kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zipl/boot: Add secure boot option to the dump programm

Browse Source 
With SECURE_BOOT_DISABLED always set in add_dump_program() no signature
entries for a dump kernel are written. This might lead to security
violation error from the IPL Loader on the systems with secure boot support
on the attempt to boot the dump kernel:
  MLOLOA6269321F A security violation error was encountered when loading from device <device>
  MLOLOA62693212 Audit: No signed components found for program 0 loaded from device <device>

Propagate '--secure' zipl option to add_dump_program() in order to sign
relevant components upon dump program installation and thus support
secure boot execution for List-directed dump kernels.

Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Acked-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Mikhail Zaslonko
2026-02-16 13:51:00 +01:00
committed by Jan Höppner
parent 6fc1ed1a67
commit 73ab25f419
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
zipl/src/bootmap.c
View File

@@ -1062,7 +1062,7 @@ static int add_segment_program(struct install_set *bis,
static int add_dump_program(struct install_set *bis,
const struct job_dump_data *dump,
disk_blockptr_t *program, int verbose,
component_header_type type,
component_header_type type, int is_secure,
int program_table_id)
{
struct job_ipl_data ipl;
@@ -1072,7 +1072,7 @@ static int add_dump_program(struct install_set *bis,
ipl.common = dump->common;
return add_ipl_program(bis, false, NULL, &ipl, program,
verbose, 1, type, SECURE_BOOT_DISABLED,
verbose, 1, type, is_secure,
0 /* menu_idx */, 0 /* mirror id */,
program_table_id);
}
@@ -1146,7 +1146,7 @@ static int build_program_table(struct job_data *job, struct install_set *bis,
}
rc = add_dump_program(bis, &job->data.dump, &table[0],
verbose || job->command_line,
COMPONENT_HEADER_DUMP,
COMPONENT_HEADER_DUMP, job->is_secure,
program_table_id);
break;
case job_menu: