summaryrefslogtreecommitdiff
path: root/security/integrity
diff options
context:
space:
mode:
authorJonathan McDowell <noodles@fb.com>2022-06-30 11:36:12 +0300
committerBorislav Petkov <bp@suse.de>2022-07-01 16:22:16 +0300
commitb69a2afd5afce9bf6d56e349d6ab592c916e20f2 (patch)
tree3406ca4a696ef1e6e3eab66a446ae5dfb56f1c73 /security/integrity
parent03c765b0e3b4cb5063276b086c76f7a612856a9a (diff)
downloadlinux-b69a2afd5afce9bf6d56e349d6ab592c916e20f2.tar.xz
x86/kexec: Carry forward IMA measurement log on kexec
On kexec file load, the Integrity Measurement Architecture (IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify a TPM quote based on the TPM event log, the IMA measurement list and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call. PowerPC and ARM64 both achieve this using device tree with a "linux,ima-kexec-buffer" node. x86 platforms generally don't make use of device tree, so use the setup_data mechanism to pass the IMA buffer to the new kernel. Signed-off-by: Jonathan McDowell <noodles@fb.com> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> # IMA function definitions Link: https://lore.kernel.org/r/YmKyvlF3my1yWTvK@noodles-fedora-PC23Y6EG
Diffstat (limited to 'security/integrity')
-rw-r--r--security/integrity/ima/ima_kexec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
index 13753136f03f..419dc405c831 100644
--- a/security/integrity/ima/ima_kexec.c
+++ b/security/integrity/ima/ima_kexec.c
@@ -137,7 +137,7 @@ void ima_add_kexec_buffer(struct kimage *image)
/*
* Restore the measurement list from the previous kernel.
*/
-void ima_load_kexec_buffer(void)
+void __init ima_load_kexec_buffer(void)
{
void *kexec_buffer = NULL;
size_t kexec_buffer_size = 0;