linux-kernel - Re: [PATCH v2] integrity: Extract secure boot enquiry function out of IMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a06d0bc2-e5e3-43e1-9bed-f7d370afeec1@huawei.com>
Date: Thu, 3 Jul 2025 13:19:21 +0800
From: GONG Ruiqi <gongruiqi1@...wei.com>
To: Mimi Zohar <zohar@...ux.ibm.com>, Roberto Sassu
	<roberto.sassu@...wei.com>, Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
	Jarkko Sakkinen <jarkko@...nel.org>, Madhavan Srinivasan
	<maddy@...ux.ibm.com>, Michael Ellerman <mpe@...erman.id.au>, Heiko Carstens
	<hca@...ux.ibm.com>, Vasily Gorbik <gor@...ux.ibm.com>, Alexander Gordeev
	<agordeev@...ux.ibm.com>
CC: Eric Snowberg <eric.snowberg@...cle.com>, Christophe Leroy
	<christophe.leroy@...roup.eu>, Nicholas Piggin <npiggin@...il.com>, Christian
 Borntraeger <borntraeger@...ux.ibm.com>, Sven Schnelle <svens@...ux.ibm.com>,
	"Lee, Chun-Yi" <jlee@...e.com>, <linuxppc-dev@...ts.ozlabs.org>,
	<linux-kernel@...r.kernel.org>, <linux-s390@...r.kernel.org>,
	<linux-integrity@...r.kernel.org>, <keyrings@...r.kernel.org>, Lu Jialin
	<lujialin4@...wei.com>, Nayna Jain <nayna@...ux.ibm.com>
Subject: Re: [PATCH v2] integrity: Extract secure boot enquiry function out of
 IMA


On 7/3/2025 11:35 AM, Mimi Zohar wrote:
> ...
>>
>> You're right. I didn't realize it's arch-specific in the first place,
>> and moving and renaming arch_ima_get_secureboot() turned out to be a
>> real mess ...
>>
>> So the V3 keeps the prototype of arch_ima_get_secureboot(), and only
>> moves out its body, which I think can also better represent the
>> intention of the patch.
> 
> It's definitely much better.  To summarize, arch_ima_get_secureboot() becomes a
> wrapper for integrity_get_efi_secureboot().  Before loading the MOK/MOKx keys,
> load_uefi_certs() calls integrity_get_efi_secureboot() directly.

Exactly.

> 
> With load_uefi_certs() calling integrity_get_efi_secureboot() directly, please
> check to see whether an integrity_get_efi_secureboot() stub function needs to be
> defined.

For CONFIG_LOAD_UEFI_KEYS and CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT, the
former depends on CONFIG_EFI while the latter is implied by the same, so

  integrity-$(CONFIG_EFI) += secureboot.o

should be enough. I've compile-tested the V3 on x86/arm64/powerpc/s390,
with various config combinations as much as I can think of. Let's see if
the kernel test robot could find out some corner cases.

-Ruiqi

> 
> Mimi
> 
>>
>> As of the name of the new file, as V3 has been sent earlier and still
>> uses secureboot.c, I can't change it there. I can do it in V4.
>>
>> -Ruiqi
>