linux-kernel - [PATCH v3 0/2] integrity: Extract secure boot enquiry function out of IMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250703014353.3366268-1-gongruiqi1@huawei.com>
Date: Thu, 3 Jul 2025 09:43:51 +0800
From: GONG Ruiqi <gongruiqi1@...wei.com>
To: Mimi Zohar <zohar@...ux.ibm.com>, Roberto Sassu
	<roberto.sassu@...wei.com>, Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
	Jarkko Sakkinen <jarkko@...nel.org>, Ard Biesheuvel <ardb@...nel.org>
CC: Eric Snowberg <eric.snowberg@...cle.com>, Paul Moore
	<paul@...l-moore.com>, James Morris <jmorris@...ei.org>, "Serge E . Hallyn"
	<serge@...lyn.com>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar
	<mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, Dave Hansen
	<dave.hansen@...ux.intel.com>, <x86@...nel.org>, "H . Peter Anvin"
	<hpa@...or.com>, <linux-kernel@...r.kernel.org>,
	<linux-integrity@...r.kernel.org>, <linux-security-module@...r.kernel.org>,
	<linux-efi@...r.kernel.org>, <keyrings@...r.kernel.org>, Lu Jialin
	<lujialin4@...wei.com>, <gongruiqi1@...wei.com>
Subject: [PATCH v3 0/2] integrity: Extract secure boot enquiry function out of IMA

v3:
- Redesign the implementation. Keep the name of arch_ima_get_secureboot
  to escape from the morass consisted of multiple arch and configs.
- Rephrase the commit message.
v2:
- Fix compile errors for CONFIG_IMA_ARCH_POLICY=n on s390 & powerpc

---

Hi,

We encountered a boot failure issue in an in-house testing, where the
kernel refused to load its modules since it couldn't verify their
signature. The root cause turned out to be the early return of
load_uefi_certs(), where arch_ima_get_secureboot() returned false
unconditionally due to CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=n, even
though the secure boot was enabled.

This patch set attempts to remove this implicit dependency by shifting
the functionality of efi secure boot enquiry from IMA to the integrity
subsystem, so that both certificate loading and IMA can make use of it
independently.

-Ruiqi

GONG Ruiqi (2):
  x86/efi: Rename IMA-related function and macro of boot mode
  integrity: Extract secure boot enquiry function out of IMA

 arch/x86/include/asm/efi.h                    |  4 +-
 arch/x86/platform/efi/efi.c                   |  2 +-
 include/linux/integrity.h                     |  1 +
 security/integrity/Makefile                   |  1 +
 security/integrity/ima/ima_efi.c              | 42 +----------------
 security/integrity/platform_certs/load_uefi.c |  3 +-
 security/integrity/secureboot.c               | 46 +++++++++++++++++++
 7 files changed, 54 insertions(+), 45 deletions(-)
 create mode 100644 security/integrity/secureboot.c

-- 
2.25.1