mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
x86/ima: retry detecting secure boot mode
The secure boot mode may not be detected on boot for some reason (eg. buggy firmware). This patch attempts one more time to detect the secure boot mode. Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
parent
4264f27a08
commit
399574c64e
3 changed files with 47 additions and 3 deletions
|
@ -151,4 +151,6 @@ ifeq ($(CONFIG_X86_64),y)
|
|||
obj-y += vsmp_64.o
|
||||
endif
|
||||
|
||||
ifdef CONFIG_EFI
|
||||
obj-$(CONFIG_IMA) += ima_arch.o
|
||||
endif
|
||||
|
|
|
@ -7,10 +7,52 @@
|
|||
|
||||
extern struct boot_params boot_params;
|
||||
|
||||
static enum efi_secureboot_mode get_sb_mode(void)
|
||||
{
|
||||
efi_char16_t efi_SecureBoot_name[] = L"SecureBoot";
|
||||
efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
|
||||
efi_status_t status;
|
||||
unsigned long size;
|
||||
u8 secboot;
|
||||
|
||||
size = sizeof(secboot);
|
||||
|
||||
/* Get variable contents into buffer */
|
||||
status = efi.get_variable(efi_SecureBoot_name, &efi_variable_guid,
|
||||
NULL, &size, &secboot);
|
||||
if (status == EFI_NOT_FOUND) {
|
||||
pr_info("ima: secureboot mode disabled\n");
|
||||
return efi_secureboot_mode_disabled;
|
||||
}
|
||||
|
||||
if (status != EFI_SUCCESS) {
|
||||
pr_info("ima: secureboot mode unknown\n");
|
||||
return efi_secureboot_mode_unknown;
|
||||
}
|
||||
|
||||
if (secboot == 0) {
|
||||
pr_info("ima: secureboot mode disabled\n");
|
||||
return efi_secureboot_mode_disabled;
|
||||
}
|
||||
|
||||
pr_info("ima: secureboot mode enabled\n");
|
||||
return efi_secureboot_mode_enabled;
|
||||
}
|
||||
|
||||
bool arch_ima_get_secureboot(void)
|
||||
{
|
||||
if (efi_enabled(EFI_BOOT) &&
|
||||
(boot_params.secure_boot == efi_secureboot_mode_enabled))
|
||||
static enum efi_secureboot_mode sb_mode;
|
||||
static bool initialized;
|
||||
|
||||
if (!initialized && efi_enabled(EFI_BOOT)) {
|
||||
sb_mode = boot_params.secure_boot;
|
||||
|
||||
if (sb_mode == efi_secureboot_mode_unset)
|
||||
sb_mode = get_sb_mode();
|
||||
initialized = true;
|
||||
}
|
||||
|
||||
if (sb_mode == efi_secureboot_mode_enabled)
|
||||
return true;
|
||||
else
|
||||
return false;
|
||||
|
|
|
@ -30,7 +30,7 @@ extern void ima_post_path_mknod(struct dentry *dentry);
|
|||
extern void ima_add_kexec_buffer(struct kimage *image);
|
||||
#endif
|
||||
|
||||
#ifdef CONFIG_X86
|
||||
#if defined(CONFIG_X86) && defined(CONFIG_EFI)
|
||||
extern bool arch_ima_get_secureboot(void);
|
||||
extern const char * const *arch_get_ima_policy(void);
|
||||
#else
|
||||
|
|
Loading…
Reference in a new issue