integrity: Check properly whether EFI GetVariable() is available

Testing the value of the efi.get_variable function pointer is not
the right way to establish whether the platform supports EFI
variables at runtime. Instead, use the newly added granular check
that can test for the presence of each EFI runtime service
individually.

Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index 111898aad56e48b99d93d55411adedbc82ad8670..e2fe1bd3abb905592e1afa9b858e3449b9a8ce22 100644 (file)
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -76,7 +76,7 @@ static int __init load_uefi_certs(void)
        unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
        int rc = 0;
 
-       if (!efi.get_variable)
+       if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
                return false;
 
        /* Get db, MokListRT, and dbx.  They might not exist, so it isn't