[PATCH 1/5] MODSIGN: do not load mok when secure boot disabled

Origin: https://lore.kernel.org/patchwork/patch/933173/

The mok can not be trusted when the secure boot is disabled. Which
means that the kernel embedded certificate is the only trusted key.

Due to db/dbx are authenticated variables, they needs manufacturer's
KEK for update. So db/dbx are secure when secureboot disabled.

Cc: David Howells <dhowells@redhat.com>
Cc: Josh Boyer <jwboyer@fedoraproject.org>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
[Rebased by Luca Boccassi]
[bwh: Forward-ported to 5.5.9:
 - get_cert_list() takes a pointer to status and returns the cert list
 - Adjust filename]

Gbp-Pq: Topic features/all/db-mok-keyring
Gbp-Pq: Name 0001-MODSIGN-do-not-load-mok-when-secure-boot-disabled.patch

diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index f0c908241966ae3f387a55d4ddc813150135b91b..1b47f34d80d7b3ab448b4a7477aa3c3c722e5d39 100644 (file)
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -102,20 +102,6 @@ static int __init load_uefi_certs(void)
                }
        }
 
-       mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status);
-       if (!mok) {
-               if (status == EFI_NOT_FOUND)
-                       pr_debug("MokListRT variable wasn't found\n");
-               else
-                       pr_info("Couldn't get UEFI MokListRT\n");
-       } else {
-               rc = parse_efi_signature_list("UEFI:MokListRT",
-                                             mok, moksize, get_handler_for_db);
-               if (rc)
-                       pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
-               kfree(mok);
-       }
-
        dbx = get_cert_list(L"dbx", &secure_var, &dbxsize, &status);
        if (!dbx) {
                if (status == EFI_NOT_FOUND)
@@ -131,6 +117,24 @@ static int __init load_uefi_certs(void)
                kfree(dbx);
        }
 
+       /* the MOK can not be trusted when secure boot is disabled */
+       if (!efi_enabled(EFI_SECURE_BOOT))
+               return 0;
+
+       mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status);
+       if (!mok) {
+               if (status == EFI_NOT_FOUND)
+                       pr_debug("MokListRT variable wasn't found\n");
+               else
+                       pr_info("Couldn't get UEFI MokListRT\n");
+       } else {
+               rc = parse_efi_signature_list("UEFI:MokListRT",
+                                             mok, moksize, get_handler_for_db);
+               if (rc)
+                       pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
+               kfree(mok);
+       }
+
        return rc;
 }
 late_initcall(load_uefi_certs);