x86/ima: retry detecting secure boot mode (399574c6) · Commits · 戴 / test

arch/x86/kernel/Makefile

+2 −0

+44 −2

Original line number	Diff line number	Diff line
		@@ -7,10 +7,52 @@

		extern struct boot_params boot_params;

		static enum efi_secureboot_mode get_sb_mode(void)
		{
		efi_char16_t efi_SecureBoot_name[] = L"SecureBoot";
		efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
		efi_status_t status;
		unsigned long size;
		u8 secboot;

		size = sizeof(secboot);

		/* Get variable contents into buffer */
		status = efi.get_variable(efi_SecureBoot_name, &efi_variable_guid,
		NULL, &size, &secboot);
		if (status == EFI_NOT_FOUND) {
		pr_info("ima: secureboot mode disabled\n");
		return efi_secureboot_mode_disabled;
		}

		if (status != EFI_SUCCESS) {
		pr_info("ima: secureboot mode unknown\n");
		return efi_secureboot_mode_unknown;
		}

		if (secboot == 0) {
		pr_info("ima: secureboot mode disabled\n");
		return efi_secureboot_mode_disabled;
		}

		pr_info("ima: secureboot mode enabled\n");
		return efi_secureboot_mode_enabled;
		}

		bool arch_ima_get_secureboot(void)
		{
		if (efi_enabled(EFI_BOOT) &&
		(boot_params.secure_boot == efi_secureboot_mode_enabled))
		static enum efi_secureboot_mode sb_mode;
		static bool initialized;

		if (!initialized && efi_enabled(EFI_BOOT)) {
		sb_mode = boot_params.secure_boot;

		if (sb_mode == efi_secureboot_mode_unset)
		sb_mode = get_sb_mode();
		initialized = true;
		}

		if (sb_mode == efi_secureboot_mode_enabled)
		return true;
		else
		return false;

+1 −1

Original line number	Diff line number	Diff line
		@@ -30,7 +30,7 @@ extern void ima_post_path_mknod(struct dentry *dentry);
		extern void ima_add_kexec_buffer(struct kimage *image);
		#endif

		#ifdef CONFIG_X86
		#if defined(CONFIG_X86) && defined(CONFIG_EFI)
		extern bool arch_ima_get_secureboot(void);
		extern const char * const *arch_get_ima_policy(void);
		#else