On Tue, 2026-02-03 at 12:14 +0800, Coiby Xu wrote:
> EVM and other LSMs need the ability to query the secure boot status of
> the system, without directly calling the IMA arch_ima_get_secureboot
> function. Refactor the secure boot status check into a general function
> named arch_get_secureboot.
>
> Reported-and-suggested-by: Mimi Zohar <[email protected]>
> Suggested-by: Roberto Sassu <[email protected]>
> Signed-off-by: Coiby Xu <[email protected]>
Thanks, Coiby. Other than unnecessarily splitting a line, the patch set looks
good. As soon as the open window closes, I'll queue these patches for linux-
next.
> diff --git a/security/integrity/ima/ima_efi.c
> b/security/integrity/ima/ima_efi.c
> index 138029bfcce1..27521d665d33 100644
> --- a/security/integrity/ima/ima_efi.c
> +++ b/security/integrity/ima/ima_efi.c
> @@ -2,52 +2,9 @@
> /*
> * Copyright (C) 2018 IBM Corporation
> */
> -#include <linux/efi.h>
> #include <linux/module.h>
> #include <linux/ima.h>
> -#include <asm/efi.h>
> -
> -#ifndef arch_ima_efi_boot_mode
> -#define arch_ima_efi_boot_mode efi_secureboot_mode_unset
> -#endif
> -
> -static enum efi_secureboot_mode get_sb_mode(void)
> -{
> - enum efi_secureboot_mode mode;
> -
> - if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {
> - pr_info("ima: secureboot mode unknown, no efi\n");
> - return efi_secureboot_mode_unknown;
> - }
> -
> - mode = efi_get_secureboot_mode(efi.get_variable);
> - if (mode == efi_secureboot_mode_disabled)
> - pr_info("ima: secureboot mode disabled\n");
> - else if (mode == efi_secureboot_mode_unknown)
> - pr_info("ima: secureboot mode unknown\n");
> - else
> - pr_info("ima: secureboot mode enabled\n");
> - return mode;
> -}
> -
> -bool arch_ima_get_secureboot(void)
> -{
> - static enum efi_secureboot_mode sb_mode;
> - static bool initialized;
> -
> - if (!initialized && efi_enabled(EFI_BOOT)) {
> - sb_mode = arch_ima_efi_boot_mode;
> -
> - if (sb_mode == efi_secureboot_mode_unset)
> - sb_mode = get_sb_mode();
> - initialized = true;
> - }
> -
> - if (sb_mode == efi_secureboot_mode_enabled)
> - return true;
> - else
> - return false;
> -}
> +#include <linux/secure_boot.h>
>
> /* secureboot arch rules */
> static const char * const sb_arch_rules[] = {
> @@ -67,7 +24,8 @@ static const char * const sb_arch_rules[] = {
>
> const char * const *arch_get_ima_policy(void)
> {
> - if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
> + if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) &&
> + arch_get_secureboot()) {
No need to split the line here or below.
> if (IS_ENABLED(CONFIG_MODULE_SIG))
> set_module_sig_enforced();
> if (IS_ENABLED(CONFIG_KEXEC_SIG))
> diff --git a/security/integrity/ima/ima_main.c
> b/security/integrity/ima/ima_main.c
> index 5770cf691912..6d093ac82a45 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -949,8 +949,8 @@ static int ima_load_data(enum kernel_load_data_id id,
> bool contents)
>
> switch (id) {
> case LOADING_KEXEC_IMAGE:
> - if (IS_ENABLED(CONFIG_KEXEC_SIG)
> - && arch_ima_get_secureboot()) {
> + if (IS_ENABLED(CONFIG_KEXEC_SIG) &&
> + arch_get_secureboot()) {
===>
Mimi
> pr_err("impossible to appraise a kernel image without a
> file descriptor; try using kexec_file_load syscall.\n");
> return -EACCES;
> }
