Pull integrity subsystem updates from Mimi Zohar: "The few changes are all kexec related: - The MOK keys are loaded onto the .platform keyring in order to verify the kexec kernel image signature. However, the MOK keys should only be trusted when secure boot is enabled. Before loading the MOK keys onto the .platform keyring, make sure the system is booted in secure boot mode. - When carrying the IMA measurement list across kexec, limit dumping the measurement list to when dynamic debug or CONFIG_DEBUG is enabled. - kselftest: add kexec_file_load selftest support for PowerNV and other cleanup" * tag 'integrity-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: selftests/kexec: Enable secureboot tests for PowerPC ima: silence measurement list hexdump during kexec selftests/kexec: update searching for the Kconfig selftest/kexec: fix "ignored null byte in input" warning integrity: Do not load MOK and MOKx when secure boot be disabled ima: Fix undefined arch_ima_get_secureboot() and co
Unified · Split
| @@ -50,21 +50,6 @@ static inline void ima_appraise_parse_cmdline(void) {} · 49 unmodified lines | ||
| 50 | 50 | extern void ima_add_kexec_buffer(struct kimage *image); |
| 51 | 51 | #endif |
| 52 | 52 | |
| 53 | −#ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT | |
| 54 | −extern bool arch_ima_get_secureboot(void); | |
| 55 | −extern const char * const *arch_get_ima_policy(void); | |
| 56 | −#else | |
| 57 | −static inline bool arch_ima_get_secureboot(void) | |
| 58 | −{ | |
| 59 | − return false; | |
| 60 | −} | |
| 61 | − | |
| 62 | −static inline const char * const *arch_get_ima_policy(void) | |
| 63 | −{ | |
| 64 | − return NULL; | |
| 65 | −} | |
| 66 | −#endif | |
| 67 | − | |
| 68 | 53 | #else |
| 69 | 54 | static inline enum hash_algo ima_get_current_hash_algo(void) |
| 70 | 55 | { |
| @@ -155,6 +140,21 @@ static inline int ima_measure_critical_data(const char *event_label, · 84 unmodified lines | ||
| 155 | 140 | |
| 156 | 141 | #endif /* CONFIG_IMA */ |
| 157 | 142 | |
| 143 | +#ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT | |
| 144 | +extern bool arch_ima_get_secureboot(void); | |
| 145 | +extern const char * const *arch_get_ima_policy(void); | |
| 146 | +#else | |
| 147 | +static inline bool arch_ima_get_secureboot(void) | |
| 148 | +{ | |
| 149 | + return false; | |
| 150 | +} | |
| 151 | + | |
| 152 | +static inline const char * const *arch_get_ima_policy(void) | |
| 153 | +{ | |
| 154 | + return NULL; | |
| 155 | +} | |
| 156 | +#endif | |
| 157 | + | |
| 158 | 158 | #ifndef CONFIG_IMA_KEXEC |
| 159 | 159 | struct kimage; |
| 160 | 160 | |
| @@ -61,9 +61,9 @@ static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer, · 60 unmodified lines | ||
| 61 | 61 | } |
| 62 | 62 | memcpy(file.buf, &khdr, sizeof(khdr)); |
| 63 | 63 | |
| 64 | − print_hex_dump(KERN_DEBUG, "ima dump: ", DUMP_PREFIX_NONE, | |
| 65 | − 16, 1, file.buf, | |
| 66 | − file.count < 100 ? file.count : 100, true); | |
| 64 | + print_hex_dump_debug("ima dump: ", DUMP_PREFIX_NONE, 16, 1, | |
| 65 | + file.buf, file.count < 100 ? file.count : 100, | |
| 66 | + true); | |
| 67 | 67 | |
| 68 | 68 | *buffer_size = file.count; |
| 69 | 69 | *buffer = file.buf; |
| @@ -6,6 +6,7 @@ · 5 unmodified lines | ||
| 6 | 6 | #include <linux/err.h> |
| 7 | 7 | #include <linux/efi.h> |
| 8 | 8 | #include <linux/slab.h> |
| 9 | +#include <linux/ima.h> | |
| 9 | 10 | #include <keys/asymmetric-type.h> |
| 10 | 11 | #include <keys/system_keyring.h> |
| 11 | 12 | #include "../integrity.h" |
| @@ -176,6 +177,10 @@ static int __init load_uefi_certs(void) · 164 unmodified lines | ||
| 176 | 177 | kfree(dbx); |
| 177 | 178 | } |
| 178 | 179 | |
| 180 | + /* the MOK/MOKx can not be trusted when secure boot is disabled */ | |
| 181 | + if (!arch_ima_get_secureboot()) | |
| 182 | + return 0; | |
| 183 | + | |
| 179 | 184 | mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status); |
| 180 | 185 | if (!mokx) { |
| 181 | 186 | if (status == EFI_NOT_FOUND) |
| @@ -4,7 +4,7 @@ · 3 unmodified lines | ||
| 4 | 4 | uname_M := $(shell uname -m 2>/dev/null || echo not) |
| 5 | 5 | ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/) |
| 6 | 6 | |
| 7 | −ifeq ($(ARCH),x86) | |
| 7 | +ifeq ($(ARCH),$(filter $(ARCH),x86 ppc64le)) | |
| 8 | 8 | TEST_PROGS := test_kexec_load.sh test_kexec_file_load.sh |
| 9 | 9 | TEST_FILES := kexec_common_lib.sh |
| 10 | 10 | |
