User space kexec-tools need to know whether to verify signature of kernel
image being loaded. This patch exports two knobs to user space. One is
for knowing if secureboot is enabled, this knob will be set to 1 if secure
boot is enabled. Other knob is secure_module_enabled. This knob will be set
to 1 if secure modules is one.
kexec-tools will verify signature of kernel image if either secureboot is
enabled or secure modules is enabled. The only difference between two is
that kexec-tools will set secureboot on in bootparams being passed to
second kernel if secureboot is on in first kernel.
Signed-off-by: Vivek Goyal <vgoyal@xxxxxxxxxx>
---
kernel/ksysfs.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 6ada93c..b95d3e0 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -18,6 +18,8 @@
#include <linux/stat.h>
#include <linux/sched.h>
#include <linux/capability.h>
+#include <linux/efi.h>
+#include <linux/module.h>
#define KERNEL_ATTR_RO(_name) \
static struct kobj_attribute _name##_attr = __ATTR_RO(_name)
@@ -101,6 +103,20 @@ static ssize_t kexec_crash_loaded_show(struct kobject *kobj,
}
KERNEL_ATTR_RO(kexec_crash_loaded);
+static ssize_t secureboot_enabled_show(struct kobject *kobj,
+ struct kobj_attribute *attr, char *buf)
+{
+ return sprintf(buf, "%d\n", !!efi_enabled(EFI_SECURE_BOOT));
+}
+KERNEL_ATTR_RO(secureboot_enabled);
+
+static ssize_t secure_modules_enabled_show(struct kobject *kobj,
+ struct kobj_attribute *attr, char *buf)
+{
+ return sprintf(buf, "%d\n", !!secure_modules());
+}
+KERNEL_ATTR_RO(secure_modules_enabled);
+
static ssize_t kexec_crash_size_show(struct kobject *kobj,
struct kobj_attribute *attr, char *buf)
{
@@ -196,6 +212,10 @@ static struct attribute * kernel_attrs[] = {
&kexec_crash_size_attr.attr,
&vmcoreinfo_attr.attr,
#endif
+#ifdef CONFIG_EFI
+ &secureboot_enabled_attr.attr,
+#endif
+ &secure_modules_enabled_attr.attr,
&rcu_expedited_attr.attr,
NULL
};
--
1.8.3.1
_______________________________________________
kernel mailing list
kernel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/kernel
