Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
Pull IMA fixes from Mimi Zohar:
"Two bug fixes and an associated change for each.
The one that adds SM3 to the IMA list of supported hash algorithms is
a simple change, but could be considered a new feature"
* 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
ima: add sm3 algorithm to hash algorithm configuration list
crypto: rename sm3-256 to sm3 in hash_algo_name
efi: Only print errors about failing to get certs if EFI vars are found
x86/ima: use correct identifier for SetupMode variable
+34
-19
+2
-4
arch/x86/kernel/ima_arch.c
+2
-4
arch/x86/kernel/ima_arch.c
···
10
10
11
11
static enum efi_secureboot_mode get_sb_mode(void)
12
12
{
13
-
efi_char16_t efi_SecureBoot_name[] = L"SecureBoot";
14
-
efi_char16_t efi_SetupMode_name[] = L"SecureBoot";
15
13
efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
16
14
efi_status_t status;
17
15
unsigned long size;
···
23
25
}
24
26
25
27
/* Get variable contents into buffer */
26
-
status = efi.get_variable(efi_SecureBoot_name, &efi_variable_guid,
28
+
status = efi.get_variable(L"SecureBoot", &efi_variable_guid,
27
29
NULL, &size, &secboot);
28
30
if (status == EFI_NOT_FOUND) {
29
31
pr_info("ima: secureboot mode disabled\n");
···
36
38
}
37
39
38
40
size = sizeof(setupmode);
39
-
status = efi.get_variable(efi_SetupMode_name, &efi_variable_guid,
41
+
status = efi.get_variable(L"SetupMode", &efi_variable_guid,
40
42
NULL, &size, &setupmode);
41
43
42
44
if (status != EFI_SUCCESS) /* ignore unknown SetupMode */
+1
-1
crypto/hash_info.c
+1
-1
crypto/hash_info.c
+5
security/integrity/ima/Kconfig
+5
security/integrity/ima/Kconfig
···
112
112
config IMA_DEFAULT_HASH_WP512
113
113
bool "WP512"
114
114
depends on CRYPTO_WP512=y && !IMA_TEMPLATE
115
+
116
+
config IMA_DEFAULT_HASH_SM3
117
+
bool "SM3"
118
+
depends on CRYPTO_SM3=y && !IMA_TEMPLATE
115
119
endchoice
116
120
117
121
config IMA_DEFAULT_HASH
···
125
121
default "sha256" if IMA_DEFAULT_HASH_SHA256
126
122
default "sha512" if IMA_DEFAULT_HASH_SHA512
127
123
default "wp512" if IMA_DEFAULT_HASH_WP512
124
+
default "sm3" if IMA_DEFAULT_HASH_SM3
128
125
129
126
config IMA_WRITE_POLICY
130
127
bool "Enable multiple writes to the IMA policy"
+26
-14
security/integrity/platform_certs/load_uefi.c
+26
-14
security/integrity/platform_certs/load_uefi.c
···
35
35
* Get a certificate list blob from the named EFI variable.
36
36
*/
37
37
static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
38
-
unsigned long *size)
38
+
unsigned long *size, efi_status_t *status)
39
39
{
40
-
efi_status_t status;
41
40
unsigned long lsize = 4;
42
41
unsigned long tmpdb[4];
43
42
void *db;
44
43
45
-
status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
46
-
if (status != EFI_BUFFER_TOO_SMALL) {
47
-
pr_err("Couldn't get size: 0x%lx\n", status);
44
+
*status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
45
+
if (*status == EFI_NOT_FOUND)
46
+
return NULL;
47
+
48
+
if (*status != EFI_BUFFER_TOO_SMALL) {
49
+
pr_err("Couldn't get size: 0x%lx\n", *status);
48
50
return NULL;
49
51
}
50
52
···
54
52
if (!db)
55
53
return NULL;
56
54
57
-
status = efi.get_variable(name, guid, NULL, &lsize, db);
58
-
if (status != EFI_SUCCESS) {
55
+
*status = efi.get_variable(name, guid, NULL, &lsize, db);
56
+
if (*status != EFI_SUCCESS) {
59
57
kfree(db);
60
-
pr_err("Error reading db var: 0x%lx\n", status);
58
+
pr_err("Error reading db var: 0x%lx\n", *status);
61
59
return NULL;
62
60
}
63
61
···
76
74
efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
77
75
void *db = NULL, *dbx = NULL, *mok = NULL;
78
76
unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
77
+
efi_status_t status;
79
78
int rc = 0;
80
79
81
80
if (!efi.get_variable)
···
86
83
* an error if we can't get them.
87
84
*/
88
85
if (!uefi_check_ignore_db()) {
89
-
db = get_cert_list(L"db", &secure_var, &dbsize);
86
+
db = get_cert_list(L"db", &secure_var, &dbsize, &status);
90
87
if (!db) {
91
-
pr_err("MODSIGN: Couldn't get UEFI db list\n");
88
+
if (status == EFI_NOT_FOUND)
89
+
pr_debug("MODSIGN: db variable wasn't found\n");
90
+
else
91
+
pr_err("MODSIGN: Couldn't get UEFI db list\n");
92
92
} else {
93
93
rc = parse_efi_signature_list("UEFI:db",
94
94
db, dbsize, get_handler_for_db);
···
102
96
}
103
97
}
104
98
105
-
mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
99
+
mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status);
106
100
if (!mok) {
107
-
pr_info("Couldn't get UEFI MokListRT\n");
101
+
if (status == EFI_NOT_FOUND)
102
+
pr_debug("MokListRT variable wasn't found\n");
103
+
else
104
+
pr_info("Couldn't get UEFI MokListRT\n");
108
105
} else {
109
106
rc = parse_efi_signature_list("UEFI:MokListRT",
110
107
mok, moksize, get_handler_for_db);
···
116
107
kfree(mok);
117
108
}
118
109
119
-
dbx = get_cert_list(L"dbx", &secure_var, &dbxsize);
110
+
dbx = get_cert_list(L"dbx", &secure_var, &dbxsize, &status);
120
111
if (!dbx) {
121
-
pr_info("Couldn't get UEFI dbx list\n");
112
+
if (status == EFI_NOT_FOUND)
113
+
pr_debug("dbx variable wasn't found\n");
114
+
else
115
+
pr_info("Couldn't get UEFI dbx list\n");
122
116
} else {
123
117
rc = parse_efi_signature_list("UEFI:dbx",
124
118
dbx, dbxsize,