* [PATCH v2 0/3] Make detecting the secure boot status integrity-wide
@ 2026-02-03 4:14 Coiby Xu
2026-02-03 4:14 ` [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide Coiby Xu
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Coiby Xu @ 2026-02-03 4:14 UTC (permalink / raw)
To: linux-integrity
Cc: Heiko Carstens, Alexander Egorenkov, Ard Biesheuvel, Dave Hansen
EVM and other LSMs need the ability to query the secure boot status of
the system, without directly calling the IMA arch_ima_get_secureboot
function. Make arch_ima_get_secureboot integrity-wide.
v2:
- drop CONFIG_INTEGRITY_SECURE_BOOT Kconfig option since it
"imply INTEGRITY_SECURE_BOOT" is anti-pattern as pointed out by
Ard Biesheuvel
Coiby Xu (3):
integrity: Make arch_ima_get_secureboot integrity-wide
evm: Don't enable fix mode when secure boot is enabled
s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
MAINTAINERS | 1 +
arch/powerpc/kernel/ima_arch.c | 5 --
arch/powerpc/kernel/secure_boot.c | 6 ++
arch/s390/Kconfig | 1 -
arch/s390/kernel/Makefile | 1 -
arch/s390/kernel/ima_arch.c | 14 -----
arch/s390/kernel/ipl.c | 5 ++
arch/x86/include/asm/efi.h | 4 +-
arch/x86/platform/efi/efi.c | 2 +-
include/linux/ima.h | 7 +--
include/linux/secure_boot.h | 19 +++++++
security/integrity/Makefile | 3 +-
security/integrity/efi_secureboot.c | 56 +++++++++++++++++++
security/integrity/evm/evm_main.c | 24 +++++---
security/integrity/ima/ima_appraise.c | 2 +-
security/integrity/ima/ima_efi.c | 48 +---------------
security/integrity/ima/ima_main.c | 4 +-
security/integrity/integrity.h | 1 +
security/integrity/platform_certs/load_uefi.c | 2 +-
security/integrity/secure_boot.c | 16 ++++++
20 files changed, 134 insertions(+), 87 deletions(-)
delete mode 100644 arch/s390/kernel/ima_arch.c
create mode 100644 include/linux/secure_boot.h
create mode 100644 security/integrity/efi_secureboot.c
create mode 100644 security/integrity/secure_boot.c
base-commit: 8dfce8991b95d8625d0a1d2896e42f93b9d7f68d
--
2.52.0
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide 2026-02-03 4:14 [PATCH v2 0/3] Make detecting the secure boot status integrity-wide Coiby Xu @ 2026-02-03 4:14 ` Coiby Xu 2026-02-09 20:43 ` Mimi Zohar 2026-02-03 4:14 ` [PATCH v2 2/3] evm: Don't enable fix mode when secure boot is enabled Coiby Xu 2026-02-03 4:14 ` [PATCH v2 3/3] s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT Coiby Xu 2 siblings, 1 reply; 7+ messages in thread From: Coiby Xu @ 2026-02-03 4:14 UTC (permalink / raw) To: linux-integrity Cc: Heiko Carstens, Alexander Egorenkov, Ard Biesheuvel, Dave Hansen, Mimi Zohar, Roberto Sassu, Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin, Christophe Leroy (CS GROUP), Vasily Gorbik, Alexander Gordeev, Christian Borntraeger, Sven Schnelle, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin, Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris, Serge E. Hallyn, Jarkko Sakkinen, open list, open list:LINUX FOR POWERPC (32-BIT AND 64-BIT), open list:S390 ARCHITECTURE, open list:EXTENSIBLE FIRMWARE INTERFACE (EFI), open list:SECURITY SUBSYSTEM, open list:KEYS/KEYRINGS_INTEGRITY EVM and other LSMs need the ability to query the secure boot status of the system, without directly calling the IMA arch_ima_get_secureboot function. Refactor the secure boot status check into a general function named arch_get_secureboot. Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com> Suggested-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Coiby Xu <coxu@redhat.com> --- MAINTAINERS | 1 + arch/powerpc/kernel/ima_arch.c | 5 -- arch/powerpc/kernel/secure_boot.c | 6 ++ arch/s390/kernel/ima_arch.c | 6 -- arch/s390/kernel/ipl.c | 5 ++ arch/x86/include/asm/efi.h | 4 +- arch/x86/platform/efi/efi.c | 2 +- include/linux/ima.h | 7 +-- include/linux/secure_boot.h | 19 +++++++ security/integrity/Makefile | 3 +- security/integrity/efi_secureboot.c | 56 +++++++++++++++++++ security/integrity/ima/ima_appraise.c | 2 +- security/integrity/ima/ima_efi.c | 48 +--------------- security/integrity/ima/ima_main.c | 4 +- security/integrity/integrity.h | 1 + security/integrity/platform_certs/load_uefi.c | 2 +- security/integrity/secure_boot.c | 16 ++++++ 17 files changed, 117 insertions(+), 70 deletions(-) create mode 100644 include/linux/secure_boot.h create mode 100644 security/integrity/efi_secureboot.c create mode 100644 security/integrity/secure_boot.c diff --git a/MAINTAINERS b/MAINTAINERS index 67db88b04537..1f963a621a99 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -12519,6 +12519,7 @@ R: Eric Snowberg <eric.snowberg@oracle.com> L: linux-integrity@vger.kernel.org S: Supported T: git git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git +F: include/linux/secure_boot.h F: security/integrity/ F: security/integrity/ima/ diff --git a/arch/powerpc/kernel/ima_arch.c b/arch/powerpc/kernel/ima_arch.c index b7029beed847..0d8892a03526 100644 --- a/arch/powerpc/kernel/ima_arch.c +++ b/arch/powerpc/kernel/ima_arch.c @@ -7,11 +7,6 @@ #include <linux/ima.h> #include <asm/secure_boot.h> -bool arch_ima_get_secureboot(void) -{ - return is_ppc_secureboot_enabled(); -} - /* * The "secure_rules" are enabled only on "secureboot" enabled systems. * These rules verify the file signatures against known good values. diff --git a/arch/powerpc/kernel/secure_boot.c b/arch/powerpc/kernel/secure_boot.c index 3a28795b4ed8..28436c1599e0 100644 --- a/arch/powerpc/kernel/secure_boot.c +++ b/arch/powerpc/kernel/secure_boot.c @@ -5,6 +5,7 @@ */ #include <linux/types.h> #include <linux/of.h> +#include <linux/secure_boot.h> #include <linux/string_choices.h> #include <asm/secure_boot.h> @@ -44,6 +45,11 @@ bool is_ppc_secureboot_enabled(void) return enabled; } +bool arch_get_secureboot(void) +{ + return is_ppc_secureboot_enabled(); +} + bool is_ppc_trustedboot_enabled(void) { struct device_node *node; diff --git a/arch/s390/kernel/ima_arch.c b/arch/s390/kernel/ima_arch.c index f3c3e6e1c5d3..6ccbe34ce408 100644 --- a/arch/s390/kernel/ima_arch.c +++ b/arch/s390/kernel/ima_arch.c @@ -1,12 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 #include <linux/ima.h> -#include <asm/boot_data.h> - -bool arch_ima_get_secureboot(void) -{ - return ipl_secure_flag; -} const char * const *arch_get_ima_policy(void) { diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c index dcdc7e274848..781deb588557 100644 --- a/arch/s390/kernel/ipl.c +++ b/arch/s390/kernel/ipl.c @@ -2504,6 +2504,11 @@ void *ipl_report_finish(struct ipl_report *report) return buf; } +bool arch_get_secureboot(void) +{ + return ipl_secure_flag; +} + int ipl_report_free(struct ipl_report *report) { struct ipl_report_component *comp, *ncomp; diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h index f227a70ac91f..ee382b56dd7b 100644 --- a/arch/x86/include/asm/efi.h +++ b/arch/x86/include/asm/efi.h @@ -401,9 +401,9 @@ extern int __init efi_memmap_split_count(efi_memory_desc_t *md, extern void __init efi_memmap_insert(struct efi_memory_map *old_memmap, void *buf, struct efi_mem_range *mem); -extern enum efi_secureboot_mode __x86_ima_efi_boot_mode(void); +enum efi_secureboot_mode __x86_efi_boot_mode(void); -#define arch_ima_efi_boot_mode __x86_ima_efi_boot_mode() +#define arch_efi_boot_mode __x86_efi_boot_mode() #ifdef CONFIG_EFI_RUNTIME_MAP int efi_get_runtime_map_size(void); diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c index 463b784499a8..d8b25ae7af1e 100644 --- a/arch/x86/platform/efi/efi.c +++ b/arch/x86/platform/efi/efi.c @@ -921,7 +921,7 @@ umode_t efi_attr_is_visible(struct kobject *kobj, struct attribute *attr, int n) return attr->mode; } -enum efi_secureboot_mode __x86_ima_efi_boot_mode(void) +enum efi_secureboot_mode __x86_efi_boot_mode(void) { return boot_params.secure_boot; } diff --git a/include/linux/ima.h b/include/linux/ima.h index 8e29cb4e6a01..b3927b795a60 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -11,6 +11,7 @@ #include <linux/fs.h> #include <linux/security.h> #include <linux/kexec.h> +#include <linux/secure_boot.h> #include <crypto/hash_info.h> struct linux_binprm; @@ -72,14 +73,8 @@ int __init ima_get_kexec_buffer(void **addr, size_t *size); #endif #ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT -extern bool arch_ima_get_secureboot(void); extern const char * const *arch_get_ima_policy(void); #else -static inline bool arch_ima_get_secureboot(void) -{ - return false; -} - static inline const char * const *arch_get_ima_policy(void) { return NULL; diff --git a/include/linux/secure_boot.h b/include/linux/secure_boot.h new file mode 100644 index 000000000000..3ded3f03655c --- /dev/null +++ b/include/linux/secure_boot.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2026 Red Hat, Inc. All Rights Reserved. + * + * Author: Coiby Xu <coxu@redhat.com> + */ + +#ifndef _LINUX_SECURE_BOOT_H +#define _LINUX_SECURE_BOOT_H + +#include <linux/types.h> + +/* + * Returns true if the platform secure boot is enabled. + * Returns false if disabled or not supported. + */ +bool arch_get_secureboot(void); + +#endif /* _LINUX_SECURE_BOOT_H */ diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 92b63039c654..548665e2b702 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -5,7 +5,7 @@ obj-$(CONFIG_INTEGRITY) += integrity.o -integrity-y := iint.o +integrity-y := iint.o secure_boot.o integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o @@ -18,6 +18,7 @@ integrity-$(CONFIG_LOAD_IPL_KEYS) += platform_certs/load_ipl_s390.o integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \ platform_certs/load_powerpc.o \ platform_certs/keyring_handler.o +integrity-$(CONFIG_EFI) += efi_secureboot.o # The relative order of the 'ima' and 'evm' LSMs depends on the order below. obj-$(CONFIG_IMA) += ima/ obj-$(CONFIG_EVM) += evm/ diff --git a/security/integrity/efi_secureboot.c b/security/integrity/efi_secureboot.c new file mode 100644 index 000000000000..bfd4260a83a3 --- /dev/null +++ b/security/integrity/efi_secureboot.c @@ -0,0 +1,56 @@ +// SPDX-License-Identifier: GPL-1.0+ +/* + * Copyright (C) 2018 IBM Corporation + */ +#include <linux/efi.h> +#include <linux/secure_boot.h> +#include <asm/efi.h> + +#ifndef arch_efi_boot_mode +#define arch_efi_boot_mode efi_secureboot_mode_unset +#endif + +static enum efi_secureboot_mode get_sb_mode(void) +{ + enum efi_secureboot_mode mode; + + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { + pr_info("integrity: secureboot mode unknown, no efi\n"); + return efi_secureboot_mode_unknown; + } + + mode = efi_get_secureboot_mode(efi.get_variable); + if (mode == efi_secureboot_mode_disabled) + pr_info("integrity: secureboot mode disabled\n"); + else if (mode == efi_secureboot_mode_unknown) + pr_info("integrity: secureboot mode unknown\n"); + else + pr_info("integrity: secureboot mode enabled\n"); + return mode; +} + +/* + * Query secure boot status + * + * Note don't call this function too early e.g. in __setup hook otherwise the + * kernel may hang when calling efi_get_secureboot_mode. + * + */ +bool arch_get_secureboot(void) +{ + static enum efi_secureboot_mode sb_mode; + static bool initialized; + + if (!initialized && efi_enabled(EFI_BOOT)) { + sb_mode = arch_efi_boot_mode; + + if (sb_mode == efi_secureboot_mode_unset) + sb_mode = get_sb_mode(); + initialized = true; + } + + if (sb_mode == efi_secureboot_mode_enabled) + return true; + else + return false; +} diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 5149ff4fd50d..9737bf76ce17 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -27,7 +27,7 @@ core_param(ima_appraise, ima_appraise_cmdline_default, charp, 0); void __init ima_appraise_parse_cmdline(void) { const char *str = ima_appraise_cmdline_default; - bool sb_state = arch_ima_get_secureboot(); + bool sb_state = arch_get_secureboot(); int appraisal_state = ima_appraise; if (!str) diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c index 138029bfcce1..27521d665d33 100644 --- a/security/integrity/ima/ima_efi.c +++ b/security/integrity/ima/ima_efi.c @@ -2,52 +2,9 @@ /* * Copyright (C) 2018 IBM Corporation */ -#include <linux/efi.h> #include <linux/module.h> #include <linux/ima.h> -#include <asm/efi.h> - -#ifndef arch_ima_efi_boot_mode -#define arch_ima_efi_boot_mode efi_secureboot_mode_unset -#endif - -static enum efi_secureboot_mode get_sb_mode(void) -{ - enum efi_secureboot_mode mode; - - if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { - pr_info("ima: secureboot mode unknown, no efi\n"); - return efi_secureboot_mode_unknown; - } - - mode = efi_get_secureboot_mode(efi.get_variable); - if (mode == efi_secureboot_mode_disabled) - pr_info("ima: secureboot mode disabled\n"); - else if (mode == efi_secureboot_mode_unknown) - pr_info("ima: secureboot mode unknown\n"); - else - pr_info("ima: secureboot mode enabled\n"); - return mode; -} - -bool arch_ima_get_secureboot(void) -{ - static enum efi_secureboot_mode sb_mode; - static bool initialized; - - if (!initialized && efi_enabled(EFI_BOOT)) { - sb_mode = arch_ima_efi_boot_mode; - - if (sb_mode == efi_secureboot_mode_unset) - sb_mode = get_sb_mode(); - initialized = true; - } - - if (sb_mode == efi_secureboot_mode_enabled) - return true; - else - return false; -} +#include <linux/secure_boot.h> /* secureboot arch rules */ static const char * const sb_arch_rules[] = { @@ -67,7 +24,8 @@ static const char * const sb_arch_rules[] = { const char * const *arch_get_ima_policy(void) { - if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) { + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && + arch_get_secureboot()) { if (IS_ENABLED(CONFIG_MODULE_SIG)) set_module_sig_enforced(); if (IS_ENABLED(CONFIG_KEXEC_SIG)) diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 5770cf691912..6d093ac82a45 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -949,8 +949,8 @@ static int ima_load_data(enum kernel_load_data_id id, bool contents) switch (id) { case LOADING_KEXEC_IMAGE: - if (IS_ENABLED(CONFIG_KEXEC_SIG) - && arch_ima_get_secureboot()) { + if (IS_ENABLED(CONFIG_KEXEC_SIG) && + arch_get_secureboot()) { pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n"); return -EACCES; } diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 7b388b66cf80..4636629533af 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -14,6 +14,7 @@ #include <linux/types.h> #include <linux/integrity.h> +#include <linux/secure_boot.h> #include <crypto/sha1.h> #include <crypto/hash.h> #include <linux/key.h> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index d1fdd113450a..c0d6948446c3 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -212,7 +212,7 @@ static int __init load_uefi_certs(void) } /* the MOK/MOKx can not be trusted when secure boot is disabled */ - if (!arch_ima_get_secureboot()) + if (!arch_get_secureboot()) return 0; mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status); diff --git a/security/integrity/secure_boot.c b/security/integrity/secure_boot.c new file mode 100644 index 000000000000..fc2693c286f8 --- /dev/null +++ b/security/integrity/secure_boot.c @@ -0,0 +1,16 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (C) 2026 Red Hat, Inc. All Rights Reserved. + * + * Author: Coiby Xu <coxu@redhat.com> + */ +#include <linux/secure_boot.h> + +/* + * Default weak implementation. + * Architectures that support secure boot must override this. + */ +__weak bool arch_get_secureboot(void) +{ + return false; +} -- 2.52.