Hi Dave!

On Mon, 2026-01-19 at 10:44 -0800, Dave Hansen wrote:

On 1/18/26 10:25, Mimi Zohar wrote:

quoted

As not all arch's implement arch_integrity_get_secureboot, the definition in
include/linux/integrity.h would need to be updated.  Something like:

-#ifdef CONFIG_INTEGRITY_SECURE_BOOT
+#if (defined(CONFIG_INTEGRITY_SECURE_BOOT) && \
+       (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390) \
+        || defined(CONFIG_PPC_SECURE_BOOT))

Then IMA_SECURE_AND_OR_TRUSTED_BOOT and EVM could select INTEGRITY_SECURE_BOOT,
as suggested.

This seems to be going a wee bit sideways. :)

Agreed, that was my point. :)   "imply" was cleaner, but Ard objected to two
imply's.

This kind of CONFIG complexity really should be left to Kconfig. C
macros really aren't a great place to do it.

The other idiom we use a lot is this in generic code:

#ifndef arch_foo
static inline void arch_foo(void) {}
#endif

Then all you have to do is make sure the arch header that #defines it is
included before the generic code. I'm not a super huge fan of these
because it can be hard to tell (for humans at least) _if_ the
architecture has done the #define.

But it sure beats that #ifdef maze.

Sure.