integrity: Make arch_ima_get_secureboot integrity-wide

EVM and other LSMs need the ability to query the secure boot status of
the system, without directly calling the IMA arch_ima_get_secureboot
function. Refactor the secure boot status check into a general function
named arch_get_secureboot.

Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Suggested-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index 61bf550fd37c274843e516e00068bb2ab1e152ac..04823afa8b740957d4ec895544ef0023be465400 100644 (file)
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -12668,6 +12668,7 @@ R:      Eric Snowberg <eric.snowberg@oracle.com>
 L:     linux-integrity@vger.kernel.org
 S:     Supported
 T:     git git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
+F:     include/linux/secure_boot.h
 F:     security/integrity/
 F:     security/integrity/ima/
 

diff --git a/arch/powerpc/kernel/ima_arch.c b/arch/powerpc/kernel/ima_arch.c
index b7029beed847dc0acf15b3edbdd7fe9e60626f24..0d8892a0352662b040922a48c4ec64412c3327a2 100644 (file)
--- a/arch/powerpc/kernel/ima_arch.c
+++ b/arch/powerpc/kernel/ima_arch.c
@@ -7,11 +7,6 @@
 #include <linux/ima.h>
 #include <asm/secure_boot.h>
 
-bool arch_ima_get_secureboot(void)
-{
-       return is_ppc_secureboot_enabled();
-}
-
 /*
  * The "secure_rules" are enabled only on "secureboot" enabled systems.
  * These rules verify the file signatures against known good values.

diff --git a/arch/powerpc/kernel/secure_boot.c b/arch/powerpc/kernel/secure_boot.c
index 3a28795b4ed82e9d05b5b804e3f93c53c03cc44a..28436c1599e0864d8040f5362d3499b2fc2f1c2d 100644 (file)
--- a/arch/powerpc/kernel/secure_boot.c
+++ b/arch/powerpc/kernel/secure_boot.c
@@ -5,6 +5,7 @@
  */
 #include <linux/types.h>
 #include <linux/of.h>
+#include <linux/secure_boot.h>
 #include <linux/string_choices.h>
 #include <asm/secure_boot.h>
 
@@ -44,6 +45,11 @@ out:
        return enabled;
 }
 
+bool arch_get_secureboot(void)
+{
+       return is_ppc_secureboot_enabled();
+}
+
 bool is_ppc_trustedboot_enabled(void)
 {
        struct device_node *node;

diff --git a/arch/s390/kernel/ima_arch.c b/arch/s390/kernel/ima_arch.c
index f3c3e6e1c5d38c8a2d401700b63ff55600baaece..6ccbe34ce4087a2e389f5bd6249f83ec591e2238 100644 (file)
--- a/arch/s390/kernel/ima_arch.c
+++ b/arch/s390/kernel/ima_arch.c
@@ -1,12 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 
 #include <linux/ima.h>
-#include <asm/boot_data.h>
-
-bool arch_ima_get_secureboot(void)
-{
-       return ipl_secure_flag;
-}
 
 const char * const *arch_get_ima_policy(void)
 {

diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index 049c557c452ff96cf0aa49a19c3ad3067ecce296..bdbbedf5258021a12d2ece00ba78960d5b2dd84c 100644 (file)
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -2504,6 +2504,11 @@ out:
        return buf;
 }
 
+bool arch_get_secureboot(void)
+{
+       return ipl_secure_flag;
+}
+
 int ipl_report_free(struct ipl_report *report)
 {
        struct ipl_report_component *comp, *ncomp;

diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index f227a70ac91f04eb8f50430c034c9fd9d866010a..ee382b56dd7b4b4fa1df9f54fea6f0d35444cac0 100644 (file)
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -401,9 +401,9 @@ extern int __init efi_memmap_split_count(efi_memory_desc_t *md,
 extern void __init efi_memmap_insert(struct efi_memory_map *old_memmap,
                                     void *buf, struct efi_mem_range *mem);
 
-extern enum efi_secureboot_mode __x86_ima_efi_boot_mode(void);
+enum efi_secureboot_mode __x86_efi_boot_mode(void);
 
-#define arch_ima_efi_boot_mode __x86_ima_efi_boot_mode()
+#define arch_efi_boot_mode __x86_efi_boot_mode()
 
 #ifdef CONFIG_EFI_RUNTIME_MAP
 int efi_get_runtime_map_size(void);

diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index d00c6de7f3b733e3ecbd26894a8585604a4efda0..74032f3ab9b0a7fe0f088b085b4bbee82c4a27cb 100644 (file)
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -920,7 +920,7 @@ umode_t efi_attr_is_visible(struct kobject *kobj, struct attribute *attr, int n)
        return attr->mode;
 }
 
