evm: Don't enable fix mode when secure boot is enabled

Similar to IMA fix mode, forbid EVM fix mode when secure boot is
enabled.

Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Suggested-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Coiby Xu <coxu@redhat.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 41b053c900f23173600b46692603967f66d1ca59..cfc3531cf53fd879843347f08a627842b651a215 100644 (file)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -72,17 +72,25 @@ static struct xattr_list evm_config_default_xattrnames[] = {
 
 LIST_HEAD(evm_config_xattrnames);
 
+static char *evm_cmdline __initdata;
+core_param(evm, evm_cmdline, charp, 0);
+
 static int evm_fixmode __ro_after_init;
-static int __init evm_set_fixmode(char *str)
+static void __init evm_set_fixmode(void)
 {
-       if (strncmp(str, "fix", 3) == 0)
-               evm_fixmode = 1;
-       else
-               pr_err("invalid \"%s\" mode", str);
+       if (!evm_cmdline)
+               return;
 
-       return 1;
+       if (strncmp(evm_cmdline, "fix", 3) == 0) {
+               if (arch_get_secureboot()) {
+                       pr_info("Secure boot enabled: ignoring evm=fix");
+                       return;
+               }
+               evm_fixmode = 1;
+       } else {
+               pr_err("invalid \"%s\" mode", evm_cmdline);
+       }
 }
-__setup("evm=", evm_set_fixmode);
 
 static void __init evm_init_config(void)
 {
@@ -1119,6 +1127,8 @@ static int __init init_evm(void)
 
        evm_init_config();
 
+       evm_set_fixmode();
+
        error = integrity_init_keyring(INTEGRITY_KEYRING_EVM);
        if (error)
                goto error;