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide 2026-02-03 4:14 ` [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide Coiby Xu @ 2026-02-09 20:43 ` Mimi Zohar 2026-02-12 1:28 ` Coiby Xu 0 siblings, 1 reply; 7+ messages in thread From: Mimi Zohar @ 2026-02-09 20:43 UTC (permalink / raw) To: Coiby Xu, linux-integrity Cc: Heiko Carstens, Alexander Egorenkov, Ard Biesheuvel, Dave Hansen, Roberto Sassu, Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin, Christophe Leroy (CS GROUP), Vasily Gorbik, Alexander Gordeev, Christian Borntraeger, Sven Schnelle, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin, Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris, Serge E. Hallyn, Jarkko Sakkinen, open list, open list:LINUX FOR POWERPC (32-BIT AND 64-BIT), open list:S390 ARCHITECTURE, open list:EXTENSIBLE FIRMWARE INTERFACE (EFI), open list:SECURITY SUBSYSTEM, open list:KEYS/KEYRINGS_INTEGRITY On Tue, 2026-02-03 at 12:14 +0800, Coiby Xu wrote: > EVM and other LSMs need the ability to query the secure boot status of > the system, without directly calling the IMA arch_ima_get_secureboot > function. Refactor the secure boot status check into a general function > named arch_get_secureboot. > > Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com> > Suggested-by: Roberto Sassu <roberto.sassu@huawei.com> > Signed-off-by: Coiby Xu <coxu@redhat.com> Thanks, Coiby. Other than unnecessarily splitting a line, the patch set looks good. As soon as the open window closes, I'll queue these patches for linux- next. > diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c > index 138029bfcce1..27521d665d33 100644 > --- a/security/integrity/ima/ima_efi.c > +++ b/security/integrity/ima/ima_efi.c > @@ -2,52 +2,9 @@ > /* > * Copyright (C) 2018 IBM Corporation > */ > -#include <linux/efi.h> > #include <linux/module.h> > #include <linux/ima.h> > -#include <asm/efi.h> > - > -#ifndef arch_ima_efi_boot_mode > -#define arch_ima_efi_boot_mode efi_secureboot_mode_unset > -#endif > - > -static enum efi_secureboot_mode get_sb_mode(void) > -{ > - enum efi_secureboot_mode mode; > - > - if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) { > - pr_info("ima: secureboot mode unknown, no efi\n"); > - return efi_secureboot_mode_unknown; > - } > - > - mode = efi_get_secureboot_mode(efi.get_variable); > - if (mode == efi_secureboot_mode_disabled) > - pr_info("ima: secureboot mode disabled\n"); > - else if (mode == efi_secureboot_mode_unknown) > - pr_info("ima: secureboot mode unknown\n"); > - else > - pr_info("ima: secureboot mode enabled\n"); > - return mode; > -} > - > -bool arch_ima_get_secureboot(void) > -{ > - static enum efi_secureboot_mode sb_mode; > - static bool initialized; > - > - if (!initialized && efi_enabled(EFI_BOOT)) { > - sb_mode = arch_ima_efi_boot_mode; > - > - if (sb_mode == efi_secureboot_mode_unset) > - sb_mode = get_sb_mode(); > - initialized = true; > - } > - > - if (sb_mode == efi_secureboot_mode_enabled) > - return true; > - else > - return false; > -} > +#include <linux/secure_boot.h> > > /* secureboot arch rules */ > static const char * const sb_arch_rules[] = { > @@ -67,7 +24,8 @@ static const char * const sb_arch_rules[] = { > > const char * const *arch_get_ima_policy(void) > { > - if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) { > + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && > + arch_get_secureboot()) { No need to split the line here or below. > if (IS_ENABLED(CONFIG_MODULE_SIG)) > set_module_sig_enforced(); > if (IS_ENABLED(CONFIG_KEXEC_SIG)) > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > index 5770cf691912..6d093ac82a45 100644 > --- a/security/integrity/ima/ima_main.c > +++ b/security/integrity/ima/ima_main.c > @@ -949,8 +949,8 @@ static int ima_load_data(enum kernel_load_data_id id, bool contents) > > switch (id) { > case LOADING_KEXEC_IMAGE: > - if (IS_ENABLED(CONFIG_KEXEC_SIG) > - && arch_ima_get_secureboot()) { > + if (IS_ENABLED(CONFIG_KEXEC_SIG) && > + arch_get_secureboot()) { ===> Mimi > pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n"); > return -EACCES; > } ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide 2026-02-09 20:43 ` Mimi Zohar @ 2026-02-12 1:28 ` Coiby Xu 2026-02-12 20:25 ` Mimi Zohar 0 siblings, 1 reply; 7+ messages in thread From: Coiby Xu @ 2026-02-12 1:28 UTC (permalink / raw) To: Mimi Zohar Cc: linux-integrity, Heiko Carstens, Alexander Egorenkov, Ard Biesheuvel, Dave Hansen, Roberto Sassu, Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin, Christophe Leroy (CS GROUP), Vasily Gorbik, Alexander Gordeev, Christian Borntraeger, Sven Schnelle, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin, Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris, Serge E. Hallyn, Jarkko Sakkinen, open list, open list:LINUX FOR POWERPC (32-BIT AND 64-BIT), open list:S390 ARCHITECTURE, open list:EXTENSIBLE FIRMWARE INTERFACE (EFI), open list:SECURITY SUBSYSTEM, open list:KEYS/KEYRINGS_INTEGRITY On Mon, Feb 09, 2026 at 03:43:08PM -0500, Mimi Zohar wrote: >On Tue, 2026-02-03 at 12:14 +0800, Coiby Xu wrote: >> EVM and other LSMs need the ability to query the secure boot status of >> the system, without directly calling the IMA arch_ima_get_secureboot >> function. Refactor the secure boot status check into a general function >> named arch_get_secureboot. >> >> Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com> >> Suggested-by: Roberto Sassu <roberto.sassu@huawei.com> >> Signed-off-by: Coiby Xu <coxu@redhat.com> > >Thanks, Coiby. Other than unnecessarily splitting a line, the patch set looks >good. As soon as the open window closes, I'll queue these patches for linux- >next. Hi Mimi, thanks for reviewing the patch set! Would you like me to send a new version with the line splitting issue fixed? > >> diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c >> index 138029bfcce1..27521d665d33 100644 >> --- a/security/integrity/ima/ima_efi.c >> +++ b/security/integrity/ima/ima_efi.c [...] >> { >> - if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) { >> + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && >> + arch_get_secureboot()) { > >No need to split the line here or below. > > >> if (IS_ENABLED(CONFIG_MODULE_SIG)) >> set_module_sig_enforced(); >> if (IS_ENABLED(CONFIG_KEXEC_SIG)) >> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c >> index 5770cf691912..6d093ac82a45 100644 >> --- a/security/integrity/ima/ima_main.c >> +++ b/security/integrity/ima/ima_main.c >> @@ -949,8 +949,8 @@ static int ima_load_data(enum kernel_load_data_id id, bool contents) >> >> switch (id) { >> case LOADING_KEXEC_IMAGE: >> - if (IS_ENABLED(CONFIG_KEXEC_SIG) >> - && arch_ima_get_secureboot()) { >> + if (IS_ENABLED(CONFIG_KEXEC_SIG) && >> + arch_get_secureboot()) { > >===> > >Mimi > >> pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n"); >> return -EACCES; >> } > -- Best regards, Coiby ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide 2026-02-12 1:28 ` Coiby Xu @ 2026-02-12 20:25 ` Mimi Zohar 0 siblings, 0 replies; 7+ messages in thread From: Mimi Zohar @ 2026-02-12 20:25 UTC (permalink / raw) To: Coiby Xu Cc: linux-integrity, Heiko Carstens, Alexander Egorenkov, Ard Biesheuvel, Dave Hansen, Roberto Sassu, Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin, Christophe Leroy (CS GROUP), Vasily Gorbik, Alexander Gordeev, Christian Borntraeger, Sven Schnelle, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin, Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris, Serge E. Hallyn, Jarkko Sakkinen, open list, open list:LINUX FOR POWERPC (32-BIT AND 64-BIT), open list:S390 ARCHITECTURE, open list:EXTENSIBLE