-enum efi_secureboot_mode __x86_ima_efi_boot_mode(void)
+enum efi_secureboot_mode __x86_efi_boot_mode(void)
 {
        return boot_params.secure_boot;
 }

diff --git a/include/linux/ima.h b/include/linux/ima.h
index abf8923f8fc51e16a707c8d857d5708f465ad956..8e08baf16c2fdd3f3ba0509dc1d02c2b3061931d 100644 (file)
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -11,6 +11,7 @@
 #include <linux/fs.h>
 #include <linux/security.h>
 #include <linux/kexec.h>
+#include <linux/secure_boot.h>
 #include <crypto/hash_info.h>
 struct linux_binprm;
 
@@ -73,14 +74,8 @@ int ima_validate_range(phys_addr_t phys, size_t size);
 #endif
 
 #ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
-extern bool arch_ima_get_secureboot(void);
 extern const char * const *arch_get_ima_policy(void);
 #else
-static inline bool arch_ima_get_secureboot(void)
-{
-       return false;
-}
-
 static inline const char * const *arch_get_ima_policy(void)
 {
        return NULL;

diff --git a/include/linux/secure_boot.h b/include/linux/secure_boot.h
new file mode 100644 (file)
index 0000000..3ded3f0
--- /dev/null
+++ b/include/linux/secure_boot.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2026 Red Hat, Inc. All Rights Reserved.
+ *
+ * Author: Coiby Xu <coxu@redhat.com>
+ */
+
+#ifndef _LINUX_SECURE_BOOT_H
+#define _LINUX_SECURE_BOOT_H
+
+#include <linux/types.h>
+
+/*
+ * Returns true if the platform secure boot is enabled.
+ * Returns false if disabled or not supported.
+ */
+bool arch_get_secureboot(void);
+
+#endif /* _LINUX_SECURE_BOOT_H */

diff --git a/security/integrity/Makefile b/security/integrity/Makefile
index 92b63039c654c1607e903b01788834ef52b17116..548665e2b702e60c318c02db947666b507583f8f 100644 (file)
--- a/security/integrity/Makefile
+++ b/security/integrity/Makefile
@@ -5,7 +5,7 @@
 
 obj-$(CONFIG_INTEGRITY) += integrity.o
 
-integrity-y := iint.o
+integrity-y := iint.o secure_boot.o
 integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o
 integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o
 integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o
@@ -18,6 +18,7 @@ integrity-$(CONFIG_LOAD_IPL_KEYS) += platform_certs/load_ipl_s390.o
 integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \
                                      platform_certs/load_powerpc.o \
                                      platform_certs/keyring_handler.o
+integrity-$(CONFIG_EFI) += efi_secureboot.o
 # The relative order of the 'ima' and 'evm' LSMs depends on the order below.
 obj-$(CONFIG_IMA)                      += ima/
 obj-$(CONFIG_EVM)                      += evm/

diff --git a/security/integrity/efi_secureboot.c b/security/integrity/efi_secureboot.c
new file mode 100644 (file)
index 0000000..bfd4260
--- /dev/null
+++ b/security/integrity/efi_secureboot.c
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-1.0+
+/*
+ * Copyright (C) 2018 IBM Corporation
+ */
+#include <linux/efi.h>
+#include <linux/secure_boot.h>
+#include <asm/efi.h>
+
+#ifndef arch_efi_boot_mode
+#define arch_efi_boot_mode efi_secureboot_mode_unset
+#endif
+
+static enum efi_secureboot_mode get_sb_mode(void)
+{
+       enum efi_secureboot_mode mode;
+
+       if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {
+               pr_info("integrity: secureboot mode unknown, no efi\n");
+               return efi_secureboot_mode_unknown;
+       }
+
+       mode = efi_get_secureboot_mode(efi.get_variable);
+       if (mode == efi_secureboot_mode_disabled)
+               pr_info("integrity: secureboot mode disabled\n");
+       else if (mode == efi_secureboot_mode_unknown)
+               pr_info("integrity: secureboot mode unknown\n");
+       else
+               pr_info("integrity: secureboot mode enabled\n");
+       return mode;
+}
+
+/*
+ * Query secure boot status
+ *
+ * Note don't call this function too early e.g. in __setup hook otherwise the
+ * kernel may hang when calling efi_get_secureboot_mode.
+ *
+ */
+bool arch_get_secureboot(void)
+{
+       static enum efi_secureboot_mode sb_mode;
+       static bool initialized;
+
+       if (!initialized && efi_enabled(EFI_BOOT)) {
+               sb_mode = arch_efi_boot_mode;
+
+               if (sb_mode == efi_secureboot_mode_unset)
+                       sb_mode = get_sb_mode();
+               initialized = true;
+       }
+
+       if (sb_mode == efi_secureboot_mode_enabled)
+               return true;
+       else
+               return false;
+}

diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 16c20c578ea8781ce51892dda71dc5248aba92b0..ee2e0891febcc0146c53742d7719bb3bc4170c03 100644 (file)
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -27,7 +27,7 @@ core_param(ima_appraise, ima_appraise_cmdline_default, charp, 0);
 void __init ima_appraise_parse_cmdline(void)
 {
        const char *str = ima_appraise_cmdline_default;
-       bool sb_state = arch_ima_get_secureboot();
+       bool sb_state = arch_get_secureboot();
        int appraisal_state = ima_appraise;
 
        if (!str)

diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c
index 138029bfcce1e40ef37700c15e30909f6e9b4f2d..78191879dd98f5ad8978fac9bbe59982ebd2e58b 100644 (file)
--- a/security/integrity/ima/ima_efi.c
+++ b/security/integrity/ima/ima_efi.c
@@ -2,52 +2,9 @@
 /*
  * Copyright (C) 2018 IBM Corporation
  */
-#include <linux/efi.h>
 #include <linux/module.h>
 #include <linux/ima.h>
-#include <asm/efi.h>
-
-#ifndef arch_ima_efi_boot_mode
-#define arch_ima_efi_boot_mode efi_secureboot_mode_unset
-#endif
-
-static enum efi_secureboot_mode get_sb_mode(void)
-{
-       enum efi_secureboot_mode mode;
-
-       if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {
-               pr_info("ima: secureboot mode unknown, no efi\n");
-               return efi_secureboot_mode_unknown;
-       }
-
-       mode = efi_get_secureboot_mode(efi.get_variable);
-       if (mode == efi_secureboot_mode_disabled)
-               pr_info("ima: secureboot mode disabled\n");
-       else if (mode == efi_secureboot_mode_unknown)
-               pr_info("ima: secureboot mode unknown\n");
-       else
-               pr_info("ima: secureboot mode enabled\n");
-       return mode;
-}
-
-bool arch_ima_get_secureboot(void)
-{
-       static enum efi_secureboot_mode sb_mode;
-       static bool initialized;
-
-       if (!initialized && efi_enabled(EFI_BOOT)) {
-               sb_mode = arch_ima_efi_boot_mode;
-
-               if (sb_mode == efi_secureboot_mode_unset)
-                       sb_mode = get_sb_mode();
-               initialized = true;
-       }
-
-       if (sb_mode == efi_secureboot_mode_enabled)
-               return true;
-       else
-               return false;
-}
+#include <linux/secure_boot.h>
 
 /* secureboot arch rules */
 static const char * const sb_arch_rules[] = {
@@ -67,7 +24,7 @@ static const char * const sb_arch_rules[] = {
 
 const char * const *arch_get_ima_policy(void)
 {
-       if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
+       if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_get_secureboot()) {
                if (IS_ENABLED(CONFIG_MODULE_SIG))
                        set_module_sig_enforced();
                if (IS_ENABLED(CONFIG_KEXEC_SIG))

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 1d6229b156fb179b3da690a87f089ef54ceb7cb1..5808b52c842644ac37ca13499e91b133cae9aaaf 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -953,8 +953,7 @@ static int ima_load_data(enum kernel_load_data_id id, bool contents)
 
        switch (id) {
        case LOADING_KEXEC_IMAGE:
-               if (IS_ENABLED(CONFIG_KEXEC_SIG)
-                   && arch_ima_get_secureboot()) {
+               if (IS_ENABLED(CONFIG_KEXEC_SIG) && arch_get_secureboot()) {
                        pr_err("impossible to appraise a kernel image without a file descriptor; try using kexec_file_load syscall.\n");
                        return -EACCES;
                }

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 7b388b66cf80d5bc92b4e28ac1d66ed671b5fe92..4636629533afb4292b88d05d6d89be40a7986064 100644 (file)
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -14,6 +14,7 @@
 
 #include <linux/types.h>
 #include <linux/integrity.h>
+#include <linux/secure_boot.h>
 #include <crypto/sha1.h>
 #include <crypto/hash.h>
 #include <linux/key.h>

diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index d1fdd113450a63887b1a5aed9ab33c46ead9c84a..c0d6948446c307123ee502c91cc1cca2f3650676 100644 (file)
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -212,7 +212,7 @@ static int __init load_uefi_certs(void)
        }
 
        /* the MOK/MOKx can not be trusted when secure boot is disabled */
-       if (!arch_ima_get_secureboot())
+       if (!arch_get_secureboot())
                return 0;
 
        mokx = get_cert_list(L"MokListXRT", &mok_var, &mokxsize, &status);

diff --git a/security/integrity/secure_boot.c b/security/integrity/secure_boot.c
new file mode 100644 (file)
index 0000000..fc2693c
--- /dev/null
+++ b/security/integrity/secure_boot.c
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026 Red Hat, Inc. All Rights Reserved.
+ *
+ * Author: Coiby Xu <coxu@redhat.com>
+ */
+#include <linux/secure_boot.h>
+
+/*
+ * Default weak implementation.
+ * Architectures that support secure boot must override this.
+ */
+__weak bool arch_get_secureboot(void)
+{
+       return false;
+}