wire up IMA secure boot for arm64
Get series with b4
b4 am [email protected]Versions newest first
- v4 Latest3 patches 12 repliesIn review
Patches in v4 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | efi: generalize efi_get_securebootarch/ drivers/ drivers/ +1 more | +40 | 3 replies | |
| 2/3 | ima: generalize x86/EFI arch glue for other EFI architecturesarch/ arch/ security/ +1 more | +19 | 2 replies | |
| 3/3 | arm64/ima: add ima_arch supportarch/ | +1 | 1 reply |
Reviews trailers per patch
1 of 3 patches has a Reviewed-by or Acked-by of their own; the series has one for all of them.
| Patch | Mimi Zohar | Catalin Marinas |
|---|---|---|
| Series | A-b | |
| 1/3 | ||
| 2/3 | ||
| 3/3 | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v4 0/3] wire up IMA secure boot for arm64
This is a follow-up to Chester's series [0] to enable IMA to the secure boot state of arm64 platforms, which is EFI based.
This v4 implements the changes I suggested to Chester, in particular:
- disregard MokSbState when factoring out secure boot mode discovery
- turn the x86 IMA arch code into shared code for all architectures.
This reduces the final patch to a one liner enabling a Kconfig option for arm64 when EFI is enabled.
Build tested only.
[0] https://lore.kernel.org/linux-arm-kernel/[email protected]/
Chester Lin (3):
efi: generalize efi_get_secureboot
ima: generalize x86/EFI arch glue for other EFI architectures arm64/ima: add ima_arch support
arch/arm64/Kconfig | 1 + arch/x86/boot/compressed/Makefile | 2 +- arch/x86/include/asm/efi.h | 3 ++ arch/x86/kernel/Makefile | 2 - drivers/firmware/efi/libstub/efistub.h | 2 + drivers/firmware/efi/libstub/secureboot.c | 41 +++++++---------- include/linux/efi.h | 23 +++++++++- security/integrity/ima/Makefile | 4 ++ .../integrity/ima/ima_efi.c | 45 +++++-------------- 9 files changed, 60 insertions(+), 63 deletions(-) rename arch/x86/kernel/ima_arch.c => security/integrity/ima/ima_efi.c (60%)
Signature · 1 line
2.17.1