From e8386a3360adb6ec327def1557d2c0fd62c49386 Mon Sep 17 00:00:00 2001 From: Enrico Bravi Date: Tue, 13 Oct 2026 16:46:45 +0200 Subject: [PATCH] ima: recover number of violations after kexec When recovering the IMA measurement list after kexec(), currently, the counter of violations is not restored. This causes a mismatch between the real number of violations and the value reported by the /ima/violations file. Restore the violations counter during the IMA measurement list recovery. This mechanism does not take into account false positives. A legit all-zeros hash is treated as a violation. Reported-by: Roberto Sassu Closes: https://github.com/linux-integrity/linux/issues/13 Signed-off-by: Enrico Bravi Reviewed-and-tested-by: Roberto Sassu [zohar@linux.ibm.com: Fixed patch description line length] Signed-off-by: Mimi Zohar --- security/integrity/ima/ima_template.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c index 7034573fb41e..daa897ccaf58 100644 --- a/security/integrity/ima/ima_template.c +++ b/security/integrity/ima/ima_template.c @@ -524,6 +524,13 @@ int ima_restore_measurement_list(loff_t size, void *buf) ret = -EINVAL; break; } + } else { + /* + * If the template hash found in the kexec buffer is all + * zeros, record it as a violation. Note that this can + * be a false positive. + */ + atomic_long_inc(&ima_num_violations); } entry->pcr = !ima_canonical_fmt ? *(u32 *)(hdr[HDR_PCR].data) :