With this "[RFC PATCH v3 0/4] Fix IMA + TPM initialisation ordering issue" patch set, how many records would be missing if IMA initialization is deferred to late_initcall_sync [1]?
[1]https://lore.kernel.org/linux-integrity/[email protected]/ --- Jonathan, Yeoreum, others - By going into TPM-bypass mode, we can see how many measurements are actually missing when deferring IMA initialization to late_initcall_sync. As this is system/TPM dependent, I'd appreciate your checking. Please use the boot command line option "ima_policy=tcb|critical_data". thanks, Mimi security/integrity/ima/ima.h | 1 + security/integrity/ima/ima_init.c | 6 ++++++ security/integrity/ima/ima_main.c | 19 +++++++++++++++++++ 3 files changed, 26 insertions(+) diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 01aae19ed365..9a1117112fb2 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -286,6 +286,7 @@ extern bool ima_canonical_fmt; /* Internal IMA function definitions */ int ima_init_core(bool late); +int ima_init_debug(bool late); int ima_fs_init(void); int ima_add_template_entry(struct ima_template_entry *entry, int violation, const char *op, struct inode *inode, diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c index 5f335834a9bb..edd063b99685 100644 --- a/security/integrity/ima/ima_init.c +++ b/security/integrity/ima/ima_init.c @@ -122,6 +122,12 @@ void __init ima_load_x509(void) } #endif +int __init ima_init_debug(bool late) +{ + ima_add_boot_aggregate(late); /* just add an additional record */ + return 0; +} + int __init ima_init_core(bool late) { int rc; diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 42099bfe7e43..23e669be54fc 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -1254,6 +1254,7 @@ static int ima_kernel_module_request(char *kmod_name) #endif /* CONFIG_INTEGRITY_ASYMMETRIC_KEYS */ +#define TESTING 1 static int __init init_ima(bool late) { int error; @@ -1264,6 +1265,23 @@ static int __init init_ima(bool late) return 0; } +#ifdef TESTING + /* + * Initialize early, even if it means going into TPM-bypass mode, + * but add an additional boot_aggregrate message for the + * late_initcall_sync. + * + * If measurement list records exist between the boot_aggregate + * and the boot_aggregate_late records, these records would be + * missing when IMA initializion is deferred to late_initcall_sync. + */ + if (ima_tpm_chip) { + ima_init_debug(late); /* Add an additional record */ + return 0; + } + + ima_tpm_chip = tpm_default_chip(); +#elif /* * If we found the TPM during our first attempt, or we know there's no * TPM, nothing further to do @@ -1276,6 +1294,7 @@ static int __init init_ima(bool late) pr_debug("TPM not available, will try later\n"); return -EPROBE_DEFER; } +#endif if (!ima_tpm_chip) pr_info("No TPM chip found, activating TPM-bypass!\n"); -- 2.53.0