| @@ -91,6 +91,27 @@ get_efi_var_secureboot_mode() · 90 unmodified lines | ||
| 91 | 91 | return 0; |
| 92 | 92 | } |
| 93 | 93 | |
| 94 | +# On powerpc platform, check device-tree property | |
| 95 | +# /proc/device-tree/ibm,secureboot/os-secureboot-enforcing | |
| 96 | +# to detect secureboot state. | |
| 97 | +get_ppc64_secureboot_mode() | |
| 98 | +{ | |
| 99 | + local secure_boot_file="/proc/device-tree/ibm,secureboot/os-secureboot-enforcing" | |
| 100 | + # Check for secure boot file existence | |
| 101 | + if [ -f $secure_boot_file ]; then | |
| 102 | + log_info "Secureboot is enabled (Device tree)" | |
| 103 | + return 1; | |
| 104 | + fi | |
| 105 | + log_info "Secureboot is not enabled (Device tree)" | |
| 106 | + return 0; | |
| 107 | +} | |
| 108 | + | |
| 109 | +# Return the architecture of the system | |
| 110 | +get_arch() | |
| 111 | +{ | |
| 112 | + echo $(arch) | |
| 113 | +} | |
| 114 | + | |
| 94 | 115 | # Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID). |
| 95 | 116 | # The secure boot mode can be accessed either as the last integer |
| 96 | 117 | # of "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*" or from |
| @@ -100,14 +121,19 @@ get_efi_var_secureboot_mode() · 3 unmodified lines | ||
| 100 | 121 | get_secureboot_mode() |
| 101 | 122 | { |
| 102 | 123 | local secureboot_mode=0 |
| 124 | + local system_arch=$(get_arch) | |
| 103 | 125 | |
| 104 | − get_efivarfs_secureboot_mode | |
| 105 | − secureboot_mode=$? | |
| 106 | − | |
| 107 | − # fallback to using the efi_var files | |
| 108 | − if [ $secureboot_mode -eq 0 ]; then | |
| 109 | − get_efi_var_secureboot_mode | |
| 126 | + if [ "$system_arch" == "ppc64le" ]; then | |
| 127 | + get_ppc64_secureboot_mode | |
| 128 | + secureboot_mode=$? | |
| 129 | + else | |
| 130 | + get_efivarfs_secureboot_mode | |
| 110 | 131 | secureboot_mode=$? |
| 132 | + # fallback to using the efi_var files | |
| 133 | + if [ $secureboot_mode -eq 0 ]; then | |
| 134 | + get_efi_var_secureboot_mode | |
| 135 | + secureboot_mode=$? | |
| 136 | + fi | |
| 111 | 137 | fi |
| 112 | 138 | |
| 113 | 139 | if [ $secureboot_mode -eq 0 ]; then |
| @@ -138,15 +164,20 @@ kconfig_enabled() · 24 unmodified lines | ||
| 138 | 164 | return 0 |
| 139 | 165 | } |
| 140 | 166 | |
| 141 | −# Attempt to get the kernel config first via proc, and then by | |
| 142 | −# extracting it from the kernel image or the configs.ko using | |
| 143 | −# scripts/extract-ikconfig. | |
| 167 | +# Attempt to get the kernel config first by checking the modules directory | |
| 168 | +# then via proc, and finally by extracting it from the kernel image or the | |
| 169 | +# configs.ko using scripts/extract-ikconfig. | |
| 144 | 170 | # Return 1 for found. |
| 145 | 171 | get_kconfig() |
| 146 | 172 | { |
| 147 | 173 | local proc_config="/proc/config.gz" |
| 148 | 174 | local module_dir="/lib/modules/`uname -r`" |
| 149 | − local configs_module="$module_dir/kernel/kernel/configs.ko" | |
| 175 | + local configs_module="$module_dir/kernel/kernel/configs.ko*" | |
| 176 | + | |
| 177 | + if [ -f $module_dir/config ]; then | |
| 178 | + IKCONFIG=$module_dir/config | |
| 179 | + return 1 | |
| 180 | + fi | |
| 150 | 181 | |
| 151 | 182 | if [ ! -f $proc_config ]; then |
| 152 | 183 | modprobe configs > /dev/null 2>&1 |
| @@ -97,10 +97,11 @@ check_for_imasig() · 96 unmodified lines | ||
| 97 | 97 | check_for_modsig() |
| 98 | 98 | { |
| 99 | 99 | local module_sig_string="~Module signature appended~" |
| 100 | − local sig="$(tail --bytes $((${#module_sig_string} + 1)) $KERNEL_IMAGE)" | |
| 101 | 100 | local ret=0 |
| 102 | 101 | |
| 103 | − if [ "$sig" == "$module_sig_string" ]; then | |
| 102 | + tail --bytes $((${#module_sig_string} + 1)) $KERNEL_IMAGE | \ | |
| 103 | + grep -q "$module_sig_string" | |
| 104 | + if [ $? -eq 0 ]; then | |
| 104 | 105 | ret=1 |
| 105 | 106 | log_info "kexec kernel image modsig signed" |
| 106 | 107 | else |
| @@ -225,8 +226,12 @@ get_secureboot_mode · 118 unmodified lines | ||
| 225 | 226 | secureboot=$? |
| 226 | 227 | |
| 227 | 228 | # Are there pe and ima signatures |
| 228 | −check_for_pesig | |
| 229 | −pe_signed=$? | |
| 229 | +if [ "$(get_arch)" == 'ppc64le' ]; then | |
| 230 | + pe_signed=0 | |
| 231 | +else | |
| 232 | + check_for_pesig | |
| 233 | + pe_signed=$? | |
| 234 | +fi | |
| 230 | 235 | |
| 231 | 236 | check_for_imasig |
| 232 | 237 | ima_signed=$? |