linux-kernel - Re: [PATCH] Revert "integrity: Do not load MOK and MOKx when secure boot be disabled"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z9wrmoPHWoxdEImx@kernel.org>
Date: Thu, 20 Mar 2025 16:52:10 +0200
From: Jarkko Sakkinen <jarkko@...nel.org>
To: Lennart Poettering <mzxreary@...inter.de>
Cc: Mimi Zohar <zohar@...ux.ibm.com>,
	Roberto Sassu <roberto.sassu@...wei.com>,
	Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
	Eric Snowberg <eric.snowberg@...cle.com>,
	Paul Moore <paul@...l-moore.com>, James Morris <jmorris@...ei.org>,
	"Serge E. Hallyn" <serge@...lyn.com>,
	linux-integrity@...r.kernel.org, keyrings@...r.kernel.org,
	linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org,
	"Lee, Chun-Yi" <joeyli.kernel@...il.com>
Subject: Re: [PATCH] Revert "integrity: Do not load MOK and MOKx when secure
 boot be disabled"

On Thu, Mar 20, 2025 at 01:02:13PM +0100, Lennart Poettering wrote:
> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> index d1fdd113450a..7783bcacd26c 100644
> --- a/security/integrity/platform_certs/load_uefi.c
> +++ b/security/integrity/platform_certs/load_uefi.c
> @@ -7,7 +7,6 @@
>  #include <linux/err.h>
>  #include <linux/efi.h>
>  #include <linux/slab.h>
> -#include <linux/ima.h>
>  #include <keys/asymmetric-type.h>
>  #include <keys/system_keyring.h>
>  #include "../integrity.h"
> @@ -211,10 +210,6 @@ static int __init load_uefi_certs(void)
>  		kfree(dbx);
>  	}
> 
> -	/* the MOK/MOKx can not be trusted when secure boot is disabled */
> -	if (!arch_ima_get_secureboot())
> -		return 0;
> -
>  	mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);
>  	if (!mokx) {
>  		if (status == EFI_NOT_FOUND)

The original commit message is foggy:

"
    integrity: Do not load MOK and MOKx when secure boot be disabled

    The security of Machine Owner Key (MOK) relies on secure boot. When
    secure boot is disabled, EFI firmware will not verify binary code. Then
    arbitrary efi binary code can modify MOK when rebooting.

    This patch prevents MOK/MOKx be loaded when secure boot be disabled.
"

Given that I don't understand the problem it is trying to solve:

Reviewed-by: Jarkko Sakkinen <jarkko@...nel.org>

> --
> 2.48.1
> 
> 
> Lennart
> 
> --
> Lennart Poettering, Berlin
> 

Jarkko