[PATCH v3 2/2] integrity: Extract secure boot enquiry function out of IMA
From: GONG Ruiqi <hidden>
Date: 2025-07-03 01:34:04
Also in:
keyrings, linux-efi, linux-integrity, lkml
Subsystem:
extended verification module (evm), integrity measurement architecture (ima), security subsystem, the rest · Maintainers:
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Commit 92ad19559ea9 ("integrity: Do not load MOK and MOKx when secure
boot be disabled") utilizes arch_ima_get_secureboot() to perform a
secure boot status check before loading the Machine Owner Key (MOK).
However, only when CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y can this
function be functional, while this config could be turned on/off
parallelly with CONFIG_LOAD_UEFI_KEYS. So the kernel could behave
unintuitively in case that CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=n and
CONFIG_LOAD_UEFI_KEYS=y, as it would refuse to load MOK even if secure
boot is enabled.
Given that what arch_ima_get_secureboot() does is just to retrieve
secure boot status via EFI interfaces and can be decoupled with IMA,
refactor this functionality into integrity_get_efi_secureboot(), a
general helper in the integrity subsystem that both MOK loading and IMA
can make use of. By using the new helper, the implicit dependence of
CONFIG_LOAD_UEFI_KEYS on CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is
removed.
Signed-off-by: GONG Ruiqi <redacted>
---
include/linux/integrity.h | 1 +
security/integrity/Makefile | 1 +
security/integrity/ima/ima_efi.c | 42 +----------------
security/integrity/platform_certs/load_uefi.c | 3 +-
security/integrity/secureboot.c | 46 +++++++++++++++++++
5 files changed, 51 insertions(+), 42 deletions(-)
create mode 100644 security/integrity/secureboot.c
diff --git a/include/linux/integrity.h b/include/linux/integrity.h
index f5842372359b..157d29cab5cd 100644
--- a/include/linux/integrity.h
+++ b/include/linux/integrity.h@@ -61,5 +61,6 @@ integrity_inode_attrs_changed(const struct integrity_inode_attributes *attrs, !inode_eq_iversion(inode, attrs->version)); } +extern bool integrity_get_efi_secureboot(void); #endif /* _LINUX_INTEGRITY_H */
diff --git a/security/integrity/Makefile b/security/integrity/Makefile
index 92b63039c654..3a216ea573fb 100644
--- a/security/integrity/Makefile
+++ b/security/integrity/Makefile@@ -18,6 +18,7 @@ integrity-$(CONFIG_LOAD_IPL_KEYS) += platform_certs/load_ipl_s390.o integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \ platform_certs/load_powerpc.o \ platform_certs/keyring_handler.o +integrity-$(CONFIG_EFI) += secureboot.o # The relative order of the 'ima' and 'evm' LSMs depends on the order below. obj-$(CONFIG_IMA) += ima/ obj-$(CONFIG_EVM) += evm/
diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c
index 9f9c30dcde17..3cf08f8ca3b7 100644
--- a/security/integrity/ima/ima_efi.c
+++ b/security/integrity/ima/ima_efi.c@@ -2,51 +2,13 @@ /* * Copyright (C) 2018 IBM Corporation */ -#include <linux/efi.h> #include <linux/module.h> #include <linux/ima.h> -#include <asm/efi.h> - -#ifndef arch_integrity_efi_boot_mode -#define arch_integrity_efi_boot_mode efi_secureboot_mode_unset -#endif - -static enum efi_secureboot_mode get_sb_mode(void) -{ - enum efi_secureboot_mode mode; - - if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { - pr_info("ima: secureboot mode unknown, no efi\n"); - return efi_secureboot_mode_unknown; - } - - mode = efi_get_secureboot_mode(efi.get_variable); - if (mode == efi_secureboot_mode_disabled) - pr_info("ima: secureboot mode disabled\n"); - else if (mode == efi_secureboot_mode_unknown) - pr_info("ima: secureboot mode unknown\n"); - else - pr_info("ima: secureboot mode enabled\n"); - return mode; -} +#include <linux/integrity.h> bool arch_ima_get_secureboot(void) { - static enum efi_secureboot_mode sb_mode; - static bool initialized; - - if (!initialized && efi_enabled(EFI_BOOT)) { - sb_mode = arch_integrity_efi_boot_mode; - - if (sb_mode == efi_secureboot_mode_unset) - sb_mode = get_sb_mode(); - initialized = true; - } - - if (sb_mode == efi_secureboot_mode_enabled) - return true; - else - return false; + return integrity_get_efi_secureboot(); } /* secureboot arch rules */
diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index d1fdd113450a..deebdbf4393e 100644
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c@@ -7,7 +7,6 @@ #include <linux/err.h> #include <linux/efi.h> #include <linux/slab.h> -#include <linux/ima.h> #include <keys/asymmetric-type.h> #include <keys/system_keyring.h> #include "../integrity.h"
@@ -212,7 +211,7 @@ static int __init load_uefi_certs(void) } /* the MOK/MOKx can not be trusted when secure boot is disabled */ - if (!arch_ima_get_secureboot()) + if (!integrity_get_efi_secureboot()) return 0; mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);
diff --git a/security/integrity/secureboot.c b/security/integrity/secureboot.c
new file mode 100644
index 000000000000..64207ae37e6b
--- /dev/null
+++ b/security/integrity/secureboot.c@@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2025 Huawei Technologies Co., Ltd + */ +#include <linux/efi.h> +#include <linux/integrity.h> +#include <asm/efi.h> + +#ifndef arch_integrity_efi_boot_mode +#define arch_integrity_efi_boot_mode efi_secureboot_mode_unset +#endif + +static enum efi_secureboot_mode get_sb_mode(void) +{ + enum efi_secureboot_mode mode; + + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { + pr_info("integrity: secureboot mode unknown, no efi\n"); + return efi_secureboot_mode_unknown; + } + + mode = efi_get_secureboot_mode(efi.get_variable); + if (mode == efi_secureboot_mode_disabled) + pr_info("integrity: secureboot mode disabled\n"); + else if (mode == efi_secureboot_mode_unknown) + pr_info("integrity: secureboot mode unknown\n"); + else + pr_info("integrity: secureboot mode enabled\n"); + return mode; +} + +bool integrity_get_efi_secureboot(void) +{ + static enum efi_secureboot_mode sb_mode; + static bool initialized; + + if (!initialized && efi_enabled(EFI_BOOT)) { + sb_mode = arch_integrity_efi_boot_mode; + + if (sb_mode == efi_secureboot_mode_unset) + sb_mode = get_sb_mode(); + initialized = true; + } + + return sb_mode == efi_secureboot_mode_enabled; +}
--
2.25.1