On Wed, 2020-11-04 at 19:50 +0100, Ard Biesheuvel wrote: > On Wed, 4 Nov 2020 at 19:20, Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > > > > Hi Ard, Chester, > > > > On Mon, 2020-11-02 at 23:37 +0100, Ard Biesheuvel wrote: > > > This is a follow-up to Chester's series [0] to enable IMA to the secure > > > boot state of arm64 platforms, which is EFI based. > > > > > > This v4 implements the changes I suggested to Chester, in particular: > > > - disregard MokSbState when factoring out secure boot mode discovery > > > - turn the x86 IMA arch code into shared code for all architectures. > > > > > > This reduces the final patch to a one liner enabling a Kconfig option > > > for arm64 when EFI is enabled. > > > > > > Build tested only. > > > > Thank you! This patch set is now queued in the linux-integrity next- > > integrity-testing branch. > > > > I don't mind per se, but this touches a number of different trees, > including x86 and arm64, and nobody has acked it yet. > > As far as the EFI tree is concerned, it looks like I should be able to > avoid any conflicts with other stuff that is in flight, and if not, we > can always use your branch up until the last patch in this serires as > a shared tag (assuming you won't rebase it). The next-integrity-testing branch is just a place holder waiting for additional tags. I've reviewed and tested the patch set on x86. Based on the secure boot status and how the kernel is configured, the appropriate policy rules are enabled. Similarly the IMA appraise mode (ima_appraise=) is working properly. I have not tested on arm64. I do not have a problem with this patch set being upstream via EFI. thanks, Mimi
