Commit 25519d68 authored by Chester Lin's avatar Chester Lin Committed by Ard Biesheuvel
Browse files

ima: generalize x86/EFI arch glue for other EFI architectures 



Move the x86 IMA arch code into security/integrity/ima/ima_efi.c,
so that we will be able to wire it up for arm64 in a future patch.

Co-developed-by: default avatarChester Lin <clin@suse.com>
Signed-off-by: default avatarChester Lin <clin@suse.com>
Acked-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
parent e1ac4b24

arch/x86/include/asm/efi.h

+3 −0
Original line number Diff line number Diff line
@@ -380,4 +380,7 @@ static inline void efi_fake_memmap_early(void) 
}

#endif



#define arch_ima_efi_boot_mode	\

	({ extern struct boot_params boot_params; boot_params.secure_boot; })



#endif /* _ASM_X86_EFI_H */

arch/x86/kernel/Makefile

+0 −2
Original line number Diff line number Diff line
@@ -161,5 +161,3 @@ ifeq ($(CONFIG_X86_64),y) 
	obj-$(CONFIG_MMCONF_FAM10H)	+= mmconf-fam10h_64.o

	obj-y				+= vsmp_64.o

endif
 


obj-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT)	+= ima_arch.o

security/integrity/ima/Makefile

+4 −0
Original line number Diff line number Diff line
@@ -14,3 +14,7 @@ ima-$(CONFIG_HAVE_IMA_KEXEC) += ima_kexec.o 
ima-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o

ima-$(CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS) += ima_asymmetric_keys.o

ima-$(CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS) += ima_queue_keys.o



ifeq ($(CONFIG_EFI),y)

ima-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT) += ima_efi.o

endif

arch/x86/kernel/ima_arch.c→security/integrity/ima/ima_efi.c

+12 −33
Original line number Diff line number Diff line
@@ -5,50 +5,29 @@ 
#include <linux/efi.h>

#include <linux/module.h>

#include <linux/ima.h>

#include <asm/efi.h>



extern struct boot_params boot_params;

#ifndef arch_ima_efi_boot_mode

#define arch_ima_efi_boot_mode efi_secureboot_mode_unset

#endif



static enum efi_secureboot_mode get_sb_mode(void)

{

	efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;

	efi_status_t status;

	unsigned long size;

	u8 secboot, setupmode;



	size = sizeof(secboot);

	enum efi_secureboot_mode mode;



	if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {

		pr_info("ima: secureboot mode unknown, no efi\n");

		return efi_secureboot_mode_unknown;

	}



	/* Get variable contents into buffer */

	status = efi.get_variable(L"SecureBoot", &efi_variable_guid,

				  NULL, &size, &secboot);

	if (status == EFI_NOT_FOUND) {

	mode = efi_get_secureboot_mode(efi.get_variable);

	if (mode == efi_secureboot_mode_disabled)

		pr_info("ima: secureboot mode disabled\n");

		return efi_secureboot_mode_disabled;

	}



	if (status != EFI_SUCCESS) {

	else if (mode == efi_secureboot_mode_unknown)

		pr_info("ima: secureboot mode unknown\n");

		return efi_secureboot_mode_unknown;

	}



	size = sizeof(setupmode);

	status = efi.get_variable(L"SetupMode", &efi_variable_guid,

				  NULL, &size, &setupmode);



	if (status != EFI_SUCCESS)	/* ignore unknown SetupMode */

		setupmode = 0;



	if (secboot == 0 || setupmode == 1) {

		pr_info("ima: secureboot mode disabled\n");

		return efi_secureboot_mode_disabled;

	}



	else

		pr_info("ima: secureboot mode enabled\n");

	return efi_secureboot_mode_enabled;

	return mode;

}



bool arch_ima_get_secureboot(void)
@@ -57,7 +36,7 @@ bool arch_ima_get_secureboot(void) 
	static bool initialized;



	if (!initialized && efi_enabled(EFI_BOOT)) {

		sb_mode = boot_params.secure_boot;

		sb_mode = arch_ima_efi_boot_mode;



		if (sb_mode == efi_secureboot_mode_unset)

			sb_mode = get_sb_mode();