FIRMWARE INTERFACE (EFI), open list:SECURITY SUBSYSTEM, open list:KEYS/KEYRINGS_INTEGRITY On Thu, 2026-02-12 at 09:28 +0800, Coiby Xu wrote: > On Mon, Feb 09, 2026 at 03:43:08PM -0500, Mimi Zohar wrote: > > On Tue, 2026-02-03 at 12:14 +0800, Coiby Xu wrote: > > > EVM and other LSMs need the ability to query the secure boot status of > > > the system, without directly calling the IMA arch_ima_get_secureboot > > > function. Refactor the secure boot status check into a general function > > > named arch_get_secureboot. > > > > > > Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com> > > > Suggested-by: Roberto Sassu <roberto.sassu@huawei.com> > > > Signed-off-by: Coiby Xu <coxu@redhat.com> > > > > Thanks, Coiby. Other than unnecessarily splitting a line, the patch set looks > > good. As soon as the open window closes, I'll queue these patches for linux- > > next. > > Hi Mimi, thanks for reviewing the patch set! Would you like me to send a > new version with the line splitting issue fixed? Yes, thanks. Mimi > > > > > > diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c > > > index 138029bfcce1..27521d665d33 100644 > > > --- a/security/integrity/ima/ima_efi.c > > > +++ b/security/integrity/ima/ima_efi.c > [...] > > > { > > > - if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) { > > > + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && > > > + arch_get_secureboot()) { > > > > No need to split the line here or below. > > > > > > > if (IS_ENABLED(CONFIG_MODULE_SIG)) > > > set_module_sig_enforced(); > > > if (IS_ENABLED(CONFIG_KEXEC_SIG)) > > > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c > > > index 5770cf691912..6d093ac82a45 100644 > > > --- a/security/integrity/ima/ima_main.c > > > +++ b/security/integrity/ima/ima_main.c > > > @@ -949,8 +949,8 @@ static int ima_load_data(enum kernel_load_data_id id, bool contents) > > > > > > switch (id) { > > > case LOADING_KEXEC_IMAGE: > > > - if (IS_ENABLED(CONFIG_KEXEC_SIG) > > > - && arch_ima_get_secureboot()) { > > > + if (IS_ENABLED(CONFIG_KEXEC_SIG) && > > > + arch_get_secureboot()) { > > > > ===> > > > > Mimi > > > > > pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n"); > > > return -EACCES; > > > } > > ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v2 2/3] evm: Don't enable fix mode when secure boot is enabled 2026-02-03 4:14 [PATCH v2 0/3] Make detecting the secure boot status integrity-wide Coiby Xu 2026-02-03 4:14 ` [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide Coiby Xu @ 2026-02-03 4:14 ` Coiby Xu 2026-02-03 4:14 ` [PATCH v2 3/3] s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT Coiby Xu 2 siblings, 0 replies; 7+ messages in thread From: Coiby Xu @ 2026-02-03 4:14 UTC (permalink / raw) To: linux-integrity Cc: Heiko Carstens, Alexander Egorenkov, Ard Biesheuvel, Dave Hansen, Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris, Serge E. Hallyn, open list:SECURITY SUBSYSTEM, open list Similar to IMA fix mode, forbid EVM fix mode when secure boot is enabled. Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com> Suggested-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Coiby Xu <coxu@redhat.com> --- security/integrity/evm/evm_main.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 73d500a375cb..a54cb73b51ee 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -72,17 +72,25 @@ static struct xattr_list evm_config_default_xattrnames[] = { LIST_HEAD(evm_config_xattrnames); +static char *evm_cmdline __initdata; +core_param(evm, evm_cmdline, charp, 0); + static int evm_fixmode __ro_after_init; -static int __init evm_set_fixmode(char *str) +static void __init evm_set_fixmode(void) { - if (strncmp(str, "fix", 3) == 0) - evm_fixmode = 1; - else - pr_err("invalid \"%s\" mode", str); + if (!evm_cmdline) + return; - return 1; + if (strncmp(evm_cmdline, "fix", 3) == 0) { + if (arch_get_secureboot()) { + pr_info("Secure boot enabled: ignoring evm=fix"); + return; + } + evm_fixmode = 1; + } else { + pr_err("invalid \"%s\" mode", evm_cmdline); + } } -__setup("evm=", evm_set_fixmode); static void __init evm_init_config(void) { @@ -1119,6 +1127,8 @@ static int __init init_evm(void) evm_init_config(); + evm_set_fixmode(); + error = integrity_init_keyring(INTEGRITY_KEYRING_EVM); if (error) goto error; -- 2.52.