Hi Dave,
On Thu, 2016-09-01 at 09:57 +0800, Dave Young wrote:
On 08/30/16 at 06:40pm, Mimi Zohar wrote:
quoted
+ * Called during kexec_file_load so that IMA can add a segment to the kexec
+ * image for the measurement list for the next kernel.
+ */
+void ima_add_kexec_buffer(struct kimage *image)
+{
+ static int registered = 0;
+ struct kexec_buf kbuf = { .image = image, .buf_align = PAGE_SIZE,
+ .buf_min = 0, .buf_max = ULONG_MAX,
+ .top_down = true, .skip_checksum = true };
+ int ret;
+
+ if (!kexec_can_hand_over_buffer())
+ return;
+
+ kexec_segment_size = ALIGN(ima_get_binary_runtime_size() + PAGE_SIZE,
+ PAGE_SIZE);
+
+ if (kexec_segment_size >= (ULONG_MAX - sizeof(long))) {
+ pr_err("Binary measurement list too large.\n");
+ return;
+ }
Now we added a limitation that total segment size can not be larger than
half of totalram. see kernel/kexec_core.c sanity_check_segment_list()
So can it fail early here if kexec_segment_size is over half of total
ram?
Sure, I'll include this change in the next post.
Mimi