security/integrity/ima/ima_kexec.c

Source file repositories/reference/linux-study-clean/security/integrity/ima/ima_kexec.c

File Facts

System
Linux kernel
Corpus path
security/integrity/ima/ima_kexec.c
Extension
.c
Size
8763 bytes
Lines
352
Domain
Core OS
Bucket
Security And Isolation
Inferred role
Core OS: implementation source
Status
source implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

Dependency Surface

Detected Declarations

Annotated Snippet

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * Copyright (C) 2016 IBM Corporation
 *
 * Authors:
 * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
 * Mimi Zohar <zohar@linux.vnet.ibm.com>
 */

#include <linux/seq_file.h>
#include <linux/vmalloc.h>
#include <linux/kexec.h>
#include <linux/of.h>
#include <linux/ima.h>
#include <linux/mm.h>
#include <linux/overflow.h>
#include <linux/reboot.h>
#include <asm/page.h>
#include "ima.h"

#ifdef CONFIG_IMA_KEXEC
#define IMA_KEXEC_EVENT_LEN 256

static bool ima_kexec_update_registered;
static struct seq_file ima_kexec_file;
static size_t kexec_segment_size;
static void *ima_kexec_buffer;

static void ima_free_kexec_file_buf(struct seq_file *sf)
{
	vfree(sf->buf);
	sf->buf = NULL;
	sf->size = 0;
	sf->read_pos = 0;
	sf->count = 0;
}

void ima_measure_kexec_event(const char *event_name)
{
	char ima_kexec_event[IMA_KEXEC_EVENT_LEN];
	size_t buf_size = 0;
	long len;
	int n;

	buf_size = ima_get_binary_runtime_size(BINARY_FULL);
	len = atomic_long_read(&ima_num_records[BINARY_FULL]);

	n = scnprintf(ima_kexec_event, IMA_KEXEC_EVENT_LEN,
		      "kexec_segment_size=%lu;ima_binary_runtime_size=%lu;"
		      "ima_runtime_measurements_count=%ld;",
		      kexec_segment_size, buf_size, len);

	ima_measure_critical_data("ima_kexec", event_name, ima_kexec_event, n, false, NULL, 0);
}

static int ima_alloc_kexec_file_buf(size_t segment_size)
{
	/*
	 * kexec 'load' may be called multiple times.
	 * Free and realloc the buffer only if the segment_size is
	 * changed from the previous kexec 'load' call.
	 */
	if (ima_kexec_file.buf && ima_kexec_file.size == segment_size)
		goto out;

	ima_free_kexec_file_buf(&ima_kexec_file);

	/* segment size can't change between kexec load and execute */
	ima_kexec_file.buf = vmalloc(segment_size);
	if (!ima_kexec_file.buf)
		return -ENOMEM;

	ima_kexec_file.size = segment_size;

out:
	ima_kexec_file.read_pos = 0;
	ima_kexec_file.count = sizeof(struct ima_kexec_hdr);	/* reserved space */
	ima_measure_kexec_event("kexec_load");

	return 0;
}

static int ima_dump_measurement(struct ima_kexec_hdr *khdr,
				struct ima_queue_entry *qe)
{
	if (ima_kexec_file.count >= ima_kexec_file.size)
		return -EINVAL;

	khdr->count++;
	ima_measurements_show(&ima_kexec_file, qe);

Annotation

Implementation Notes