1#!/bin/sh
2# SPDX-License-Identifier: GPL-2.0
3#
4# Kselftest framework defines: ksft_pass=0, ksft_fail=1, ksft_skip=4
5
6VERBOSE="${VERBOSE:-1}"
7IKCONFIG="/tmp/config-`uname -r`"
8KERNEL_IMAGE="/boot/vmlinuz-`uname -r`"
9SECURITYFS=$(grep "securityfs" /proc/mounts | awk '{print $2}')
10
11log_info()
12{
13	[ $VERBOSE -ne 0 ] && echo "[INFO] $1"
14}
15
16# The ksefltest framework requirement returns 0 for PASS.
17log_pass()
18{
19	[ $VERBOSE -ne 0 ] && echo "$1 [PASS]"
20	exit 0
21}
22
23# The ksefltest framework requirement returns 1 for FAIL.
24log_fail()
25{
26	[ $VERBOSE -ne 0 ] && echo "$1 [FAIL]"
27	exit 1
28}
29
30# The ksefltest framework requirement returns 4 for SKIP.
31log_skip()
32{
33	[ $VERBOSE -ne 0 ] && echo "$1"
34	exit 4
35}
36
37# Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID).
38# (Based on kdump-lib.sh)
39get_efivarfs_secureboot_mode()
40{
41	local efivarfs="/sys/firmware/efi/efivars"
42	local secure_boot_file=""
43	local setup_mode_file=""
44	local secureboot_mode=0
45	local setup_mode=0
46
47	# Make sure that efivar_fs is mounted in the normal location
48	if ! grep -q "^\S\+ $efivarfs efivarfs" /proc/mounts; then
49		log_info "efivars is not mounted on $efivarfs"
50		return 0;
51	fi
52	secure_boot_file=$(find "$efivarfs" -name SecureBoot-* 2>/dev/null)
53	setup_mode_file=$(find "$efivarfs" -name SetupMode-* 2>/dev/null)
54	if [ -f "$secure_boot_file" ] && [ -f "$setup_mode_file" ]; then
55		secureboot_mode=$(hexdump -v -e '/1 "%d\ "' \
56			"$secure_boot_file"|cut -d' ' -f 5)
57		setup_mode=$(hexdump -v -e '/1 "%d\ "' \
58			"$setup_mode_file"|cut -d' ' -f 5)
59
60		if [ $secureboot_mode -eq 1 ] && [ $setup_mode -eq 0 ]; then
61			log_info "secure boot mode enabled (CONFIG_EFIVAR_FS)"
62			return 1;
63		fi
64	fi
65	return 0;
66}
67
68get_efi_var_secureboot_mode()
69{
70	local efi_vars
71	local secure_boot_file
72	local setup_mode_file
73	local secureboot_mode
74	local setup_mode
75
76	if [ ! -d "$efi_vars" ]; then
77		log_skip "efi_vars is not enabled\n"
78	fi
79	secure_boot_file=$(find "$efi_vars" -name SecureBoot-* 2>/dev/null)
80	setup_mode_file=$(find "$efi_vars" -name SetupMode-* 2>/dev/null)
81	if [ -f "$secure_boot_file/data" ] && \
82	   [ -f "$setup_mode_file/data" ]; then
83		secureboot_mode=`od -An -t u1 "$secure_boot_file/data"`
84		setup_mode=`od -An -t u1 "$setup_mode_file/data"`
85
86		if [ $secureboot_mode -eq 1 ] && [ $setup_mode -eq 0 ]; then
87			log_info "secure boot mode enabled (CONFIG_EFI_VARS)"
88			return 1;
89		fi
90	fi
91	return 0;
92}
93
94# Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID).
95# The secure boot mode can be accessed either as the last integer
96# of "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*" or from
97# "od -An -t u1 /sys/firmware/efi/vars/SecureBoot-*/data".  The efi
98# SetupMode can be similarly accessed.
