Commit 92ad19559ea9 ("integrity: Do not load MOK and MOKx when secure
boot be disabled") utilizes arch_ima_get_secureboot() to perform a
secure boot status check before loading the Machine Owner Key (MOK).However, only when CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y can this function be functional, while this config could be turned on/off parallelly with CONFIG_LOAD_UEFI_KEYS. So the kernel could behave unintuitively in case that CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=n and CONFIG_LOAD_UEFI_KEYS=y, as it would refuse to load MOK even if secure boot is enabled. Given that what arch_ima_get_secureboot() does is just to retrieve secure boot status via EFI interfaces and can be decoupled with IMA, refactor this functionality into integrity_get_efi_secureboot(), a general helper in the integrity subsystem that both MOK loading and IMA can make use of. By using the new helper, the implicit dependence of CONFIG_LOAD_UEFI_KEYS on CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is removed. Signed-off-by: GONG Ruiqi <[email protected]> --- include/linux/integrity.h | 1 + security/integrity/Makefile | 1 + security/integrity/efi_secureboot.c | 46 +++++++++++++++++++ security/integrity/ima/ima_efi.c | 42 +---------------- security/integrity/platform_certs/load_uefi.c | 3 +- 5 files changed, 51 insertions(+), 42 deletions(-) create mode 100644 security/integrity/efi_secureboot.c diff --git a/include/linux/integrity.h b/include/linux/integrity.h index f5842372359b..157d29cab5cd 100644 --- a/include/linux/integrity.h +++ b/include/linux/integrity.h @@ -61,5 +61,6 @@ integrity_inode_attrs_changed(const struct integrity_inode_attributes *attrs, !inode_eq_iversion(inode, attrs->version)); } +extern bool integrity_get_efi_secureboot(void); #endif /* _LINUX_INTEGRITY_H */ diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 92b63039c654..45dfdedbdad4 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -18,6 +18,7 @@ integrity-$(CONFIG_LOAD_IPL_KEYS) += platform_certs/load_ipl_s390.o integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \ platform_certs/load_powerpc.o \ platform_certs/keyring_handler.o +integrity-$(CONFIG_EFI) += efi_secureboot.o # The relative order of the 'ima' and 'evm' LSMs depends on the order below. obj-$(CONFIG_IMA) += ima/ obj-$(CONFIG_EVM) += evm/ diff --git a/security/integrity/efi_secureboot.c b/security/integrity/efi_secureboot.c new file mode 100644 index 000000000000..64207ae37e6b --- /dev/null +++ b/security/integrity/efi_secureboot.c @@ -0,0 +1,46 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2025 Huawei Technologies Co., Ltd + */ +#include <linux/efi.h> +#include <linux/integrity.h> +#include <asm/efi.h> + +#ifndef arch_integrity_efi_boot_mode +#define arch_integrity_efi_boot_mode efi_secureboot_mode_unset +#endif + +static enum efi_secureboot_mode get_sb_mode(void) +{ + enum efi_secureboot_mode mode; + + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { + pr_info("integrity: secureboot mode unknown, no efi\n"); + return efi_secureboot_mode_unknown; + } + + mode = efi_get_secureboot_mode(efi.get_variable); + if (mode == efi_secureboot_mode_disabled) + pr_info("integrity: secureboot mode disabled\n"); + else if (mode == efi_secureboot_mode_unknown) + pr_info("integrity: secureboot mode unknown\n"); + else + pr_info("integrity: secureboot mode enabled\n"); + return mode; +} + +bool integrity_get_efi_secureboot(void) +{ + static enum efi_secureboot_mode sb_mode; + static bool initialized; + + if (!initialized && efi_enabled(EFI_BOOT)) { + sb_mode = arch_integrity_efi_boot_mode; + + if (sb_mode == efi_secureboot_mode_unset) + sb_mode = get_sb_mode(); + initialized = true; + } + + return sb_mode == efi_secureboot_mode_enabled; +} diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c index 9f9c30dcde17..3cf08f8ca3b7 100644 --- a/security/integrity/ima/ima_efi.c +++ b/security/integrity/ima/ima_efi.c @@ -2,51 +2,13 @@ /* * Copyright (C) 2018 IBM Corporation */ -#include <linux/efi.h> #include <linux/module.h> #include <linux/ima.h> -#include <asm/efi.h> - -#ifndef arch_integrity_efi_boot_mode -#define arch_integrity_efi_boot_mode efi_secureboot_mode_unset -#endif - -static enum efi_secureboot_mode get_sb_mode(void) -{ - enum efi_secureboot_mode mode; - - if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { - pr_info("ima: secureboot mode unknown, no efi\n"); - return efi_secureboot_mode_unknown; - } - - mode = efi_get_secureboot_mode(efi.get_variable); - if (mode == efi_secureboot_mode_disabled) - pr_info("ima: secureboot mode disabled\n"); - else if (mode == efi_secureboot_mode_unknown) - pr_info("ima: secureboot mode unknown\n"); - else - pr_info("ima: secureboot mode enabled\n"); - return mode; -} +#include <linux/integrity.h> bool arch_ima_get_secureboot(void) { - static enum efi_secureboot_mode sb_mode; - static bool initialized; - - if (!initialized && efi_enabled(EFI_BOOT)) { - sb_mode = arch_integrity_efi_boot_mode; - - if (sb_mode == efi_secureboot_mode_unset) - sb_mode = get_sb_mode(); - initialized = true; - } - - if (sb_mode == efi_secureboot_mode_enabled) - return true; - else - return false; + return integrity_get_efi_secureboot(); } /* secureboot arch rules */ diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index d1fdd113450a..deebdbf4393e 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -7,7 +7,6 @@ #include <linux/err.h> #include <linux/efi.h> #include <linux/slab.h> -#include <linux/ima.h> #include <keys/asymmetric-type.h> #include <keys/system_keyring.h> #include "../integrity.h" @@ -212,7 +211,7 @@ static int __init load_uefi_certs(void) } /* the MOK/MOKx can not be trusted when secure boot is disabled */ - if (!arch_ima_get_secureboot()) + if (!integrity_get_efi_secureboot()) return 0; mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status); -- 2.25.1
