[PATCH 5.2 52/85] x86/ima: check EFI SetupMode too

[Greg Kroah-Hartman]

From: Mimi Zohar <zo...@linux.ibm.com>

commit 980ef4d22a95a3cd84a9b8ffaa7b81b391d173c6 upstream.

Checking "SecureBoot" mode is not sufficient, also check "SetupMode".

Fixes: 399574c64eaf ("x86/ima: retry detecting secure boot mode")
Reported-by: Matthew Garrett <mj...@google.com>
Signed-off-by: Mimi Zohar <zo...@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 arch/x86/kernel/ima_arch.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/arch/x86/kernel/ima_arch.c
+++ b/arch/x86/kernel/ima_arch.c
@@ -11,10 +11,11 @@ extern struct boot_params boot_params;
 static enum efi_secureboot_mode get_sb_mode(void)
 {
        efi_char16_t efi_SecureBoot_name[] = L"SecureBoot";
+       efi_char16_t efi_SetupMode_name[] = L"SecureBoot";
        efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
        efi_status_t status;
        unsigned long size;
-       u8 secboot;
+       u8 secboot, setupmode;
 
        size = sizeof(secboot);
 
@@ -36,7 +37,14 @@ static enum efi_secureboot_mode get_sb_m
                return efi_secureboot_mode_unknown;
        }
 
-       if (secboot == 0) {
+       size = sizeof(setupmode);
+       status = efi.get_variable(efi_SetupMode_name, &efi_variable_guid,
+                                 NULL, &size, &setupmode);
+
+       if (status != EFI_SUCCESS)      /* ignore unknown SetupMode */
+               setupmode = 0;
+
+       if (secboot == 0 || setupmode == 1) {
                pr_info("ima: secureboot mode disabled\n");
                return efi_secureboot_mode_disabled;
        }