1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) Linux Test Project, 2020-2024
4 */
5
6 #define TST_NO_DEFAULT_MAIN
7
8 #define PATH_FIPS "/proc/sys/crypto/fips_enabled"
9 #define PATH_LOCKDOWN "/sys/kernel/security/lockdown"
10 #define SELINUX_STATUS_PATH "/sys/fs/selinux/enforce"
11
12 #if defined(__powerpc64__) || defined(__ppc64__)
13 # define SECUREBOOT_VAR "/proc/device-tree/ibm,secure-boot"
14 # define VAR_DATA_SIZE 4
15 #else
16 # define SECUREBOOT_VAR "/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c"
17 # define VAR_DATA_SIZE 5
18 #endif
19
20 #include <fcntl.h>
21 #include <stdio.h>
22 #include <stdlib.h>
23 #include <sys/mount.h>
24
25 #include "tst_test.h"
26 #include "tst_safe_macros.h"
27 #include "tst_safe_stdio.h"
28 #include "tst_security.h"
29 #include "tst_private.h"
30
tst_fips_enabled(void)31 int tst_fips_enabled(void)
32 {
33 int fips = 0;
34
35 if (access(PATH_FIPS, R_OK) == 0)
36 SAFE_FILE_SCANF(PATH_FIPS, "%d", &fips);
37
38 tst_res(TINFO, "FIPS: %s", fips ? "on" : "off");
39
40 return fips;
41 }
42
tst_lockdown_enabled(void)43 int tst_lockdown_enabled(void)
44 {
45 char line[BUFSIZ];
46 FILE *file;
47 int ret;
48
49 if (access(PATH_LOCKDOWN, F_OK) != 0) {
50 char flag;
51
52 /* SecureBoot enabled could mean integrity lockdown (non-mainline version) */
53 #if defined(__powerpc64__) || defined(__ppc64__)
54 flag = tst_kconfig_get("CONFIG_SECURITY_LOCKDOWN_LSM") == 'y';
55 flag |= tst_kconfig_get("CONFIG_SECURITY_LOCKDOWN_LSM_EARLY") == 'y';
56 #else
57 flag = tst_kconfig_get("CONFIG_EFI_SECURE_BOOT_LOCK_DOWN") == 'y';
58 flag |= tst_kconfig_get("CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT") == 'y';
59 #endif
60
61 if (flag && tst_secureboot_enabled() > 0)
62 return 1;
63
64 tst_res(TINFO, "Unable to determine system lockdown state");
65 return 0;
66 }
67
68 file = SAFE_FOPEN(PATH_LOCKDOWN, "r");
69 if (!fgets(line, sizeof(line), file))
70 tst_brk(TBROK | TERRNO, "fgets %s", PATH_LOCKDOWN);
71 SAFE_FCLOSE(file);
72
73 ret = strstr(line, "[none]") == NULL;
74 tst_res(TINFO, "Kernel lockdown: %s", ret ? "on" : "off");
75
76 return ret;
77 }
78
tst_secureboot_enabled(void)79 int tst_secureboot_enabled(void)
80 {
81 int fd;
82 char data[5];
83
84 if (access(SECUREBOOT_VAR, F_OK)) {
85 tst_res(TINFO, "SecureBoot sysfs file not available");
86 return -1;
87 }
88
89 fd = open(SECUREBOOT_VAR, O_RDONLY);
90
91 if (fd == -1) {
92 tst_res(TINFO | TERRNO,
93 "Cannot open SecureBoot file");
94 return -1;
95 } else if (fd < 0) {
96 tst_brk(TBROK | TERRNO, "Invalid open() return value %d", fd);
97 return -1;
98 }
99 SAFE_READ(1, fd, data, VAR_DATA_SIZE);
100 SAFE_CLOSE(fd);
101 tst_res(TINFO, "SecureBoot: %s", data[VAR_DATA_SIZE - 1] ? "on" : "off");
102 return data[VAR_DATA_SIZE - 1];
103 }
104
tst_selinux_enforcing(void)105 int tst_selinux_enforcing(void)
106 {
107 int res = 0;
108
109 if (access(SELINUX_STATUS_PATH, F_OK) == 0)
110 SAFE_FILE_SCANF(SELINUX_STATUS_PATH, "%d", &res);
111
112 tst_res(TINFO, "SELinux enforcing: %s", res ? "on" : "off");
113
114 return res;
115 }
116