Message ID | 1466057121-17416-1-git-send-email-tim.gardner@canonical.com |
---|---|
State | New |
Headers | show |
On 16/06/16 09:05, Tim Gardner wrote: > BugLink: http://bugs.launchpad.net/bugs/1593075 > > This is a better method for detecting the state of secure boot and > the MOKSBState override, as opposed to grepping status from the kernel log. > Both variables return 0 or 1. If secure_boot==0 then signed module enforcement > is not enabled. Likewise, if moksbstate_disabled==1 then signed module > enforcement is not enabled. The only conditions uder which signed module > enforcement is enabled is when secure_boot==1 and moksbstate_disabled==0. > > /proc/sys/kernel/secure_boot > /proc/sys/kernel/moksbstate_disabled > > Signed-off-by: Tim Gardner <tim.gardner@canonical.com> > --- > arch/x86/kernel/setup.c | 1 + > kernel/sysctl.c | 39 +++++++++++++++++++++++++++++++++++++++ > 2 files changed, 40 insertions(+) > > diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c > index be173c2..b815923 100644 > --- a/arch/x86/kernel/setup.c > +++ b/arch/x86/kernel/setup.c > @@ -1150,6 +1150,7 @@ void __init setup_arch(char **cmdline_p) > pr_info("Secure boot enabled\n"); > } > else if (boot_params.secure_boot == EFI_MOKSBSTATE_DISABLED) { > + set_bit(EFI_MOKSBSTATE_DISABLED, &efi.flags); > boot_params.secure_boot = 0; > pr_info("Secure boot MOKSBState disabled\n"); > } > diff --git a/kernel/sysctl.c b/kernel/sysctl.c > index 4a7683b..61c2fbc 100644 > --- a/kernel/sysctl.c > +++ b/kernel/sysctl.c > @@ -65,6 +65,7 @@ > #include <linux/sched/sysctl.h> > #include <linux/kexec.h> > #include <linux/bpf.h> > +#include <linux/efi.h> > > #include <asm/uaccess.h> > #include <asm/processor.h> > @@ -279,8 +280,46 @@ static int min_extfrag_threshold; > static int max_extfrag_threshold = 1000; > #endif > > +static unsigned int secure_boot_enabled; > +int secure_boot_proc_handler(struct ctl_table *table, int write, > + void __user *buffer, size_t *lenp, loff_t *ppos) > +{ > + int error = -1; > + > + if (write) return error; > + secure_boot_enabled = efi_enabled(EFI_SECURE_BOOT); > + error = proc_dointvec(table, write, buffer, lenp, ppos); > + return error; > +} > + > +static unsigned int moksbstate_disabled; > +int moksbstate_disabled_proc_handler(struct ctl_table *table, int write, > + void __user *buffer, size_t *lenp, loff_t *ppos) > +{ > + int error = -1; > + > + if (write) return error; > + moksbstate_disabled = efi_enabled(EFI_MOKSBSTATE_DISABLED); > + error = proc_dointvec(table, write, buffer, lenp, ppos); > + return error; > +} > + > static struct ctl_table kern_table[] = { > { > + .procname = "secure_boot", > + .data = &secure_boot_enabled, > + .maxlen = sizeof(unsigned int), > + .mode = 0444, > + .proc_handler = secure_boot_proc_handler, > + }, > + { > + .procname = "moksbstate_disabled", > + .data = &moksbstate_disabled, > + .maxlen = sizeof(unsigned int), > + .mode = 0444, > + .proc_handler = moksbstate_disabled_proc_handler, > + }, > + { > .procname = "sched_child_runs_first", > .data = &sysctl_sched_child_runs_first, > .maxlen = sizeof(unsigned int), > checkpatch complains about style: ERROR: trailing statements should be on next line #138: FILE: kernel/sysctl.c:289: + if (write) return error; ERROR: trailing statements should be on next line #150: FILE: kernel/sysctl.c:301: + if (write) return error;
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c index be173c2..b815923 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -1150,6 +1150,7 @@ void __init setup_arch(char **cmdline_p) pr_info("Secure boot enabled\n"); } else if (boot_params.secure_boot == EFI_MOKSBSTATE_DISABLED) { + set_bit(EFI_MOKSBSTATE_DISABLED, &efi.flags); boot_params.secure_boot = 0; pr_info("Secure boot MOKSBState disabled\n"); } diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 4a7683b..61c2fbc 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -65,6 +65,7 @@ #include <linux/sched/sysctl.h> #include <linux/kexec.h> #include <linux/bpf.h> +#include <linux/efi.h> #include <asm/uaccess.h> #include <asm/processor.h> @@ -279,8 +280,46 @@ static int min_extfrag_threshold; static int max_extfrag_threshold = 1000; #endif +static unsigned int secure_boot_enabled; +int secure_boot_proc_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + int error = -1; + + if (write) return error; + secure_boot_enabled = efi_enabled(EFI_SECURE_BOOT); + error = proc_dointvec(table, write, buffer, lenp, ppos); + return error; +} + +static unsigned int moksbstate_disabled; +int moksbstate_disabled_proc_handler(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + int error = -1; + + if (write) return error; + moksbstate_disabled = efi_enabled(EFI_MOKSBSTATE_DISABLED); + error = proc_dointvec(table, write, buffer, lenp, ppos); + return error; +} + static struct ctl_table kern_table[] = { { + .procname = "secure_boot", + .data = &secure_boot_enabled, + .maxlen = sizeof(unsigned int), + .mode = 0444, + .proc_handler = secure_boot_proc_handler, + }, + { + .procname = "moksbstate_disabled", + .data = &moksbstate_disabled, + .maxlen = sizeof(unsigned int), + .mode = 0444, + .proc_handler = moksbstate_disabled_proc_handler, + }, + { .procname = "sched_child_runs_first", .data = &sysctl_sched_child_runs_first, .maxlen = sizeof(unsigned int),
BugLink: http://bugs.launchpad.net/bugs/1593075 This is a better method for detecting the state of secure boot and the MOKSBState override, as opposed to grepping status from the kernel log. Both variables return 0 or 1. If secure_boot==0 then signed module enforcement is not enabled. Likewise, if moksbstate_disabled==1 then signed module enforcement is not enabled. The only conditions uder which signed module enforcement is enabled is when secure_boot==1 and moksbstate_disabled==0. /proc/sys/kernel/secure_boot /proc/sys/kernel/moksbstate_disabled Signed-off-by: Tim Gardner <tim.gardner@canonical.com> --- arch/x86/kernel/setup.c | 1 + kernel/sysctl.c | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+)