Messages in this thread | | | Date | Fri, 12 Aug 2022 13:14:38 -0400 | Subject | Re: [PATCH v7 3/6] x86/kexec: Carry forward IMA measurement log on kexec | From | Stefan Berger <> |
| |
On 8/12/22 13:10, Borislav Petkov wrote: > On Fri, Aug 12, 2022 at 12:43:02PM -0400, Stefan Berger wrote: >> From: Jonathan McDowell <noodles@fb.com> >> >> On kexec file load, the Integrity Measurement Architecture (IMA) >> subsystem may verify the IMA signature of the kernel and initramfs, and >> measure it. The command line parameters passed to the kernel in the >> kexec call may also be measured by IMA. >> >> A remote attestation service can verify a TPM quote based on the TPM >> event log, the IMA measurement list and the TPM PCR data. This can >> be achieved only if the IMA measurement log is carried over from the >> current kernel to the next kernel across the kexec call. >> >> PowerPC and ARM64 both achieve this using device tree with a >> "linux,ima-kexec-buffer" node. x86 platforms generally don't make use of >> device tree, so use the setup_data mechanism to pass the IMA buffer to >> the new kernel. >> >> Signed-off-by: Jonathan McDowell <noodles@fb.com> >> Signed-off-by: Borislav Petkov <bp@suse.de> >> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> # IMA function definitions >> Link: https://lore.kernel.org/r/YmKyvlF3my1yWTvK@noodles-fedora-PC23Y6EG > > Is there any particular reason to keep sending a patch which is already > upstream? >
Yes, so this series can be tested by krobot. I only based this series on 5.19 so far, so if it's upstreamed since then it will go missing next time when I base it on 5.20-rc1 or so.
| |