x86/ima: define arch_ima_get_secureboot (0914ade2) · Commits · 戴 / test

Distros are concerned about totally disabling the kexec_load syscall. As a compromise, the kexec_load syscall will only be disabled when CONFIG_KEXEC_VERIFY_SIG is configured and the system is booted with secureboot enabled. This patch defines the new arch specific function called arch_ima_get_secureboot() to retrieve the secureboot state of the system. Signed-off-by:

Nayna Jain <nayna@linux.ibm.com> Suggested-by:

Seth Forshee <seth.forshee@canonical.com> Cc: David Howells <dhowells@redhat.com> Cc: Eric Biederman <ebiederm@xmission.com> Cc: Peter Jones <pjones@redhat.com> Cc: Vivek Goyal <vgoyal@redhat.com> Cc: Dave Young <dyoung@redhat.com> Signed-off-by:

Mimi Zohar <zohar@linux.ibm.com>

arch/x86/kernel/Makefile

+2 −0

Original line number	Diff line number	Diff line
		@@ -150,3 +150,5 @@ ifeq ($(CONFIG_X86_64),y)
		obj-$(CONFIG_MMCONF_FAM10H) += mmconf-fam10h_64.o
		obj-y += vsmp_64.o
		endif

		obj-$(CONFIG_IMA) += ima_arch.o

arch/x86/kernel/ima_arch.c

0 → 100644

+17 −0

Original line number	Diff line number	Diff line
		/* SPDX-License-Identifier: GPL-2.0+ */
		/*
		* Copyright (C) 2018 IBM Corporation
		*/
		#include <linux/efi.h>
		#include <linux/ima.h>

		extern struct boot_params boot_params;

		bool arch_ima_get_secureboot(void)
		{
		if (efi_enabled(EFI_BOOT) &&
		(boot_params.secure_boot == efi_secureboot_mode_enabled))
		return true;
		else
		return false;
		}

include/linux/ima.h

+9 −0

Original line number	Diff line number	Diff line
		@@ -30,6 +30,15 @@ extern void ima_post_path_mknod(struct dentry *dentry);
		extern void ima_add_kexec_buffer(struct kimage *image);
		#endif

		#ifdef CONFIG_X86
		extern bool arch_ima_get_secureboot(void);
		#else
		static inline bool arch_ima_get_secureboot(void)
		{
		return false;
		}
		#endif

		#else
		static inline int ima_bprm_check(struct linux_binprm *bprm)
		{

Admin message