mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-12-27 11:06:41 -05:00
Code Issues Packages Projects Releases Wiki Activity

powerpc/secvar: Expose secvars relevant to the key management mode

Browse Source 
The PLPKS enabled PowerVM LPAR sysfs exposes all of the secure boot
secvars irrespective of the key management mode.

The PowerVM LPAR supports static and dynamic key management for secure
boot. The key management option can be updated in the management
console. The secvars PK, trustedcadb, and moduledb can be consumed both
in the static and dynamic key management modes for the loading of signed
third-party kernel modules. However, other secvars i.e. KEK, grubdb,
grubdbx, sbat, db and dbx, which are used to verify the grub and kernel
images, are consumed only in the dynamic key management mode.

Expose only PK, trustedcadb, and moduledb in the static key management
mode.

Co-developed-by: Souradeep <soura@imap.linux.ibm.com>
Signed-off-by: Souradeep <soura@imap.linux.ibm.com>
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250610211907.101384-3-ssrish@linux.ibm.com
This commit is contained in:
Srish Srinivasan
2025-06-11 02:49:06 +05:30
committed by Madhavan Srinivasan
parent fbf355f32b
commit c1d96cd9a1
2 changed files with 32 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Documentation/ABI/testing/sysfs-secvar
View File

@@ -38,6 +38,13 @@ Description: Each secure variable is represented as a directory named as
representation. The data and size can be determined by reading
their respective attribute files.
Only secvars relevant to the key management mode are exposed.
Only in the dynamic key management mode should the user have
access (read and write) to the secure boot secvars db, dbx,
grubdb, grubdbx, and sbat. These secvars are not consumed in the
static key management mode. PK, trustedcadb and moduledb are the
secvars common to both static and dynamic key management modes.
What: /sys/firmware/secvar/vars/<variable_name>/size
Date: August 2019
Contact: Nayna Jain <nayna@linux.ibm.com>

30
arch/powerpc/platforms/pseries/plpks-secvar.c
View File

@@ -59,7 +59,14 @@ static u32 get_policy(const char *name)
return PLPKS_SIGNEDUPDATE;
}
static const char * const plpks_var_names[] = {
static const char * const plpks_var_names_static[] = {
"PK",
"moduledb",
"trustedcadb",
NULL,
};
static const char * const plpks_var_names_dynamic[] = {
"PK",
"KEK",
"db",
@@ -213,21 +220,34 @@ static int plpks_max_size(u64 *max_size)
return 0;
}
static const struct secvar_operations plpks_secvar_ops = {
static const struct secvar_operations plpks_secvar_ops_static = {
.get = plpks_get_variable,
.set = plpks_set_variable,
.format = plpks_secvar_format,
.max_size = plpks_max_size,
.config_attrs = config_attrs,
.var_names = plpks_var_names,
.var_names = plpks_var_names_static,
};
static const struct secvar_operations plpks_secvar_ops_dynamic = {
.get = plpks_get_variable,
.set = plpks_set_variable,
.format = plpks_secvar_format,
.max_size = plpks_max_size,
.config_attrs = config_attrs,
.var_names = plpks_var_names_dynamic,
};
static int plpks_secvar_init(void)
{
u8 mode;
if (!plpks_is_available())
return -ENODEV;
return set_secvar_ops(&plpks_secvar_ops);
mode = plpks_get_sb_keymgmt_mode();
if (mode)
return set_secvar_ops(&plpks_secvar_ops_dynamic);
return set_secvar_ops(&plpks_secvar_ops_static);
}
machine_device_initcall(pseries, plpks_secvar_init);