Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0914ade2 authored by Nayna Jain's avatar Nayna Jain Committed by Mimi Zohar
Browse files

x86/ima: define arch_ima_get_secureboot 



Distros are concerned about totally disabling the kexec_load syscall.
As a compromise, the kexec_load syscall will only be disabled when
CONFIG_KEXEC_VERIFY_SIG is configured and the system is booted with
secureboot enabled.

This patch defines the new arch specific function called
arch_ima_get_secureboot() to retrieve the secureboot state of the system.

Signed-off-by: default avatarNayna Jain <nayna@linux.ibm.com>
Suggested-by: default avatarSeth Forshee <seth.forshee@canonical.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Peter Jones <pjones@redhat.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 59637d5e

arch/x86/kernel/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -150,3 +150,5 @@ ifeq ($(CONFIG_X86_64),y) 
	obj-$(CONFIG_MMCONF_FAM10H)	+= mmconf-fam10h_64.o

	obj-y				+= vsmp_64.o

endif



obj-$(CONFIG_IMA)			+= ima_arch.o

arch/x86/kernel/ima_arch.c

0 → 100644
+17 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0+ */

/*

 * Copyright (C) 2018 IBM Corporation

 */

#include <linux/efi.h>

#include <linux/ima.h>



extern struct boot_params boot_params;



bool arch_ima_get_secureboot(void)

{

	if (efi_enabled(EFI_BOOT) &&

		(boot_params.secure_boot == efi_secureboot_mode_enabled))

		return true;

	else

		return false;

}

include/linux/ima.h

+9 −0
Original line number Diff line number Diff line
@@ -30,6 +30,15 @@ extern void ima_post_path_mknod(struct dentry *dentry); 
extern void ima_add_kexec_buffer(struct kimage *image);

#endif



#ifdef CONFIG_X86

extern bool arch_ima_get_secureboot(void);

#else

static inline bool arch_ima_get_secureboot(void)

{

	return false;

}

#endif



#else

static inline int ima_bprm_check(struct linux_binprm *bprm)

{