[PATCH v4 0/2] integrity: Extract secure boot enquiry function out of IMA

[GONG Ruiqi]

v4:
- Rename secureboot.c to efi_secureboot.c, as Mimi suggested.
v3:
- Redesign the implementation. Keep the name of arch_ima_get_secureboot
  to escape from the morass consisted of multiple arch and configs.
- Rephrase the commit message.
v2:
- Fix compile errors for CONFIG_IMA_ARCH_POLICY=n on s390 & powerpc

---

Hi,

We encountered a boot failure issue in an in-house testing, where the
kernel refused to load its modules since it couldn't verify their
signature. The root cause turned out to be the early return of
load_uefi_certs(), where arch_ima_get_secureboot() returned false
unconditionally due to CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=n, even
though the secure boot was enabled.

This patch set attempts to remove this implicit dependency by shifting
the functionality of efi secure boot enquiry from IMA to the integrity
subsystem, so that both certificate loading and IMA can make use of it
independently.

The code has been compile-tested on x86/arm64/powerpc/s390, with as much
as config combinations I can think of.

-Ruiqi

GONG Ruiqi (2):
  x86/efi: Rename IMA-related function and macro of boot mode
  integrity: Extract secure boot enquiry function out of IMA

 arch/x86/include/asm/efi.h                    |  4 +-
 arch/x86/platform/efi/efi.c                   |  2 +-
 include/linux/integrity.h                     |  1 +
 security/integrity/Makefile                   |  1 +
 security/integrity/efi_secureboot.c           | 46 +++++++++++++++++++
 security/integrity/ima/ima_efi.c              | 42 +----------------
 security/integrity/platform_certs/load_uefi.c |  3 +-
 7 files changed, 54 insertions(+), 45 deletions(-)
 create mode 100644 security/integrity/efi_secureboot.c

-- 
2.25.1