Re: [PATCH 1/3] integrity: Make arch_ima_get_secureboot integrity-wide

Dave Hansen
2026-01-19T18:44:20Z

On 1/18/26 10:25, Mimi Zohar wrote:
> As not all arch's implement arch_integrity_get_secureboot, the definition in
> include/linux/integrity.h would need to be updated. Something like:
>
> -#ifdef CONFIG_INTEGRITY_SECURE_BOOT
> +#if (defined(CONFIG_INTEGRITY_SECURE_BOOT) && \
> + (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390) \
> + || defined(CONFIG_PPC_SECURE_BOOT))
>
> Then IMA_SECURE_AND_OR_TRUSTED_BOOT and EVM could select INTEGRITY_SECURE_BOOT,
> as suggested.

This seems to be going a wee bit sideways. :)

This kind of CONFIG complexity really should be left to Kconfig. C
macros really aren't a great place to do it.

The other idiom we use a lot is this in generic code:

#ifndef arch_foo
static inline void arch_foo(void) {}
#endif

Then all you have to do is make sure the arch header that #defines it is
included before the generic code. I'm not a super huge fan of these
because it can be hard to tell (for humans at least) _if_ the
architecture has done the #define.

But it sure beats that #ifdef maze.