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v2 3/3] s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT 2026-02-03 4:14 [PATCH v2 0/3] Make detecting the secure boot status integrity-wide Coiby Xu 2026-02-03 4:14 ` [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide Coiby Xu 2026-02-03 4:14 ` [PATCH v2 2/3] evm: Don't enable fix mode when secure boot is enabled Coiby Xu @ 2026-02-03 4:14 ` Coiby Xu 2 siblings, 0 replies; 7+ messages in thread From: Coiby Xu @ 2026-02-03 4:14 UTC (permalink / raw) To: linux-integrity Cc: Heiko Carstens, Alexander Egorenkov, Ard Biesheuvel, Dave Hansen, Vasily Gorbik, Alexander Gordeev, Christian Borntraeger, Sven Schnelle, open list:S390 ARCHITECTURE, open list Commit b5ca117365d9 ("ima: prevent kexec_load syscall based on runtime secureboot flag") and commit 268a78404973 ("s390/kexec_file: Disable kexec_load when IPLed secure") disabled the kexec_load syscall based on the secureboot mode. Commit 9e2b4be377f0 ("ima: add a new CONFIG for loading arch-specific policies") needed to detect the secure boot mode, not to load an IMA architecture specific policy. Since there is the new CONFIG_INTEGRITY_SECURE_BOOT, drop CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT for s390. Signed-off-by: Coiby Xu <coxu@redhat.com> --- arch/s390/Kconfig | 1 - arch/s390/kernel/Makefile | 1 - arch/s390/kernel/ima_arch.c | 8 -------- 3 files changed, 10 deletions(-) delete mode 100644 arch/s390/kernel/ima_arch.c diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig index 0e5fad5f06ca..d8e62c67d1ad 100644 --- a/arch/s390/Kconfig +++ b/arch/s390/Kconfig @@ -77,7 +77,6 @@ config S390 # # Note: keep this list sorted alphabetically # - imply IMA_SECURE_AND_OR_TRUSTED_BOOT select ALTERNATE_USER_ADDRESS_SPACE select ARCH_32BIT_USTAT_F_TINODE select ARCH_CORRECT_STACKTRACE_ON_KRETPROBE diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile index 42c83d60d6fa..89a2c8078fe7 100644 --- a/arch/s390/kernel/Makefile +++ b/arch/s390/kernel/Makefile @@ -71,7 +71,6 @@ obj-$(CONFIG_STACKPROTECTOR) += stackprotector.o obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o obj-$(CONFIG_KEXEC_FILE) += kexec_elf.o obj-$(CONFIG_CERT_STORE) += cert_store.o -obj-$(CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT) += ima_arch.o obj-$(CONFIG_PERF_EVENTS) += perf_event.o obj-$(CONFIG_PERF_EVENTS) += perf_cpum_cf.o perf_cpum_sf.o diff --git a/arch/s390/kernel/ima_arch.c b/arch/s390/kernel/ima_arch.c deleted file mode 100644 index 6ccbe34ce408..000000000000 --- a/arch/s390/kernel/ima_arch.c +++ /dev/null @@ -1,8 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 - -#include <linux/ima.h> - -const char * const *arch_get_ima_policy(void) -{ - return NULL; -} -- 2.52.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-02-12 20:26 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-02-03 4:14 [PATCH v2 0/3] Make detecting the secure boot status integrity-wide Coiby Xu 2026-02-03 4:14 ` [PATCH v2 1/3] integrity: Make arch_ima_get_secureboot integrity-wide Coiby Xu 2026-02-09 20:43 ` Mimi Zohar 2026-02-12 1:28 ` Coiby Xu 2026-02-12 20:25 ` Mimi Zohar 2026-02-03 4:14 ` [PATCH v2 2/3] evm: Don't enable fix mode when secure boot is enabled Coiby Xu 2026-02-03 4:14 ` [PATCH v2 3/3] s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT Coiby Xu
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox