Date:   Thu, 16 Dec 2021 00:03:45 +0800
From:   joeyli <jlee@suse.com>
To:     Takashi Iwai <tiwai@suse.de>, Mimi Zohar <zohar@linux.ibm.com>
Cc:     Mimi Zohar <zohar@linux.ibm.com>,
        Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
        linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] ima: Fix undefined arch_ima_get_secureboot() and co
Message-ID: <20211215160345.GF3786@linux-l9pv.suse>
References: <20211213161145.3447-1-tiwai@suse.de>
 <d99fc78005d8a245449dd6ca0158cf9e2a897465.camel@linux.ibm.com>
 <s5hpmpz9o08.wl-tiwai@suse.de>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <s5hpmpz9o08.wl-tiwai@suse.de>
User-Agent: Mutt/1.11.4 (2019-03-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?vMxPimkowEWEm/oX6SOz6khteVBWu+Yn1yORBHoMWCxqbXtKzlMy74FGB2hX?=
 =?us-ascii?Q?cgksaV1METEgRKlBFoETWIZdqpk5CmaqAvO795Ugppea4n6yKz60cEH53Gqg?=
 =?us-ascii?Q?BmMg5ct2P45OIT559hVbFsuf4JjeVe2VvwJF3GEtI/JOkgorEcnYW/yaOL04?=
 =?us-ascii?Q?VdtKG2mWogdRCjB+jdk2JRg3m9V9sR82W9VKzRr7Hun+hnlRvmWf74BPKmuC?=
 =?us-ascii?Q?Vd7UFJhicKoI2mszAIA3JV7vC6aZGEMuz56NB7S8RKo7rFm4Khw94BpNBnY/?=
 =?us-ascii?Q?7eFF5K+xsTLVe3WiwBglhN0C81t3b+vKEhQIj1HT3B4K3nsaroIuqdAroJj7?=
 =?us-ascii?Q?QV7L+YJCItAwtdnP/ye0Xpsk7qCskJ9YW+I7RUwS/hzSffbJL+pYlW+JthIf?=
 =?us-ascii?Q?26qy1gFdIt/GymCXynEpDy67YgcHNGZyULIX8d8SkPegJkqzjcJgIWmhlEU7?=
 =?us-ascii?Q?AJGHA5D5sJDXUzAWcOiMeei8kM6njOS7f8WPXN45FDkCqRLiTGcJqMkAIPrm?=
 =?us-ascii?Q?/6U638wBmgrVbl2nEC2F0dao1SInKTQVWDX2RsQX5ilFPDecBuOzRvPeSyZo?=
 =?us-ascii?Q?X9FL6fG5dLUNKq1lFn3Lerxp/q5Iu7NSCZ0/ImkTf+bO3L0vmBiRs1R9IvX4?=
 =?us-ascii?Q?4JV6qe3CLOKEVLH1W11qdmyRxnn46r97c3yfhHeprNcy/YKPqwYg5c9Bro++?=
 =?us-ascii?Q?iT2OvCtdKWiZfPhFtM+5HukBri1h1QTTDrrL2xp9mJYfNUuNKrdhT7Y5EIFa?=
 =?us-ascii?Q?G9rzg5v22O5GUgwmhUogITRzWJ1IE0rAUT3kUr5MhakfPsh8uk+An8qfDOVN?=
 =?us-ascii?Q?MSx8rjWWfdkcHMTdL00QD6tnyl9K4yfvR+vfEYGaaL12dU1C3MSEreMr6BZy?=
 =?us-ascii?Q?tyj2qH1BEO9G0rLmcISslDa2GhShncefgy+CFQd1GV1skd1RqjYpmZ4r+VK2?=
 =?us-ascii?Q?vh9qYzvx3ETwQamqRNBNjR0q6PU7nQYu9Cs3N2+YSgN5uiciJT3bjeFtoDpk?=
 =?us-ascii?Q?jpOeXp0DWQLQI8up3JtmGlbm5I5wh7uDEX3XD0Y2B3tF1rdvi2s3mL94NHJ9?=
 =?us-ascii?Q?oK3DBR9YiT+WeH31YGVeLli6eKntGQ9Z17gOwctHcYuVl93aDj8JnvMAG/Cp?=
 =?us-ascii?Q?Ah3UVpID8YeUnxMWtvXScnDlXSBSrXjslhupW8Ra+kDYhlc6GWyWO2IJahcx?=
 =?us-ascii?Q?lUMYnpLbC5yNC13OsJhXHob3zYEDVdH6WDXBdAqcXffZRbHrShhqAW/UynRE?=
 =?us-ascii?Q?Jtr0uTumpF2X2d3dgUzDkb4TUhZXp/DatD0EUOdTgnaZKTgSM6sQOkAfT55O?=
 =?us-ascii?Q?CgWkeaYC8yi05DXJU0O5NTzGNTuo9xl32Z1ak2/cAo+QPiOrqwQVOeFiGCLB?=
 =?us-ascii?Q?iE8+KLkogtVVoztjQQ4t2fFOT4bN9tR2CAVYdd6rhB98Z6ymwWmSPGujev8p?=
 =?us-ascii?Q?WRvJ+RXlU5Kc9BAOjn1uE7eQ7al6+sPsJAETX13EAFD+1jmiIUki+ryzXcYt?=
 =?us-ascii?Q?d1fmyBc+z6+iKCtqBlcBtNUTM6swgKIvPwsOvHX8SpKMoXVsgLNA84duZu3p?=
 =?us-ascii?Q?Szw3rEFwDXo11ANHp/o=3D?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b6c6e8c7-b8bc-4638-8336-08d9bfe47eec
X-MS-Exchange-CrossTenant-AuthSource: VI1PR04MB7102.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Dec 2021 16:03:55.7880
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: kNC5dHFJZwLx61ViYNqSwXHsn+cbTU2BS5JF6FZv66OE8TEWCtxTBzKmnia2mxBq
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR04MB5727
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Takashi, Mimi,

