14238fad3SNayna Jain // SPDX-License-Identifier: GPL-2.0 24238fad3SNayna Jain /* 34238fad3SNayna Jain * Copyright (C) 2019 IBM Corporation 44238fad3SNayna Jain * Author: Nayna Jain 54238fad3SNayna Jain */ 64238fad3SNayna Jain 74238fad3SNayna Jain #include <linux/ima.h> 84238fad3SNayna Jain #include <asm/secure_boot.h> 94238fad3SNayna Jain 104238fad3SNayna Jain bool arch_ima_get_secureboot(void) 114238fad3SNayna Jain { 124238fad3SNayna Jain return is_ppc_secureboot_enabled(); 134238fad3SNayna Jain } 144238fad3SNayna Jain 154238fad3SNayna Jain /* 164238fad3SNayna Jain * The "secure_rules" are enabled only on "secureboot" enabled systems. 174238fad3SNayna Jain * These rules verify the file signatures against known good values. 184238fad3SNayna Jain * The "appraise_type=imasig|modsig" option allows the known good signature 194238fad3SNayna Jain * to be stored as an xattr or as an appended signature. 204238fad3SNayna Jain * 214238fad3SNayna Jain * To avoid duplicate signature verification as much as possible, the IMA 224238fad3SNayna Jain * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE 234238fad3SNayna Jain * is not enabled. 244238fad3SNayna Jain */ 254238fad3SNayna Jain static const char *const secure_rules[] = { 264238fad3SNayna Jain "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig|modsig", 274238fad3SNayna Jain #ifndef CONFIG_MODULE_SIG_FORCE 284238fad3SNayna Jain "appraise func=MODULE_CHECK appraise_type=imasig|modsig", 294238fad3SNayna Jain #endif 304238fad3SNayna Jain NULL 314238fad3SNayna Jain }; 324238fad3SNayna Jain 334238fad3SNayna Jain /* 344238fad3SNayna Jain * Returns the relevant IMA arch-specific policies based on the system secure 354238fad3SNayna Jain * boot state. 364238fad3SNayna Jain */ 374238fad3SNayna Jain const char *const *arch_get_ima_policy(void) 384238fad3SNayna Jain { 394238fad3SNayna Jain if (is_ppc_secureboot_enabled()) 404238fad3SNayna Jain return secure_rules; 414238fad3SNayna Jain 424238fad3SNayna Jain return NULL; 434238fad3SNayna Jain } 44