github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ima: recover number of violations after kexec

Browse Source 
When recovering the IMA measurement list after kexec(), currently, the
counter of violations is not restored. This causes a mismatch between
the real number of violations and the value reported by the
<securityfs>/ima/violations file.

Restore the violations counter during the IMA measurement list recovery.
This mechanism does not take into account false positives. A legit
all-zeros hash is treated as a violation.

Reported-by: Roberto Sassu <roberto.sassu@huawei.com>
Closes: https://github.com/linux-integrity/linux/issues/13
Signed-off-by: Enrico Bravi <enrico.bravi@polito.it>
Reviewed-and-tested-by: Roberto Sassu <roberto.sassu@huawei.com>
[zohar@linux.ibm.com: Fixed patch description line length]
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Enrico Bravi 2026-10-13 16:46:45 +02:00 committed by Mimi Zohar
parent 1dc3174383
commit e8386a3360
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
security/integrity/ima/ima_template.c
View File

@ -524,6 +524,13 @@ int ima_restore_measurement_list(loff_t size, void *buf)
ret = -EINVAL;
break;
}
} else {
/*
* If the template hash found in the kexec buffer is all
* zeros, record it as a violation. Note that this can
* be a false positive.
*/
atomic_long_inc(&ima_num_violations);
}
entry->pcr = !ima_canonical_fmt ? *(u32 *)(hdr[HDR_PCR].data) :