From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_2 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23C73C2D0A3 for ; Wed, 4 Nov 2020 19:04:27 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 78F08206D9 for ; Wed, 4 Nov 2020 19:04:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="m/gTiNCS"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="USck3GLw" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 78F08206D9 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.ibm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Mime-Version:References:In-Reply-To:Date:To:From: Subject:Message-ID:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=C+lvbelROAojyDQvz2j14kwUDrF5Za0oTAJhIOjqJfQ=; b=m/gTiNCSIzLEdnHK6RuxEF4J8 AJOsSNdGu88EiF8hWyAweEwKLTxJgQKZEv1JEBq78Uh/CCBaDiY8aiw1mkZGAo5WiBa/ZlSdmM6WX mG3ffiB4BTtKXykHBnE/k6zn2z7tj2xAVlDQrE6OVY7lmjbkT2Ef1GkxspjHqu2+TSwFTUzkKHaK3 L8dWL00oUvCJ+Lx9JMmB468sJlU1XZH71SbpPfoY5tvbWdJEsdB8jGEogy64R6tcH0y1H1kV8neAH ndg43eDj+tHvgRthBgqRriVOB4dzqO1rKzStpAUHIve0sDM0p1MOVr7/sfLGhEQJfHt78JEccKRFs t+AxEmaLw==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kaO4Z-0003zv-S6; Wed, 04 Nov 2020 19:03:55 +0000 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kaO4V-0003xo-2I for linux-arm-kernel@lists.infradead.org; Wed, 04 Nov 2020 19:03:53 +0000 Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0A4J2d5r065487; Wed, 4 Nov 2020 14:03:36 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=message-id : subject : from : to : cc : date : in-reply-to : references : content-type : mime-version : content-transfer-encoding; s=pp1; bh=yOxE0JtfLADlvR2nLuOr0EeZD60hbYIQnY+lcJ2jUzA=; b=USck3GLwRc8AlRuEWhy1JAgHDkfhuARablK0JXB37my1GLw05VSGmN5YRifL4gFfa1JC RJRIYiv//K8OqAXOJOQfn0tUK93cEIMftQr0Ar2AQjWv5UPgKuXTcleBY2fFmQ3fwhLa jPuNId4jC5K1cfaV2vsJQBB9hvhvC7os4DGSEr2EWO04pJVK3oAGJ+F0/FKvBJY84rM3 AiW+r6w1QnZ9je8JnI0/JurEBS+XqPlwugxbZYE/694cjck42JtBzAqSC+cjrujj0WSS NTLL62A0xpZDldoi2JQHDlxVfH8LqHJuOsOyMVyjtQMkJhJ3nosz4+BH4pEXSLd0Yk5p DA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 34kqdb75jh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 04 Nov 2020 14:03:36 -0500 Received: from m0098410.ppops.net (m0098410.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 0A4J2d25065467; Wed, 4 Nov 2020 14:03:35 -0500 Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0a-001b2d01.pphosted.com with ESMTP id 34kqdb75gb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 04 Nov 2020 14:03:35 -0500 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.0.42/8.16.0.42) with SMTP id 0A4Iv8Zs011155; Wed, 4 Nov 2020 19:03:33 GMT Received: from b06avi18878370.portsmouth.uk.ibm.com (b06avi18878370.portsmouth.uk.ibm.com [9.149.26.194]) by ppma06ams.nl.ibm.com with ESMTP id 34h0fcvmy5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 04 Nov 2020 19:03:32 +0000 Received: from b06wcsmtp001.portsmouth.uk.ibm.com (b06wcsmtp001.portsmouth.uk.ibm.com [9.149.105.160]) by b06avi18878370.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 0A4J3UX959965898 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 4 Nov 2020 19:03:30 GMT Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B1300A405F; Wed, 4 Nov 2020 19:03:30 +0000 (GMT) Received: from b06wcsmtp001.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3C91BA4054; Wed, 4 Nov 2020 19:03:28 +0000 (GMT) Received: from li-f45666cc-3089-11b2-a85c-c57d1a57929f.ibm.com (unknown [9.160.13.183]) by b06wcsmtp001.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 4 Nov 2020 19:03:28 +0000 (GMT) Message-ID: Subject: Re: [PATCH v4 0/3] wire up IMA secure boot for arm64 From: Mimi Zohar To: Ard Biesheuvel Date: Wed, 04 Nov 2020 14:03:27 -0500 In-Reply-To: References: <20201102223800.12181-1-ardb@kernel.org> <2fd203414ba8ac3349f0109fea633838b4e04f05.camel@linux.ibm.com> X-Mailer: Evolution 3.28.5 (3.28.5-12.el8) Mime-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.312, 18.0.737 definitions=2020-11-04_12:2020-11-04, 2020-11-04 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 impostorscore=0 mlxscore=0 malwarescore=0 bulkscore=0 adultscore=0 spamscore=0 mlxlogscore=999 phishscore=0 clxscore=1015 suspectscore=0 priorityscore=1501 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2011040135 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201104_140351_479752_ACC2B8B8 X-CRM114-Status: GOOD ( 31.01 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Lee, Chun-Yi" , linux-efi , Dmitry Kasatkin , X86 ML , James Morris , Chester Lin , Catalin Marinas , linux-integrity , Will Deacon , Linux ARM , "Serge E. Hallyn" Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, 2020-11-04 at 19:50 +0100, Ard Biesheuvel wrote: > On Wed, 4 Nov 2020 at 19:20, Mimi Zohar wrote: > > > > Hi Ard, Chester, > > > > On Mon, 2020-11-02 at 23:37 +0100, Ard Biesheuvel wrote: > > > This is a follow-up to Chester's series [0] to enable IMA to the secure > > > boot state of arm64 platforms, which is EFI based. > > > > > > This v4 implements the changes I suggested to Chester, in particular: > > > - disregard MokSbState when factoring out secure boot mode discovery > > > - turn the x86 IMA arch code into shared code for all architectures. > > > > > > This reduces the final patch to a one liner enabling a Kconfig option > > > for arm64 when EFI is enabled. > > > > > > Build tested only. > > > > Thank you! This patch set is now queued in the linux-integrity next- > > integrity-testing branch. > > > > I don't mind per se, but this touches a number of different trees, > including x86 and arm64, and nobody has acked it yet. > > As far as the EFI tree is concerned, it looks like I should be able to > avoid any conflicts with other stuff that is in flight, and if not, we > can always use your branch up until the last patch in this serires as > a shared tag (assuming you won't rebase it). The next-integrity-testing branch is just a place holder waiting for additional tags. I've reviewed and tested the patch set on x86. Based on the secure boot status and how the kernel is configured, the appropriate policy rules are enabled. Similarly the IMA appraise mode (ima_appraise=) is working properly. I have not tested on arm64. I do not have a problem with this patch set being upstream via EFI. thanks, Mimi _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel