Re: [PATCH] ima: defer arch_ima_get_secureboot() call to IMA init time

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Ard,

On Mon, 2020-10-12 at 10:36 +0200, Ard Biesheuvel wrote:
> Chester reports that it is necessary to introduce a new way to pass
> the EFI secure boot status between the EFI stub and the core kernel
> on ARM systems. The usual way of obtaining this information is by
> checking the SecureBoot and SetupMode EFI variables, but this can
> only be done after the EFI variable workqueue is created, which
> occurs in a subsys_initcall(), whereas arch_ima_get_secureboot()
> is called much earlier by the IMA framework.
> 
> However, the IMA framework itself is started as a late_initcall,
> and the only reason the call to arch_ima_get_secureboot() occurs
> so early is because it happens in the context of a __setup()
> callback that parses the ima_appraise= command line parameter.
> 
> So let's refactor this code a little bit, by using a core_param()
> callback to capture the command line argument, and deferring any
> reasoning based on its contents to the IMA init routine.

Other than this patch needing to be on top of commit e4d7e2df3a09
("ima: limit secure boot feedback scope for appraise"), it looks good.

thanks,

Mimi