On Thu, 2025-04-10 at 11:49 -0700, steven chen wrote: > On 4/10/2025 11:04 AM, Mimi Zohar wrote: > > On Thu, 2025-04-10 at 09:59 -0700, steven chen wrote: > > > On 4/10/2025 2:54 AM, Baoquan He wrote: > > > > On 04/02/25 at 05:47am, steven chen wrote: > > > > > The extra memory allocated for carrying the IMA measurement list > > > > > across > > > > > kexec is hard-coded as half a PAGE. Make it configurable. > > > > > > > > > > Define a Kconfig option, IMA_KEXEC_EXTRA_MEMORY_KB, to configure the > > > > > extra memory (in kb) to be allocated for IMA measurements added during > > > > > kexec soft reboot. Ensure the default value of the option is set such > > > > > that extra half a page of memory for additional measurements is > > > > > allocated > > > > > for the additional measurements. > > > > > > > > > > Update ima_add_kexec_buffer() function to allocate memory based on the > > > > > Kconfig option value, rather than the currently hard-coded one. > > > > > > > > > > Suggested-by: Stefan Berger <stef...@linux.ibm.com> > > > > > Signed-off-by: Tushar Sugandhi <tusha...@linux.microsoft.com> > > > > > Signed-off-by: steven chen <chen...@linux.microsoft.com> > > > > > Reviewed-by: Stefan Berger <stef...@linux.ibm.com> > > > > > Reviewed-by: Mimi Zohar <zo...@linux.ibm.com> > > > > > --- > > > > > security/integrity/ima/Kconfig | 10 ++++++++++ > > > > > security/integrity/ima/ima_kexec.c | 16 +++++++++++----- > > > > > 2 files changed, 21 insertions(+), 5 deletions(-) > > > > > > > > > > diff --git a/security/integrity/ima/Kconfig > > > > > b/security/integrity/ima/Kconfig > > > > > index 475c32615006..d73c96c3c1c9 100644 > > > > > --- a/security/integrity/ima/Kconfig > > > > > +++ b/security/integrity/ima/Kconfig > > > > > @@ -321,4 +321,14 @@ config IMA_DISABLE_HTABLE > > > > > help > > > > > This option disables htable to allow measurement of > > > > > duplicate records. > > > > > > > > > > +config IMA_KEXEC_EXTRA_MEMORY_KB > > > > > + int "Extra memory for IMA measurements added during kexec soft > > > > > reboot" > > > > > + depends on IMA_KEXEC > > > > > + default 0 > > > > Usually a new Kconfig item which accepts a range should define the range > > > > boundary, otherwise it's not clear to people how large or how small it > > > > can be set. For example, can I set it as value of 1<<40? We should at > > > > least estimate a possible upper limit for it for other people's > > > > reference. My personal opinion. > > > Hi Baoquan, > > > > > > How about I set range 2-40? Default set as 2, same as the fixed setting. > > 0, the current default, sets the "extra" memory to the existing "extra half > > a > > page of memory for the additional measurements". For backwards > > compatibility, > > please do not change this. > > > > The requirement for a larger "extra" measurement is coming from Microsoft. > > If > > this isn't any longer a requirement, we could drop this patch. Lakshmi, do > > you > > have any thoughts on this? > > How about the range set as 0-40 and the default as 0? > > We (Microsoft) are ok with 0 as the default.
Thanks, fine. > > Thanks > > > > > The rest looks good to me. > > > > > > > > > > > > > + help > > > > > + IMA_KEXEC_EXTRA_MEMORY_KB determines the extra memory to be > > > > > + allocated (in kb) for IMA measurements added during kexec > > > > > soft reboot. > > > > > + If set to the default value of 0, an extra half page of > > > > > memory for those > > > > > + additional measurements will be allocated. > > > > > + > > > > > endif > > > > ...snip... > > > > > > > >
