v4: - Rename secureboot.c to efi_secureboot.c, as Mimi suggested. v3: - Redesign the implementation. Keep the name of arch_ima_get_secureboot to escape from the morass consisted of multiple arch and configs. - Rephrase the commit message. v2: - Fix compile errors for CONFIG_IMA_ARCH_POLICY=n on s390 & powerpc
--- Hi, We encountered a boot failure issue in an in-house testing, where the kernel refused to load its modules since it couldn't verify their signature. The root cause turned out to be the early return of load_uefi_certs(), where arch_ima_get_secureboot() returned false unconditionally due to CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=n, even though the secure boot was enabled. This patch set attempts to remove this implicit dependency by shifting the functionality of efi secure boot enquiry from IMA to the integrity subsystem, so that both certificate loading and IMA can make use of it independently. The code has been compile-tested on x86/arm64/powerpc/s390, with as much as config combinations I can think of. -Ruiqi GONG Ruiqi (2): x86/efi: Rename IMA-related function and macro of boot mode integrity: Extract secure boot enquiry function out of IMA arch/x86/include/asm/efi.h | 4 +- arch/x86/platform/efi/efi.c | 2 +- include/linux/integrity.h | 1 + security/integrity/Makefile | 1 + security/integrity/efi_secureboot.c | 46 +++++++++++++++++++ security/integrity/ima/ima_efi.c | 42 +---------------- security/integrity/platform_certs/load_uefi.c | 3 +- 7 files changed, 54 insertions(+), 45 deletions(-) create mode 100644 security/integrity/efi_secureboot.c -- 2.25.1
