Revision 5f56a74cc0a6d9b9f8ba89cea29cd7c4774cb2b1 authored by Ard Biesheuvel on 20 September 2022, 15:08:23 UTC, committed by Ard Biesheuvel on 22 September 2022, 08:15:44 UTC
We currently check the MokSBState variable to decide whether we should
treat UEFI secure boot as being disabled, even if the firmware thinks
otherwise. This is used by shim to indicate that it is not checking
signatures on boot images. In the kernel, we use this to relax lockdown
policies.

However, in cases where shim is not even being used, we don't want this
variable to interfere with lockdown, given that the variable may be
non-volatile and therefore persist across a reboot. This means setting
it once will persistently disable lockdown checks on a given system.

So switch to the mirrored version of this variable, called MokSBStateRT,
which is supposed to be volatile, and this is something we can check.

Cc: <stable@vger.kernel.org> # v4.19+
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Peter Jones <pjones@redhat.com>
1 parent 63bf28c
History
File Mode Size
Makefile -rw-r--r-- 366 bytes
advise.c -rw-r--r-- 2.1 KB
advise.h -rw-r--r-- 316 bytes
alloc_cache.h -rw-r--r-- 1.1 KB
cancel.c -rw-r--r-- 7.2 KB
cancel.h -rw-r--r-- 579 bytes
epoll.c -rw-r--r-- 1.5 KB
epoll.h -rw-r--r-- 213 bytes
fdinfo.c -rw-r--r-- 6.1 KB
fdinfo.h -rw-r--r-- 100 bytes
filetable.c -rw-r--r-- 4.4 KB
filetable.h -rw-r--r-- 2.5 KB
fs.c -rw-r--r-- 6.6 KB
fs.h -rw-r--r-- 929 bytes
io-wq.c -rw-r--r-- 33.4 KB
io-wq.h -rw-r--r-- 2.0 KB
io_uring.c -rw-r--r-- 101.3 KB
io_uring.h -rw-r--r-- 8.3 KB
kbuf.c -rw-r--r-- 13.2 KB
kbuf.h -rw-r--r-- 3.8 KB
msg_ring.c -rw-r--r-- 4.0 KB
msg_ring.h -rw-r--r-- 178 bytes
net.c -rw-r--r-- 30.2 KB
net.h -rw-r--r-- 2.0 KB
nop.c -rw-r--r-- 498 bytes
nop.h -rw-r--r-- 168 bytes
notif.c -rw-r--r-- 3.9 KB
notif.h -rw-r--r-- 2.2 KB
opdef.c -rw-r--r-- 10.9 KB
opdef.h -rw-r--r-- 1.1 KB
openclose.c -rw-r--r-- 6.1 KB
openclose.h -rw-r--r-- 596 bytes
poll.c -rw-r--r-- 25.7 KB
poll.h -rw-r--r-- 1006 bytes
refs.h -rw-r--r-- 1.2 KB
rsrc.c -rw-r--r-- 32.6 KB
rsrc.h -rw-r--r-- 4.5 KB
rw.c -rw-r--r-- 26.8 KB
rw.h -rw-r--r-- 666 bytes
slist.h -rw-r--r-- 3.0 KB
splice.c -rw-r--r-- 2.9 KB
splice.h -rw-r--r-- 306 bytes
sqpoll.c -rw-r--r-- 9.5 KB
sqpoll.h -rw-r--r-- 753 bytes
statx.c -rw-r--r-- 1.6 KB
statx.h -rw-r--r-- 217 bytes
sync.c -rw-r--r-- 2.7 KB
sync.h -rw-r--r-- 460 bytes
tctx.c -rw-r--r-- 7.4 KB
tctx.h -rw-r--r-- 934 bytes
timeout.c -rw-r--r-- 16.7 KB
timeout.h -rw-r--r-- 1.2 KB
uring_cmd.c -rw-r--r-- 2.9 KB
uring_cmd.h -rw-r--r-- 494 bytes
xattr.c -rw-r--r-- 5.5 KB
xattr.h -rw-r--r-- 654 bytes

back to top