Commit 92ad1955 authored by Lee, Chun-Yi's avatar Lee, Chun-Yi Committed by Mimi Zohar
Browse files

integrity: Do not load MOK and MOKx when secure boot be disabled 



The security of Machine Owner Key (MOK) relies on secure boot. When
secure boot is disabled, EFI firmware will not verify binary code. Then
arbitrary efi binary code can modify MOK when rebooting.

This patch prevents MOK/MOKx be loaded when secure boot be disabled.

Signed-off-by: default avatar"Lee, Chun-Yi" <jlee@suse.com>
Reviewed-by: default avatarPetr Vorel <pvorel@suse.cz>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 54bf7fa3

security/integrity/platform_certs/load_uefi.c

+5 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 
#include <linux/err.h>

#include <linux/efi.h>

#include <linux/slab.h>

#include <linux/ima.h>

#include <keys/asymmetric-type.h>

#include <keys/system_keyring.h>

#include "../integrity.h"
@@ -176,6 +177,10 @@ static int __init load_uefi_certs(void) 
		kfree(dbx);

	}



	/* the MOK/MOKx can not be trusted when secure boot is disabled */

	if (!arch_ima_get_secureboot())

		return 0;



	mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);

	if (!mokx) {

		if (status == EFI_NOT_FOUND)