EVM and other LSMs need the ability to query the secure boot status of the system, without directly calling the IMA arch_ima_get_secureboot function. Make arch_ima_get_secureboot integrity-wide.
v2: - drop CONFIG_INTEGRITY_SECURE_BOOT Kconfig option since it "imply INTEGRITY_SECURE_BOOT" is anti-pattern as pointed out by Ard Biesheuvel Coiby Xu (3): integrity: Make arch_ima_get_secureboot integrity-wide evm: Don't enable fix mode when secure boot is enabled s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT MAINTAINERS | 1 + arch/powerpc/kernel/ima_arch.c | 5 -- arch/powerpc/kernel/secure_boot.c | 6 ++ arch/s390/Kconfig | 1 - arch/s390/kernel/Makefile | 1 - arch/s390/kernel/ima_arch.c | 14 ----- arch/s390/kernel/ipl.c | 5 ++ arch/x86/include/asm/efi.h | 4 +- arch/x86/platform/efi/efi.c | 2 +- include/linux/ima.h | 7 +-- include/linux/secure_boot.h | 19 +++++++ security/integrity/Makefile | 3 +- security/integrity/efi_secureboot.c | 56 +++++++++++++++++++ security/integrity/evm/evm_main.c | 24 +++++--- security/integrity/ima/ima_appraise.c | 2 +- security/integrity/ima/ima_efi.c | 48 +--------------- security/integrity/ima/ima_main.c | 4 +- security/integrity/integrity.h | 1 + security/integrity/platform_certs/load_uefi.c | 2 +- security/integrity/secure_boot.c | 16 ++++++ 20 files changed, 134 insertions(+), 87 deletions(-) delete mode 100644 arch/s390/kernel/ima_arch.c create mode 100644 include/linux/secure_boot.h create mode 100644 security/integrity/efi_secureboot.c create mode 100644 security/integrity/secure_boot.c base-commit: 8dfce8991b95d8625d0a1d2896e42f93b9d7f68d -- 2.52.0
