OrgACRN
/
acrn-kernel
mirror of https://github.com/projectacrn/acrn-kernel.git
1
0
Fork 0
Code Issues Releases Wiki Activity

integrity: Do not load MOK and MOKx when secure boot be disabled 

The security of Machine Owner Key (MOK) relies on secure boot. When
secure boot is disabled, EFI firmware will not verify binary code. Then
arbitrary efi binary code can modify MOK when rebooting.

This patch prevents MOK/MOKx be loaded when secure boot be disabled.

Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Lee, Chun-Yi 2021-12-18 10:09:05 +08:00 committed by Mimi Zohar
parent 54bf7fa3ef
commit 92ad19559e
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
security/integrity/platform_certs/load_uefi.c
View File

@ -6,6 +6,7 @@
#include <linux/err.h> #include <linux/err.h>
#include <linux/efi.h> #include <linux/efi.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/ima.h>
#include <keys/asymmetric-type.h> #include <keys/asymmetric-type.h>
#include <keys/system_keyring.h> #include <keys/system_keyring.h>
#include "../integrity.h" #include "../integrity.h"
@ -176,6 +177,10 @@ static int __init load_uefi_certs(void)
kfree(dbx); kfree(dbx);
} }
/* the MOK/MOKx can not be trusted when secure boot is disabled */
if (!arch_ima_get_secureboot())
return 0;
mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status); mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);
if (!mokx) { if (!mokx) {
if (status == EFI_NOT_FOUND) if (status == EFI_NOT_FOUND)