From 650e2da843d72789b3cda4967e0085f85ac757a6 Mon Sep 17 00:00:00 2001 From: Jan Polensky Date: Wed, 19 Feb 2025 14:19:38 +0100 Subject: [PATCH] ipl_tools/cmd_lsreipl.c: Add secure boot state to output MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The actual secure boot state ensures that a Linux instance has loaded only trusted, signed software. During boot component signatures are verified. If secure boot is enabled, unsigned or unverifiable components prevent booting. Since Secure Boot on IBM Z is always triggered by the hypervisor, its state is merely observable by the active system. Secure boot: 1 - Linux booted secure (only trusted sources) Secure boot: 0 - Booted from any source without verification $ dmesg -t | grep Secure-IPL setup: Linux is running with Secure-IPL enabled $ cat /sys/kernel/security/lockdown none [integrity] confidentiality $ lsreipl Re-IPL type: fcp WWPN: 0x500507630710572c LUN: 0x4022409600000000 Device: 0.0.1908 bootprog: 0 br_lba: 0 Loadparm: "" Bootparms: "" Secure boot: 1 References: * https://www.ibm.com/docs/en/linux-on-systems?topic=using-verifying-secure-boot * https://www.ibm.com/docs/en/linux-on-systems?topic=introduction-requirements Signed-off-by: Jan Polensky Reviewed-by: Jan Höppner Signed-off-by: Jan Höppner --- ipl_tools/cmd_lsreipl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/ipl_tools/cmd_lsreipl.c b/ipl_tools/cmd_lsreipl.c index ddd2da32..681dec66 100644 --- a/ipl_tools/cmd_lsreipl.c +++ b/ipl_tools/cmd_lsreipl.c @@ -59,6 +59,7 @@ void print_fcp(int show_ipl, int dump) char *path_bootparms = util_path_sysfs("firmware/%s/scp_data", dir); char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir); char *path_reipl_clear = util_path_sysfs("firmware/reipl/fcp/clear"); + char *path_secure_boot = util_path_sysfs("firmware/ipl/secure"); if (dump) printf("%-12s fcp_dump\n", get_ipl_banner(show_ipl)); @@ -81,9 +82,12 @@ void print_fcp(int show_ipl, int dump) print_fw_str("Bootparms: \"%s\"\n", dir, "scp_data"); if (!show_ipl && access(path_reipl_clear, R_OK) == 0) print_fw_str("clear: %s\n", dir, "clear"); + if (access(path_secure_boot, R_OK) == 0) + print_fw_str("Secure boot: %s\n", "ipl", "secure"); free(path_bootparms); free(path_loadparm); free(path_reipl_clear); + free(path_secure_boot); } void print_nvme(int show_ipl, int dump) @@ -93,6 +97,7 @@ void print_nvme(int show_ipl, int dump) char *path_bootparms = util_path_sysfs("firmware/%s/scp_data", dir); char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir); char *path_reipl_clear = util_path_sysfs("firmware/reipl/nvme/clear"); + char *path_secure_boot = util_path_sysfs("firmware/ipl/secure"); if (dump) printf("%-12s nvme_dump\n", get_ipl_banner(show_ipl)); @@ -114,9 +119,12 @@ void print_nvme(int show_ipl, int dump) print_fw_str("Bootparms: \"%s\"\n", dir, "scp_data"); if (!show_ipl && access(path_reipl_clear, R_OK) == 0) print_fw_str("clear: %s\n", dir, "clear"); + if (access(path_secure_boot, R_OK) == 0) + print_fw_str("Secure boot: %s\n", "ipl", "secure"); free(path_bootparms); free(path_loadparm); free(path_reipl_clear); + free(path_secure_boot); } void print_ccw(int show_ipl) @@ -150,6 +158,7 @@ void print_eckd(int show_ipl, const char *name) char *dir = show_ipl ? "ipl" : "reipl/eckd"; char loadparm[9], loadparm_path[PATH_MAX]; char *path_loadparm = util_path_sysfs("firmware/%s/loadparm", dir); + char *path_secure_boot = util_path_sysfs("firmware/ipl/secure"); printf("%-12s %s\n", get_ipl_banner(show_ipl), name); @@ -166,7 +175,10 @@ void print_eckd(int show_ipl, const char *name) } if (!show_ipl) print_fw_str("clear: %s\n", dir, "clear"); + if (access(path_secure_boot, R_OK) == 0) + print_fw_str("Secure boot: %s\n", "ipl", "secure"); free(path_loadparm); + free(path_secure_boot); } static void parse_lsreipl_options(int argc, char *argv[])