Commit 6b75d54d authored Feb 16, 2020 by Ard Biesheuvel

integrity: Check properly whether EFI GetVariable() is available



Testing the value of the efi.get_variable function pointer is not
the right way to establish whether the platform supports EFI
variables at runtime. Instead, use the newly added granular check
that can test for the presence of each EFI runtime service
individually.

Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

parent 9a440391

security/integrity/platform_certs/load_uefi.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -76,7 +76,7 @@ static int __init load_uefi_certs(void)
		unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
		int rc = 0;

		if (!efi.get_variable)
		if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
		return false;

		/* Get db, MokListRT, and dbx. They might not exist, so it isn't

Admin message