99# Return 1 for SecureBoot mode enabled and SetupMode mode disabled.
100get_secureboot_mode()
101{
102	local secureboot_mode=0
103
104	get_efivarfs_secureboot_mode
105	secureboot_mode=$?
106
107	# fallback to using the efi_var files
108	if [ $secureboot_mode -eq 0 ]; then
109		get_efi_var_secureboot_mode
110		secureboot_mode=$?
111	fi
112
113	if [ $secureboot_mode -eq 0 ]; then
114		log_info "secure boot mode not enabled"
115	fi
116	return $secureboot_mode;
117}
118
119require_root_privileges()
120{
121	if [ $(id -ru) -ne 0 ]; then
122		log_skip "requires root privileges"
123	fi
124}
125
126# Look for config option in Kconfig file.
127# Return 1 for found and 0 for not found.
128kconfig_enabled()
129{
130	local config="$1"
131	local msg="$2"
132
133	grep -E -q $config $IKCONFIG
134	if [ $? -eq 0 ]; then
135		log_info "$msg"
136		return 1
137	fi
138	return 0
139}
140
141# Attempt to get the kernel config first via proc, and then by
142# extracting it from the kernel image or the configs.ko using
143# scripts/extract-ikconfig.
144# Return 1 for found.
145get_kconfig()
146{
147	local proc_config="/proc/config.gz"
148	local module_dir="/lib/modules/`uname -r`"
149	local configs_module="$module_dir/kernel/kernel/configs.ko"
150
151	if [ ! -f $proc_config ]; then
152		modprobe configs > /dev/null 2>&1
153	fi
154	if [ -f $proc_config ]; then
155		cat $proc_config | gunzip > $IKCONFIG 2>/dev/null
156		if [ $? -eq 0 ]; then
157			return 1
158		fi
159	fi
160
161	local extract_ikconfig="$module_dir/source/scripts/extract-ikconfig"
162	if [ ! -f $extract_ikconfig ]; then
163		log_skip "extract-ikconfig not found"
164	fi
165
166	$extract_ikconfig $KERNEL_IMAGE > $IKCONFIG 2>/dev/null
167	if [ $? -eq 1 ]; then
168		if [ ! -f $configs_module ]; then
169			log_skip "CONFIG_IKCONFIG not enabled"
170		fi
171		$extract_ikconfig $configs_module > $IKCONFIG
172		if [ $? -eq 1 ]; then
173			log_skip "CONFIG_IKCONFIG not enabled"
174		fi
175	fi
176	return 1
177}
178
179# Make sure that securityfs is mounted
180mount_securityfs()
181{
182	if [ -z $SECURITYFS ]; then
183		SECURITYFS=/sys/kernel/security
184		mount -t securityfs security $SECURITYFS
185	fi
186
187	if [ ! -d "$SECURITYFS" ]; then
188		log_fail "$SECURITYFS :securityfs is not mounted"
189	fi
190}
191
192# The policy rule format is an "action" followed by key-value pairs.  This
193# function supports up to two key-value pairs, in any order.
194# For example: action func=<keyword> [appraise_type=<type>]
195# Return 1 for found and 0 for not found.
196check_ima_policy()
197{
198	local action="$1"
199	local keypair1="$2"
200	local keypair2="$3"
201	local ret=0
202
203	mount_securityfs
204
205	local ima_policy=$SECURITYFS/ima/policy
206	if [ ! -e $ima_policy ]; then
207		log_fail "$ima_policy not found"
208	fi
209
210	if [ -n $keypair2 ]; then
211		grep -e "^$action.*$keypair1" "$ima_policy" | \
212			grep -q -e "$keypair2"
213	else
214		grep -q -e "^$action.*$keypair1" "$ima_policy"
215	fi
216
217	# invert "grep -q" result, returning 1 for found.
218	[ $? -eq 0 ] && ret=1
219	return $ret
220}
221