ima_arch.c 2.3 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394
  1. /* SPDX-License-Identifier: GPL-2.0+ */
  2. /*
  3. * Copyright (C) 2018 IBM Corporation
  4. */
  5. #include <linux/efi.h>
  6. #include <linux/module.h>
  7. #include <linux/ima.h>
  8. extern struct boot_params boot_params;
  9. static enum efi_secureboot_mode get_sb_mode(void)
  10. {
  11. efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
  12. efi_status_t status;
  13. unsigned long size;
  14. u8 secboot, setupmode;
  15. size = sizeof(secboot);
  16. if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {
  17. pr_info("ima: secureboot mode unknown, no efi\n");
  18. return efi_secureboot_mode_unknown;
  19. }
  20. /* Get variable contents into buffer */
  21. status = efi.get_variable(L"SecureBoot", &efi_variable_guid,
  22. NULL, &size, &secboot);
  23. if (status == EFI_NOT_FOUND) {
  24. pr_info("ima: secureboot mode disabled\n");
  25. return efi_secureboot_mode_disabled;
  26. }
  27. if (status != EFI_SUCCESS) {
  28. pr_info("ima: secureboot mode unknown\n");
  29. return efi_secureboot_mode_unknown;
  30. }
  31. size = sizeof(setupmode);
  32. status = efi.get_variable(L"SetupMode", &efi_variable_guid,
  33. NULL, &size, &setupmode);
  34. if (status != EFI_SUCCESS) /* ignore unknown SetupMode */
  35. setupmode = 0;
  36. if (secboot == 0 || setupmode == 1) {
  37. pr_info("ima: secureboot mode disabled\n");
  38. return efi_secureboot_mode_disabled;
  39. }
  40. pr_info("ima: secureboot mode enabled\n");
  41. return efi_secureboot_mode_enabled;
  42. }
  43. bool arch_ima_get_secureboot(void)
  44. {
  45. static enum efi_secureboot_mode sb_mode;
  46. static bool initialized;
  47. if (!initialized && efi_enabled(EFI_BOOT)) {
  48. sb_mode = boot_params.secure_boot;
  49. if (sb_mode == efi_secureboot_mode_unset)
  50. sb_mode = get_sb_mode();
  51. initialized = true;
  52. }
  53. if (sb_mode == efi_secureboot_mode_enabled)
  54. return true;
  55. else
  56. return false;
  57. }
  58. /* secureboot arch rules */
  59. static const char * const sb_arch_rules[] = {
  60. #if !IS_ENABLED(CONFIG_KEXEC_SIG)
  61. "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig",
  62. #endif /* CONFIG_KEXEC_SIG */
  63. "measure func=KEXEC_KERNEL_CHECK",
  64. #if !IS_ENABLED(CONFIG_MODULE_SIG)
  65. "appraise func=MODULE_CHECK appraise_type=imasig",
  66. #endif
  67. "measure func=MODULE_CHECK",
  68. NULL
  69. };
  70. const char * const *arch_get_ima_policy(void)
  71. {
  72. if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
  73. if (IS_ENABLED(CONFIG_MODULE_SIG))
  74. set_module_sig_enforced();
  75. return sb_arch_rules;
  76. }
  77. return NULL;
  78. }