Skip to main content

Browse the archive

Revision 5f56a74cc0a6d9b9f8ba89cea29cd7c4774cb2b1 authored by Ard Biesheuvel on 20 September 2022, 15:08:23 UTC, committed by Ard Biesheuvel on 22 September 2022, 08:15:44 UTC 
efi: libstub: check Shim mode using MokSBStateRT
 
We currently check the MokSBState variable to decide whether we should
treat UEFI secure boot as being disabled, even if the firmware thinks
otherwise. This is used by shim to indicate that it is not checking
signatures on boot images. In the kernel, we use this to relax lockdown
policies.

However, in cases where shim is not even being used, we don't want this
variable to interfere with lockdown, given that the variable may be
non-volatile and therefore persist across a reboot. This means setting
it once will persistently disable lockdown checks on a given system.

So switch to the mirrored version of this variable, called MokSBStateRT,
which is supposed to be volatile, and this is something we can check.

Cc: <stable@vger.kernel.org> # v4.19+
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Peter Jones <pjones@redhat.com>
1 parent 63bf28c
Raw File
gup_test.h 
/* SPDX-License-Identifier: GPL-2.0-or-later */
#ifndef __GUP_TEST_H
#define __GUP_TEST_H

#include <linux/types.h>

#define GUP_FAST_BENCHMARK	_IOWR('g', 1, struct gup_test)
#define PIN_FAST_BENCHMARK	_IOWR('g', 2, struct gup_test)
#define PIN_LONGTERM_BENCHMARK	_IOWR('g', 3, struct gup_test)
#define GUP_BASIC_TEST		_IOWR('g', 4, struct gup_test)
#define PIN_BASIC_TEST		_IOWR('g', 5, struct gup_test)
#define DUMP_USER_PAGES_TEST	_IOWR('g', 6, struct gup_test)

#define GUP_TEST_MAX_PAGES_TO_DUMP		8

#define GUP_TEST_FLAG_DUMP_PAGES_USE_PIN	0x1

struct gup_test {
	__u64 get_delta_usec;
	__u64 put_delta_usec;
	__u64 addr;
	__u64 size;
	__u32 nr_pages_per_call;
	__u32 gup_flags;
	__u32 test_flags;
	/*
	 * Each non-zero entry is the number of the page (1-based: first page is
	 * page 1, so that zero entries mean "do nothing") from the .addr base.
	 */
	__u32 which_pages[GUP_TEST_MAX_PAGES_TO_DUMP];
};

#endif	/* __GUP_TEST_H */
back to top