path: root/include/linux
diff options
authorArd Biesheuvel <>2020-10-13 10:18:04 +0200
committerMimi Zohar <>2020-11-02 14:19:01 -0500
commitb000d5cb954fe25ac1ea929ae6da321033ace927 (patch)
treea062e8d69d89dca1e185bbb0cd417073a29d4fdd /include/linux
parent3cea11cd5e3b00d91caf0b4730194039b45c5891 (diff)
ima: defer arch_ima_get_secureboot() call to IMA init time
Chester reports that it is necessary to introduce a new way to pass the EFI secure boot status between the EFI stub and the core kernel on ARM systems. The usual way of obtaining this information is by checking the SecureBoot and SetupMode EFI variables, but this can only be done after the EFI variable workqueue is created, which occurs in a subsys_initcall(), whereas arch_ima_get_secureboot() is called much earlier by the IMA framework. However, the IMA framework itself is started as a late_initcall, and the only reason the call to arch_ima_get_secureboot() occurs so early is because it happens in the context of a __setup() callback that parses the ima_appraise= command line parameter. So let's refactor this code a little bit, by using a core_param() callback to capture the command line argument, and deferring any reasoning based on its contents to the IMA init routine. Cc: Chester Lin <> Cc: Dmitry Kasatkin <> Cc: James Morris <> Cc: "Serge E. Hallyn" <> Link: Signed-off-by: Ard Biesheuvel <> Reported-by: kernel test robot <> [missing core_param()] [ included linux/module.h] Tested-by: Chester Lin <> Signed-off-by: Mimi Zohar <>
Diffstat (limited to 'include/linux')
1 files changed, 6 insertions, 0 deletions
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 8fa7bcfb2da2..ac3d82f962f2 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -31,6 +31,12 @@ extern void ima_post_path_mknod(struct dentry *dentry);
extern int ima_file_hash(struct file *file, char *buf, size_t buf_size);
extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size);
+extern void ima_appraise_parse_cmdline(void);
+static inline void ima_appraise_parse_cmdline(void) {}
extern void ima_add_kexec_buffer(struct kimage *image);