* [PATCH 9/9] integrity: check properly whether EFI GetVariable() is available
[not found] <20200219171907.11894-1-ardb@kernel.org>
@ 2020-02-19 17:19 ` Ard Biesheuvel
2020-02-19 20:46 ` Serge E. Hallyn
0 siblings, 1 reply; 4+ messages in thread
From: Ard Biesheuvel @ 2020-02-19 17:19 UTC (permalink / raw)
To: linux-efi
Cc: Ard Biesheuvel, Leif Lindholm, Peter Jones, Alexander Graf,
Heinrich Schuchardt, Jeff Brasen, Atish Patra, x86, James Morris,
Serge E. Hallyn, linux-security-module
Testing the value of the efi.get_variable function pointer is not
the right way to establish whether the platform supports EFI
variables at runtime. Instead, use the newly added granular check
that can test for the presence of each EFI runtime service
individually.
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: linux-security-module@vger.kernel.org
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
security/integrity/platform_certs/load_uefi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index 111898aad56e..e2fe1bd3abb9 100644
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -76,7 +76,7 @@ static int __init load_uefi_certs(void)
unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
int rc = 0;
- if (!efi.get_variable)
+ if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
return false;
/* Get db, MokListRT, and dbx. They might not exist, so it isn't
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 9/9] integrity: check properly whether EFI GetVariable() is available
2020-02-19 17:19 ` [PATCH 9/9] integrity: check properly whether EFI GetVariable() is available Ard Biesheuvel
@ 2020-02-19 20:46 ` Serge E. Hallyn
2020-02-19 21:00 ` Ard Biesheuvel
0 siblings, 1 reply; 4+ messages in thread
From: Serge E. Hallyn @ 2020-02-19 20:46 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: linux-efi, Leif Lindholm, Peter Jones, Alexander Graf,
Heinrich Schuchardt, Jeff Brasen, Atish Patra, x86, James Morris,
Serge E. Hallyn, linux-security-module
On Wed, Feb 19, 2020 at 06:19:07PM +0100, Ard Biesheuvel wrote:
> Testing the value of the efi.get_variable function pointer is not
> the right way to establish whether the platform supports EFI
> variables at runtime. Instead, use the newly added granular check
> that can test for the presence of each EFI runtime service
> individually.
>
> Cc: James Morris <jmorris@namei.org>
> Cc: "Serge E. Hallyn" <serge@hallyn.com>
> Cc: linux-security-module@vger.kernel.org
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
> security/integrity/platform_certs/load_uefi.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> index 111898aad56e..e2fe1bd3abb9 100644
> --- a/security/integrity/platform_certs/load_uefi.c
> +++ b/security/integrity/platform_certs/load_uefi.c
> @@ -76,7 +76,7 @@ static int __init load_uefi_certs(void)
> unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
> int rc = 0;
>
> - if (!efi.get_variable)
> + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
Sorry, where is this defined?
> return false;
>
> /* Get db, MokListRT, and dbx. They might not exist, so it isn't
> --
> 2.17.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 9/9] integrity: check properly whether EFI GetVariable() is available
2020-02-19 20:46 ` Serge E. Hallyn
@ 2020-02-19 21:00 ` Ard Biesheuvel
2020-02-20 3:19 ` Serge E. Hallyn
0 siblings, 1 reply; 4+ messages in thread
From: Ard Biesheuvel @ 2020-02-19 21:00 UTC (permalink / raw)
To: Serge E. Hallyn
Cc: linux-efi, Leif Lindholm, Peter Jones, Alexander Graf,
Heinrich Schuchardt, Jeff Brasen, Atish Patra,
the arch/x86 maintainers, James Morris, linux-security-module
On Wed, 19 Feb 2020 at 21:46, Serge E. Hallyn <serge@hallyn.com> wrote:
>
> On Wed, Feb 19, 2020 at 06:19:07PM +0100, Ard Biesheuvel wrote:
> > Testing the value of the efi.get_variable function pointer is not
> > the right way to establish whether the platform supports EFI
> > variables at runtime. Instead, use the newly added granular check
> > that can test for the presence of each EFI runtime service
> > individually.
> >
> > Cc: James Morris <jmorris@namei.org>
> > Cc: "Serge E. Hallyn" <serge@hallyn.com>
> > Cc: linux-security-module@vger.kernel.org
> > Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> > ---
> > security/integrity/platform_certs/load_uefi.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> > index 111898aad56e..e2fe1bd3abb9 100644
> > --- a/security/integrity/platform_certs/load_uefi.c
> > +++ b/security/integrity/platform_certs/load_uefi.c
> > @@ -76,7 +76,7 @@ static int __init load_uefi_certs(void)
> > unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
> > int rc = 0;
> >
> > - if (!efi.get_variable)
> > + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
>
> Sorry, where is this defined?
>
Apologies, I failed to cc everyone on the whole series.
It is defined in the first patch.
https://lore.kernel.org/linux-efi/20200219171907.11894-1-ardb@kernel.org/
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 9/9] integrity: check properly whether EFI GetVariable() is available
2020-02-19 21:00 ` Ard Biesheuvel
@ 2020-02-20 3:19 ` Serge E. Hallyn
0 siblings, 0 replies; 4+ messages in thread
From: Serge E. Hallyn @ 2020-02-20 3:19 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: Serge E. Hallyn, linux-efi, Leif Lindholm, Peter Jones,
Alexander Graf, Heinrich Schuchardt, Jeff Brasen, Atish Patra,
the arch/x86 maintainers, James Morris, linux-security-module
On Wed, Feb 19, 2020 at 10:00:11PM +0100, Ard Biesheuvel wrote:
> On Wed, 19 Feb 2020 at 21:46, Serge E. Hallyn <serge@hallyn.com> wrote:
> >
> > On Wed, Feb 19, 2020 at 06:19:07PM +0100, Ard Biesheuvel wrote:
> > > Testing the value of the efi.get_variable function pointer is not
> > > the right way to establish whether the platform supports EFI
> > > variables at runtime. Instead, use the newly added granular check
> > > that can test for the presence of each EFI runtime service
> > > individually.
> > >
> > > Cc: James Morris <jmorris@namei.org>
> > > Cc: "Serge E. Hallyn" <serge@hallyn.com>
> > > Cc: linux-security-module@vger.kernel.org
> > > Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> > > ---
> > > security/integrity/platform_certs/load_uefi.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> > > index 111898aad56e..e2fe1bd3abb9 100644
> > > --- a/security/integrity/platform_certs/load_uefi.c
> > > +++ b/security/integrity/platform_certs/load_uefi.c
> > > @@ -76,7 +76,7 @@ static int __init load_uefi_certs(void)
> > > unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
> > > int rc = 0;
> > >
> > > - if (!efi.get_variable)
> > > + if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
> >
> > Sorry, where is this defined?
> >
>
> Apologies, I failed to cc everyone on the whole series.
>
> It is defined in the first patch.
>
> https://lore.kernel.org/linux-efi/20200219171907.11894-1-ardb@kernel.org/
Gotcha, thanks, I shoulda get-lore-mbox'ed it :)
Acked-by: Serge Hallyn <serge@hallyn.com>
thanks,
-serge
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-02-20 3:19 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20200219171907.11894-1-ardb@kernel.org>
2020-02-19 17:19 ` [PATCH 9/9] integrity: check properly whether EFI GetVariable() is available Ard Biesheuvel
2020-02-19 20:46 ` Serge E. Hallyn
2020-02-19 21:00 ` Ard Biesheuvel
2020-02-20 3:19 ` Serge E. Hallyn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).