linux-kernel - Re: [PATCH v2] integrity: Extract secure boot enquiry function out of IMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <683380bb-ef1b-44ab-b7df-83c23dd76ff7@linux.ibm.com>
Date: Fri, 25 Jul 2025 14:29:27 -0400
From: Nayna Jain <nayna@...ux.ibm.com>
To: GONG Ruiqi <gongruiqi1@...wei.com>, Mimi Zohar <zohar@...ux.ibm.com>,
        Roberto Sassu <roberto.sassu@...wei.com>,
        Dmitry Kasatkin <dmitry.kasatkin@...il.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        Madhavan Srinivasan <maddy@...ux.ibm.com>,
        Michael Ellerman <mpe@...erman.id.au>,
        Heiko Carstens <hca@...ux.ibm.com>, Vasily Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>
Cc: Eric Snowberg <eric.snowberg@...cle.com>,
        Christophe Leroy <christophe.leroy@...roup.eu>,
        Nicholas Piggin <npiggin@...il.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>, "Lee, Chun-Yi" <jlee@...e.com>,
        linuxppc-dev@...ts.ozlabs.org, linux-kernel@...r.kernel.org,
        linux-s390@...r.kernel.org, linux-integrity@...r.kernel.org,
        keyrings@...r.kernel.org, Lu Jialin <lujialin4@...wei.com>
Subject: Re: [PATCH v2] integrity: Extract secure boot enquiry function out of
 IMA


On 7/17/25 8:29 AM, GONG Ruiqi wrote:
> On 7/8/2025 4:35 AM, Nayna Jain wrote:
>> On 7/2/25 10:07 PM, GONG Ruiqi wrote:
>>> ...
>>>
>>> "We encountered a boot failure issue in an in-house testing, where the
>>> kernel refused to load its modules since it couldn't verify their
>>> signature. The root cause turned out to be the early return of
>>> load_uefi_certs(), where arch_ima_get_secureboot() returned false
>>> unconditionally due to CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=n, even
>>> though the secure boot was enabled.
>> Thanks for sharing additional details.
>>
>>  From x86 Kconfig:
>>
>> /For config x86:
>>
>>      imply IMA_SECURE_AND_OR_TRUSTED_BOOT    if EFI
>> /
>> And IMA_SECURE_AND_OR_TRUSTED_BOOT is dependent on IMA_ARCH_POLICY .
>>
>> And from Linux Kernel Kbuild documentation( https://docs.kernel.org/
>> kbuild/kconfig-language.html) :
>>
>> /weak reverse dependencies: “imply” <symbol> [“if” <expr>]
>>
>> This is similar to “select” as it enforces a lower limit on another
>> symbol except that the “implied” symbol’s value may still be set to n
>> from a direct dependency or with a visible prompt.
>>
>> /Following the example from the documentation, if  it is EFI enabled and
>> IMA_ARCH_POLICY is set to y then this config should be default enabled.
>>
>> If it is EFI enabled and IMA_ARCH_POLICY is set to N, then the setting
>> for IMA_SECURE_AND_OR_TRUSTED_BOOT should be prompted during the build.
>> The default setting for prompt is N. So, the person doing the build
>> should actually select Y to enable IMA_ARCH_POLICY.
>>
>> Wondering what is the scenario for you? Unless you have IMA_ARCH_POLICY
>> set to N, this config should have been ideally enabled. If you have
>> explicitly set it to N, am curious any specific reason for that.
> Hi Nayna. Sorry for the late reply. Super busy these days...
>
> Yes, IMA_ARCH_POLICY was not set. The testing was conducted on
> openEuler[1], a Linux distro mainly for arm64 & x86, and the kernel was
> compiled based on its own openeuler_defconfig[2], which set
> IMA_ARCH_POLICY to N.

Thanks Ruiqi for the response.

It seems the main cause of the problem was that IMA_ARCH_POLICY config 
wasn't enabled; and it sounds like you don't need IMA arch policies but 
you do need the arch specific function to get the secure boot status.

In that case, removing IMA_SECURE_AND_OR_TRUSTED_BOOT config dependency 
on IMA_ARCH_POLICY config and updating the corresponding help is all 
that is needed.

The help text can be updated to:
This option is selected by architectures to detect systems with secure 
and/or trusted boot enabled, in order to load the appropriate IMA 
runtime policies and keys.

Thanks & Regards,

     - Nayna