kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipl_tools/cmd_lsreipl.c: Add secure boot state to output

Browse Source 
The actual secure boot state ensures that a Linux instance has loaded
only trusted, signed software. During boot component signatures are
verified. If secure boot is enabled, unsigned or unverifiable components
prevent booting. Since Secure Boot on IBM Z is always triggered by the
hypervisor, its state is merely observable by the active system.

Secure boot: 1 - Linux booted secure (only trusted sources)
Secure boot: 0 - Booted from any source without verification

	$ dmesg -t | grep Secure-IPL
	setup: Linux is running with Secure-IPL enabled

	$ cat /sys/kernel/security/lockdown
	none [integrity] confidentiality

	$ lsreipl
	Re-IPL type: fcp
	WWPN:        0x500507630710572c
	LUN:         0x4022409600000000
	Device:      0.0.1908
	bootprog:    0
	br_lba:      0
	Loadparm:    ""
	Bootparms:   ""
	Secure boot: 1

References:
* https://www.ibm.com/docs/en/linux-on-systems?topic=using-verifying-secure-boot
* https://www.ibm.com/docs/en/linux-on-systems?topic=introduction-requirements
Signed-off-by: Jan Polensky <japo@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Jan Polensky
2025-02-19 14:19:38 +01:00
committed by Jan Höppner
parent 426311f440
commit 650e2da843
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ipl_tools/cmd_lsreipl.c
View File

@@ -59,6 +59,7 @@ void print_fcp(int show_ipl, int dump)
char *path_bootparms = util_path_sysfs("firmware/%s/scp_data", dir);
char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir);
char *path_reipl_clear = util_path_sysfs("firmware/reipl/fcp/clear");
char *path_secure_boot = util_path_sysfs("firmware/ipl/secure");
if (dump)
printf("%-12s fcp_dump\n", get_ipl_banner(show_ipl));
@@ -81,9 +82,12 @@ void print_fcp(int show_ipl, int dump)
print_fw_str("Bootparms: \"%s\"\n", dir, "scp_data");
if (!show_ipl && access(path_reipl_clear, R_OK) == 0)
print_fw_str("clear: %s\n", dir, "clear");
if (access(path_secure_boot, R_OK) == 0)
print_fw_str("Secure boot: %s\n", "ipl", "secure");
free(path_bootparms);
free(path_loadparm);
free(path_reipl_clear);
free(path_secure_boot);
}
void print_nvme(int show_ipl, int dump)
@@ -93,6 +97,7 @@ void print_nvme(int show_ipl, int dump)
char *path_bootparms = util_path_sysfs("firmware/%s/scp_data", dir);
char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir);
char *path_reipl_clear = util_path_sysfs("firmware/reipl/nvme/clear");
char *path_secure_boot = util_path_sysfs("firmware/ipl/secure");
if (dump)
printf("%-12s nvme_dump\n", get_ipl_banner(show_ipl));
@@ -114,9 +119,12 @@ void print_nvme(int show_ipl, int dump)
print_fw_str("Bootparms: \"%s\"\n", dir, "scp_data");
if (!show_ipl && access(path_reipl_clear, R_OK) == 0)
print_fw_str("clear: %s\n", dir, "clear");
if (access(path_secure_boot, R_OK) == 0)
print_fw_str("Secure boot: %s\n", "ipl", "secure");
free(path_bootparms);
free(path_loadparm);
free(path_reipl_clear);
free(path_secure_boot);
}
void print_ccw(int show_ipl)
@@ -150,6 +158,7 @@ void print_eckd(int show_ipl, const char *name)
char *dir = show_ipl ? "ipl" : "reipl/eckd";
char loadparm[9], loadparm_path[PATH_MAX];
char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir);
char *path_secure_boot = util_path_sysfs("firmware/ipl/secure");
printf("%-12s %s\n", get_ipl_banner(show_ipl), name);
@@ -166,7 +175,10 @@ void print_eckd(int show_ipl, const char *name)
}
if (!show_ipl)
print_fw_str("clear: %s\n", dir, "clear");
if (access(path_secure_boot, R_OK) == 0)
print_fw_str("Secure boot: %s\n", "ipl", "secure");
free(path_loadparm);
free(path_secure_boot);
}
static void parse_lsreipl_options(int argc, char *argv[])