Re: [GIT PULL] Please pull powerpc/linux.git powerpc-5.5-1 tag

[Mimi Zohar <zohar@linux.ibm.com>]

On Sat, 2019-11-30 at 14:42 -0800, Linus Torvalds wrote:
> [ Only tangentially related to the power parts ]
> 
> On Sat, Nov 30, 2019 at 2:41 AM Michael Ellerman <mpe@ellerman.id.au> wrote:
> >
> > There's some changes in security/integrity as part of the secure boot work. They
> > were all either written by or acked/reviewed by Mimi.
> 
>   -#if (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390)
>   +#if (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390) \
>   + || defined(CONFIG_PPC_SECURE_BOOT)
> 
> This clearly should be its own CONFIG variable, and be generated by
> having the different architectures just select it.
> 
> IOW, IMA should probably have a
> 
>    config IMA_SECURE_BOOT
> 
> and then s390 would just do the select unconditionally, while x86 and
> ppc would do
> 
>   select IMA_SECURE_BOOT if EFI
> 
> and
> 
>   select IMA_SECURE_BOOT if PPC_SECURE_BOOT
> 
> respectively.
> 
> And then we wouldn't have random architectures adding random "me me me
> tooo!!!" type code.

Agreed, but the naming is a bit off.  The flag somehow needs to take
into account "trusted boot" as well.  On s390, only secure boot is
enabled, at least for the time being.  On x86, both secure and trusted
boot are enabled.  On powerpc, the architecture properly enables
secure and/or trusted boot based on OPAL flags.

It's a bit long, but could the flag be named
IMA_SECURE_AND_OR_TRUSTED_BOOT?

thanks,

Mimi