lkml.org 
[lkml]   [2022]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v4] x86/kexec: Carry forward IMA measurement log on kexec
    From
    Date
    On Thu, 2022-05-12 at 16:25 +0000, Jonathan McDowell wrote:
    > On kexec file load Integrity Measurement Architecture (IMA) subsystem
    > may verify the IMA signature of the kernel and initramfs, and measure
    > it. The command line parameters passed to the kernel in the kexec call
    > may also be measured by IMA. A remote attestation service can verify
    > a TPM quote based on the TPM event log, the IMA measurement list, and
    > the TPM PCR data. This can be achieved only if the IMA measurement log
    > is carried over from the current kernel to the next kernel across
    > the kexec call.
    >
    > powerpc and ARM64 both achieve this using device tree with a
    > "linux,ima-kexec-buffer" node. x86 platforms generally don't make use of
    > device tree, so use the setup_data mechanism to pass the IMA buffer to
    > the new kernel.
    >
    > Signed-off-by: Jonathan McDowell <noodles@fb.com>

    Not from using "setup_data" perspective,

    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> # IMA function
    definitions

    thanks,

    Mimi

    \
     
     \ /
      Last update: 2022-05-18 16:45    [W:4.577 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site