_is_initialized()) {
void *rng_seed;
--
2.28.0
Lakshmi Ramasubramanian <[email protected]> writes:
> The functions ima_get_kexec_buffer() and ima_free_kexec_buffer() that
> handle carrying forward the IMA measurement logs on kexec for powerpc
> do not have architecture specific code, but they are currently defined
> for powerpc only.
>
> Move these functions to IMA subsystem so that it can be used for other
> architectures as well. A later patch in this series will use these
> functions for carrying forward the IMA measurement log for ARM64.
>
> Define FDT_PROP_IMA_KEXEC_BUFFER for the chosen node, namely
> "linux,ima-kexec-buffer", that is added to the DTB to hold
> the address and the size of the memory reserved to carry
> the IMA measurement log.
>
> Co-developed-by: Prakhar Srivastava <[email protected]>
> Signed-off-by: Prakhar Srivastava <[email protected]>
> Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
do_get_kexec_buffer() is still duplicated in generic code and powerpc
code. It's a small and simple function though, so not really a problem.
I think you'll need to move over remove_ima_buffer() if you agree with
the comment I'll make on patch 3, in which case the powerpc-specific
do_get_kexec_buffer() can be removed.
Reviewed-by: Thiago Jung Bauermann <[email protected]>
--
Thiago Jung Bauermann
IBM Linux Technology Center
Lakshmi Ramasubramanian <[email protected]> writes:
> The address and size of the current kernel's IMA measurement log
> need to be added to the device tree's IMA kexec buffer node for
> the log to be carried over to the next kernel on the kexec call.
>
> Add the IMA measurement log buffer properties to the device tree for
> ARM64 and reserve the memory for storing the IMA log.
> Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to
> indicate that the IMA measurement log information is present in
> the device tree.
>
> Co-developed-by: Prakhar Srivastava <[email protected]>
> Signed-off-by: Prakhar Srivastava <[email protected]>
> Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
> ---
> arch/arm64/Kconfig | 1 +
> arch/arm64/kernel/machine_kexec_file.c | 15 +++++++++++++++
> 2 files changed, 16 insertions(+)
>
> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index 6d232837cbee..9f03c8245e5b 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -1077,6 +1077,7 @@ config KEXEC
> config KEXEC_FILE
> bool "kexec file based system call"
> select KEXEC_CORE
> + select HAVE_IMA_KEXEC
> help
> This is new version of kexec system call. This system call is
> file based and takes file descriptors as system call argument
> diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
> index 361a1143e09e..0fe3d629eefe 100644
> --- a/arch/arm64/kernel/machine_kexec_file.c
> +++ b/arch/arm64/kernel/machine_kexec_file.c
> @@ -136,6 +136,21 @@ static int setup_dtb(struct kimage *image,
> FDT_PROP_KASLR_SEED);
> }
>
> + /* add ima-kexec-buffer */
> + if (image->arch.ima_buffer_size > 0) {
> + ret = fdt_appendprop_addrrange(dtb, 0, off,
> + FDT_PROP_IMA_KEXEC_BUFFER,
> + image->arch.ima_buffer_addr,
> + image->arch.ima_buffer_size);
> + if (ret)
> + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL);
> +
> + ret = fdt_add_mem_rsv(dtb, image->arch.ima_buffer_addr,
> + image->arch.ima_buffer_size);
> + if (ret)
> + goto out;
> + }
> +
> /* add rng-seed */
> if (rng_is_initialized()) {
> void *rng_seed;
I just noticed one more thing this code isn't doing compared to the
powerpc version (sorry to bring these issues piecemeal, I didn't realize
this before):
You're not checking whether there already is a device tree property and
corresponding memory reservation for an IMA kexec buffer that the
currently running kernel might have received from a previous kernel. In
that case, this code will do the wrong thing because
fdt_appendprop_addrrange() will append the range to the existing
property, which is not what you want. You'll also have a memory
reservation entry for a stale IMA kexec buffer, which just wastes
memory.
