From 68eb3e89ba13ff322f6fecb05605e82fd9774758 Mon Sep 17 00:00:00 2001 From: Martin Doucha Date: Tue, 12 Jan 2021 10:57:58 +0100 Subject: Add tst_secureboot_enabled() helper function Also check for SecureBoot status in tst_lockdown_enabled() if the lockdown sysfile is not available/readable and the kernel is configured to enable lockdown automatically under SecureBoot. Signed-off-by: Martin Doucha Reviewed-by: Li Wang Reviewed-by: Cyril Hrubis --- include/tst_lockdown.h | 1 + lib/tst_lockdown.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+) diff --git a/include/tst_lockdown.h b/include/tst_lockdown.h index 78eaeccea..172a7daf5 100644 --- a/include/tst_lockdown.h +++ b/include/tst_lockdown.h @@ -5,6 +5,7 @@ #define PATH_LOCKDOWN "/sys/kernel/security/lockdown" +int tst_secureboot_enabled(void); int tst_lockdown_enabled(void); #endif /* TST_LOCKDOWN_H */ diff --git a/lib/tst_lockdown.c b/lib/tst_lockdown.c index e7c19813c..cda7d7abd 100644 --- a/lib/tst_lockdown.c +++ b/lib/tst_lockdown.c @@ -10,6 +10,36 @@ #include "tst_safe_macros.h" #include "tst_safe_stdio.h" #include "tst_lockdown.h" +#include "tst_private.h" + +#define EFIVAR_SECUREBOOT "/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" + +int tst_secureboot_enabled(void) +{ + int fd; + char data[5]; + + if (access(EFIVAR_SECUREBOOT, F_OK)) { + tst_res(TINFO, "Efivar FS not available"); + return -1; + } + + fd = open(EFIVAR_SECUREBOOT, O_RDONLY); + + if (fd == -1) { + tst_res(TINFO | TERRNO, + "Cannot open SecureBoot Efivar sysfile"); + return -1; + } else if (fd < 0) { + tst_brk(TBROK | TERRNO, "Invalid open() return value %d", fd); + return -1; + } + + SAFE_READ(1, fd, data, 5); + SAFE_CLOSE(fd); + tst_res(TINFO, "SecureBoot: %s", data[4] ? "on" : "off"); + return data[4]; +} int tst_lockdown_enabled(void) { @@ -17,6 +47,14 @@ int tst_lockdown_enabled(void) FILE *file; if (access(PATH_LOCKDOWN, F_OK) != 0) { + char flag; + + flag = tst_kconfig_get("CONFIG_EFI_SECURE_BOOT_LOCK_DOWN"); + + /* SecureBoot enabled could mean integrity lockdown */ + if (flag == 'y' && tst_secureboot_enabled() > 0) + return 1; + tst_res(TINFO, "Unable to determine system lockdown state"); return 0; } -- cgit v1.2.3