Javier Martinez Canillas 4a1e1dda56 efi: Only print errors about failing to get certs if EFI vars are found ... [ Upstream commit 3be54d558c ] If CONFIG_LOAD_UEFI_KEYS is enabled, the kernel attempts to load the certs from the db, dbx and MokListRT EFI variables into the appropriate keyrings. But it just assumes that the variables will be present and prints an error if the certs can't be loaded, even when is possible that the variables may not exist. For example the MokListRT variable will only be present if shim is used. So only print an error message about failing to get the certs list from an EFI variable if this is found. Otherwise these printed errors just pollute the kernel log ring buffer with confusing messages like the following: [ 5.427251] Couldn't get size: 0x800000000000000e [ 5.427261] MODSIGN: Couldn't get UEFI db list [ 5.428012] Couldn't get size: 0x800000000000000e [ 5.428023] Couldn't get UEFI MokListRT Reported-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Tested-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-03-12 13:00:14 +01:00
..
apparmor	…
integrity	efi: Only print errors about failing to get certs if EFI vars are found	2020-03-12 13:00:14 +01:00
keys	…
loadpin	…
lockdown	…
safesetid	…
selinux	selinux: ensure we cleanup the internal AVC counters on error in avc_update()	2020-02-24 08:36:39 +01:00
smack	broken ping to ipv6 linklocal addresses on debian buster	2020-02-11 04:35:43 -08:00
tomoyo	tomoyo: Use atomic_t for statistics counter	2020-02-05 21:22:41 +00:00
yama	…
Kconfig	…
Kconfig.hardening	…
Makefile	…
commoncap.c	…
device_cgroup.c	…
inode.c	…
lsm_audit.c	…
min_addr.c	…
security.c	…