So one thing you need to do, whether or not there's an IMA kexec buffer
to be passed to the next kernel, is to remove any existing
FDT_PROP_IMA_KEXEC_BUFFER property and also its corresponding memory
reservation, so that you avoid accumulating stale memory reservations
for non-existing IMA kexec buffers from previous kexecs.
--
Thiago Jung Bauermann
IBM Linux Technology Center
On 9/3/20 3:11 PM, Thiago Jung Bauermann wrote:
>
> Lakshmi Ramasubramanian <[email protected]> writes:
>
>> The address and size of the current kernel's IMA measurement log
>> need to be added to the device tree's IMA kexec buffer node for
>> the log to be carried over to the next kernel on the kexec call.
>>
>> Add the IMA measurement log buffer properties to the device tree for
>> ARM64 and reserve the memory for storing the IMA log.
>> Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to
>> indicate that the IMA measurement log information is present in
>> the device tree.
>>
>> Co-developed-by: Prakhar Srivastava <[email protected]>
>> Signed-off-by: Prakhar Srivastava <[email protected]>
>> Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
>> ---
>> arch/arm64/Kconfig | 1 +
>> arch/arm64/kernel/machine_kexec_file.c | 15 +++++++++++++++
>> 2 files changed, 16 insertions(+)
>>
>> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
>> index 6d232837cbee..9f03c8245e5b 100644
>> --- a/arch/arm64/Kconfig
>> +++ b/arch/arm64/Kconfig
>> @@ -1077,6 +1077,7 @@ config KEXEC
>> config KEXEC_FILE
>> bool "kexec file based system call"
>> select KEXEC_CORE
>> + select HAVE_IMA_KEXEC
>> help
>> This is new version of kexec system call. This system call is
>> file based and takes file descriptors as system call argument
>> diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
>> index 361a1143e09e..0fe3d629eefe 100644
>> --- a/arch/arm64/kernel/machine_kexec_file.c
>> +++ b/arch/arm64/kernel/machine_kexec_file.c
>> @@ -136,6 +136,21 @@ static int setup_dtb(struct kimage *image,
>> FDT_PROP_KASLR_SEED);
>> }
>>
>> + /* add ima-kexec-buffer */
>> + if (image->arch.ima_buffer_size > 0) {
>> + ret = fdt_appendprop_addrrange(dtb, 0, off,
>> + FDT_PROP_IMA_KEXEC_BUFFER,
>> + image->arch.ima_buffer_addr,
>> + image->arch.ima_buffer_size);
>> + if (ret)
>> + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL);
>> +
>> + ret = fdt_add_mem_rsv(dtb, image->arch.ima_buffer_addr,
>> + image->arch.ima_buffer_size);
>> + if (ret)
>> + goto out;
>> + }
>> +
>> /* add rng-seed */
>> if (rng_is_initialized()) {
>> void *rng_seed;
>
> I just noticed one more thing this code isn't doing compared to the
> powerpc version (sorry to bring these issues piecemeal, I didn't realize
> this before):
>
> You're not checking whether there already is a device tree property and
> corresponding memory reservation for an IMA kexec buffer that the
> currently running kernel might have received from a previous kernel. In
> that case, this code will do the wrong thing because
> fdt_appendprop_addrrange() will append the range to the existing
> property, which is not what you want. You'll also have a memory
> reservation entry for a stale IMA kexec buffer, which just wastes
> memory.
>
> So one thing you need to do, whether or not there's an IMA kexec buffer
> to be passed to the next kernel, is to remove any existing
> FDT_PROP_IMA_KEXEC_BUFFER property and also its corresponding memory
> reservation, so that you avoid accumulating stale memory reservations
> for non-existing IMA kexec buffers from previous kexecs.
>
That's good catch Thiago. Thanks for the feedback. I'll make this change
and update.
thanks,
-lakshmi