x86/ima: check EFI SetupMode too

PATCH New Mimi Zohar 1 participant 1 message May 20, 2019

Subsystems (2)

x86 Keys-trusted

lore

Share & tools

lore

Mimi Zohar

author maintainer

2019-05-20 12:54 UTC #0 lore raw

PATCH 1/1 x86/ima: check EFI SetupMode too

Checking "SecureBoot" mode is not sufficient, also check "SetupMode".

Fixes 399574c64eaf ("x86/ima: retry detecting secure boot mode")

Reported-by Matthew Garrett <[email protected]>

Signed-off-by Mimi Zohar <[email protected]>

---
 arch/x86/kernel/ima_arch.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

arch/x86/kernel/ima_arch.c +10 -2

index 64b973f0e985..4c407833faca 100644
@@ -11,10 +11,11 @@ extern struct boot_params boot_params;
 static enum efi_secureboot_mode get_sb_mode(void)
 {
 	efi_char16_t efi_SecureBoot_name[] = L"SecureBoot";
+	efi_char16_t efi_SetupMode_name[] = L"SecureBoot";
 	efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
 	efi_status_t status;
 	unsigned long size;
-	u8 secboot;
+	u8 secboot, setupmode;
 
 	size = sizeof(secboot);

@@ -36,7 +37,14 @@ static enum efi_secureboot_mode get_sb_mode(void)
 		return efi_secureboot_mode_unknown;
 	}
 
-	if (secboot == 0) {
+	size = sizeof(setupmode);
+	status = efi.get_variable(efi_SetupMode_name, &efi_variable_guid,
+				  NULL, &size, &setupmode);
+
+	if (status != EFI_SUCCESS)	/* ignore unknown SetupMode */
+		setupmode = 0;
+
+	if (secboot == 0 || setupmode == 1) {
 		pr_info("ima: secureboot mode disabled\n");
 		return efi_secureboot_mode_disabled;
 	}

Signature · 1 line

2.7.5