Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 2 Jul 2020 16:12:50 -0300
From:   Bruno Meneguele <bmeneg@redhat.com>
To:     Mimi Zohar <zohar@linux.ibm.com>
Cc:     linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
        erichte@linux.ibm.com, nayna@linux.ibm.com
Subject: Re: [PATCH v3 2/2] ima: move APPRAISE_BOOTPARAM dependency on
 ARCH_POLICY to runtime
Message-ID: <20200702191250.GB3669@glitch>
References: <20200623202640.4936-1-bmeneg@redhat.com>
 <20200623202640.4936-3-bmeneg@redhat.com>
 <1593204023.27152.476.camel@linux.ibm.com>
 <20200629234744.GA2756@glitch>
 <1593514848.5085.82.camel@linux.ibm.com>
 <20200630170043.GE2944@glitch>
MIME-Version: 1.0
In-Reply-To: <20200630170043.GE2944@glitch>
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="+g7M9IMkV8truYOl"
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

--+g7M9IMkV8truYOl
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 30, 2020 at 02:00:43PM -0300, Bruno Meneguele wrote:
> On Tue, Jun 30, 2020 at 07:00:48AM -0400, Mimi Zohar wrote:
> > On Mon, 2020-06-29 at 20:47 -0300, Bruno Meneguele wrote:
> >=20
> > >=20
> > > > I'm not if the "secure_boot" flag is available prior to calling
> > > > default_appraise_setup(), but if it is, you could modify the test
> > > > there to also check if the system is booted in secure boot mode (eg=
.
> > > > IS_ENABLED(CONFIG_IMA_APPRAISE_BOOTPARAM) &&
> > > > !arch_ima_get_secureboot())
> > > >=20
> > >=20
> > > Well pointed. I built a custom x86 kernel with some workaround to get
> > > this flag status within default_appraise_setup() and as a result the
> > > flag is was correctly available.=20
> > >=20
> > > Considering the nature of this flag (platform's firmware (in all
> > > arches?)) can we trust that every arch supporting secure/trusted boot
> > > will have it available in the __setup() call time?
> >=20
> > Calling=A0default_appraise_setup() could be deferred.
> >=20
>=20
> Hmmm.. ok, I'm going to investigate it further.
> Didn't really know that.
>=20

After some research on powerpc, x86 and s390 (the only users of arch
policies) codes it's clear that, no matter what, the secure boot flag
will be available even before the kernel cmdline is actually
copied/saved in kernel's memory.

Both powerpc and x86 populate it through setup_arch() call in
init/main.c:kernel_start(), where some early_params are handled, but
nothing about normal (non-early) __setup() params. s390 is a bit deeper
where it gets the flag, right down its boot code, even before
start_kernel().

With that said, it's safe checking it directly from
default_appraise_setup(). I'm going to prepare a v4, test it and post it
tomorrow.=20

--=20
bmeneg=20
PGP Key: http://bmeneg.com/pubkey.txt

--+g7M9IMkV8truYOl
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEdWo6nTbnZdbDmXutYdRkFR+RokMFAl7+MbIACgkQYdRkFR+R
okOE9wgAtlCT2xp0XdlQd9PXMOlQZrofYigVUIMXsGtC0ln+HzCr87RDqf6ZGir4
z0TApF2+fb6SvtW654EDJiXQM8WalA++rsuXSzW47jPUuwkrvyHoaykHDKVbwm8h
WoYoylK8wMNo/sjO6m+78O3j3qnE0vESewUimHf5PIv8ihFS2FwNY7B6oO0P2ygu
YHpIg93bZfkSxUSWe/XA+0OvbMlsC7cS5PVEl/Cf81HR5G6knavZe9jFpGPY7rNi
QxhJQAyDfSUmZNnIQWdWn+SBKQSxsILJ9sylvDtprR8fD13fknuERlyRHjMCg83E
I04QUaw5LwbE9GhpXn0zSr/13JfuJg==
=sFZi
-----END PGP SIGNATURE-----

--+g7M9IMkV8truYOl--