On Tue, Dec 14, 2021 at 04:58:47PM +0100, Takashi Iwai wrote:
> On Tue, 14 Dec 2021 16:31:21 +0100,
> Mimi Zohar wrote:
> > 
> > Hi Takashi,
> > 
> > On Mon, 2021-12-13 at 17:11 +0100, Takashi Iwai wrote:
> > > Currently arch_ima_get_secureboot() and arch_get_ima_policy() are
> > > defined only when CONFIG_IMA is set, and this makes the code calling
> > > those functions without CONFIG_IMA failing.  Although there is no such
> > > in-tree users, but the out-of-tree users already hit it.
> > > 
> > > Move the declaration and the dummy definition of those functions
> > > outside ifdef-CONFIG_IMA block for fixing the undefined symbols.
> > > 
> > > Signed-off-by: Takashi Iwai <tiwai@suse.de>
> > 
> > Before lockdown was upstreamed, we made sure that IMA and lockdown
> > could co-exist.  This patch makes the stub functions available even
> > when IMA is not configured.  Do the remaining downstream patches
> > require IMA to be disabled or can IMA co-exist?
> 
> I guess Joey (Cc'ed) can explain this better.  AFAIK, currently it's
> used in a part of MODSIGN stuff in SUSE kernels, and it's calling
> unconditionally this function for checking whether the system is with
> the Secure Boot or not.
>

Actually in downstream code, I used arch_ima_get_secureboot() in
load_uefi_certs() to prevent the mok be loaded when secure boot is
disabled. Because the security of MOK relies on secure boot.

The downstream code likes this:

/* the MOK and MOKx can not be trusted when secure boot is disabled */
-      if (!efi_enabled(EFI_SECURE_BOOT))
+      if (!arch_ima_get_secureboot())
		return 0;

The old EFI_SECURE_BOOT bit can only be available on x86_64, so I switch
the code to to arch_ima_get_secureboot() for cross-architectures and sync
with upstream api.

The load_uefi.c depends on CONFIG_INTEGRITY but not CONFIG_IMA. So
load_uefi.c still be built when CONFIG_INTEGRITY=y and CONFIG_IMA=n.
Then "implicit declaration of function 'arch_ima_get_secureboot'" is
happened.

Thanks a lot!
Joey Lee