Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [GIT PULL] Please pull powerpc/linux.git powerpc-5.5-1 tag
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>,
        Michael Ellerman <mpe@ellerman.id.au>
Cc:     ajd@linux.ibm.com, alastair@d-silva.org,
        "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>,
        asteinhauser@google.com, Bjorn Helgaas <bhelgaas@google.com>,
        Qian Cai <cai@lca.pw>, chris.packham@alliedtelesis.co.nz,
        chris.smart@humanservices.gov.au,
        Christophe Leroy <christophe.leroy@c-s.fr>, clg@kaod.org,
        cmr@informatik.wtf, David Hildenbrand <david@redhat.com>,
        debmc@linux.vnet.ibm.com,
        Geert Uytterhoeven <geert+renesas@glider.be>,
        gwalbon@linux.ibm.com, harish@linux.ibm.com,
        hbathini@linux.ibm.com, Christoph Hellwig <hch@lst.de>,
        krzk@kernel.org, leonardo@linux.ibm.com,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Rasmus Villemoes <linux@rasmusvillemoes.dk>,
        linuxppc-dev@lists.ozlabs.org, linuxram@us.ibm.com,
        madalin.bucur@nxp.com, Mathieu Malaterre <malat@debian.org>,
        msuchanek@suse.de, Nathan Chancellor <natechancellor@gmail.com>,
        nathanl@linux.ibm.com, Nayna Jain <nayna@linux.ibm.com>,
        Nick Piggin <npiggin@gmail.com>,
        "Oliver O'Halloran" <oohall@gmail.com>, oss@buserror.net,
        ravi.bangoria@linux.ibm.com, Russell Currey <ruscur@russell.cc>,
        sbobroff@linux.ibm.com, thuth@redhat.com, tyreld@linux.ibm.com,
        vaibhav@linux.ibm.com, valentin@longchamp.me, yanaijie@huawei.com,
        YueHaibing <yuehaibing@huawei.com>
Date:   Mon, 02 Dec 2019 07:54:27 -0500
In-Reply-To: <CAHk-=wj-BW=C8mFr5mWEYyjgngLoq2N6PZ-RKtiL7X-e93poHw@mail.gmail.com>
References: <877e3hfxyq.fsf@mpe.ellerman.id.au>
         <CAHk-=wj-BW=C8mFr5mWEYyjgngLoq2N6PZ-RKtiL7X-e93poHw@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <1575291267.4793.371.camel@linux.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Sat, 2019-11-30 at 14:42 -0800, Linus Torvalds wrote:
> [ Only tangentially related to the power parts ]
> 
> On Sat, Nov 30, 2019 at 2:41 AM Michael Ellerman <mpe@ellerman.id.au> wrote:
> >
> > There's some changes in security/integrity as part of the secure boot work. They
> > were all either written by or acked/reviewed by Mimi.
> 
>   -#if (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390)
>   +#if (defined(CONFIG_X86) && defined(CONFIG_EFI)) || defined(CONFIG_S390) \
>   + || defined(CONFIG_PPC_SECURE_BOOT)
> 
> This clearly should be its own CONFIG variable, and be generated by
> having the different architectures just select it.
> 
> IOW, IMA should probably have a
> 
>    config IMA_SECURE_BOOT
> 
> and then s390 would just do the select unconditionally, while x86 and
> ppc would do
> 
>   select IMA_SECURE_BOOT if EFI
> 
> and
> 
>   select IMA_SECURE_BOOT if PPC_SECURE_BOOT
> 
> respectively.
> 
> And then we wouldn't have random architectures adding random "me me me
> tooo!!!" type code.

Agreed, but the naming is a bit off.  The flag somehow needs to take
into account "trusted boot" as well.  On s390, only secure boot is
enabled, at least for the time being.  On x86, both secure and trusted
boot are enabled.  On powerpc, the architecture properly enables
secure and/or trusted boot based on OPAL flags.

It's a bit long, but could the flag be named
IMA_SECURE_AND_OR_TRUSTED_BOOT?

thanks,

Mimi