Messages in this thread | | | Subject | Re: [PATCH v8 0/4] Carry forward IMA measurement log on kexec on ARM64 | From | Lakshmi Ramasubramanian <> | Date | Tue, 3 Nov 2020 11:26:45 -0800 |
| |
On 11/3/20 7:18 AM, Mimi Zohar wrote:
Hi Mimi,
> On Fri, 2020-10-30 at 10:44 -0700, Lakshmi Ramasubramanian wrote: >> On kexec file load Integrity Measurement Architecture (IMA) subsystem >> may verify the IMA signature of the kernel and initramfs, and measure >> it. The command line parameters passed to the kernel in the kexec call >> may also be measured by IMA. A remote attestation service can verify >> the measurement through the IMA log and the TPM PCR data. This can be >> achieved only if the IMA measurement log is carried over from >> the current kernel to the next kernel across the kexec call. > > Nice, but you might want to tweak it a bit. This is just a suggestion. > "A remote attestation service can verify a TPM quote based on the TPM > event log, the IMA measurement list, and the TPM PCR data". Sure - will make this change.
> >> However in the current implementation the IMA measurement logs are not >> carried over on ARM64 platforms. Therefore a remote attestation service >> cannot verify the authenticity of the running kernel on ARM64 platforms >> when the kernel is updated through the kexec system call. > > The paragraphs above and below are redundant. The first paragraph > already explained why carrying the measurement across kexec is needed. > Perhaps drop the above paragraph. Sure.
> >> This patch series adds support for carrying forward the IMA measurement >> log on kexec on ARM64. powerpc already supports carrying forward >> the IMA measurement log on kexec. > > And invert these sentences, starting the paragraph with "Powerpc > already" and ending with ARM64. Sure.
> >> >> This series refactors the platform independent code defined for powerpc >> such that it can be reused for ARM64 as well. A chosen node namely >> "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold >> the address and the size of the memory reserved to carry >> the IMA measurement log. > > ^This patch set moves ..." Sure - will make this change.
Thanks again for reviewing the patches. Will post the updated patch set shortly.
-lakshmi
| |