Re: [PATCH] security: policy: allow querying the active policy

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hi,

On 11/11/25 9:59 AM, Ahmad Fatoum wrote:
> Hello Fabian,
> 
> On 11/10/25 10:46 PM, Fabian Pflug wrote:
>> Sometimes it is needed from board code to not to check what is allowed,
>> but what is the currently activated security policy to do some stuff.
> 
> As you know, security policies were a recent addition in the last
> month's release and we are still gathering experience with how to best
> use it.
> 
> May I ask what you are using the name for? I envisioned the name to be
> just a descriptive string and that boards would define their own
> SCONFIG_ symbols if they need to control something.

I talked with Fabian off-list about this. I prefer not to add an API as
not to encourage comparisons against the name of the security policy for
security-related decisions.

If the name is needed (in this case to avoid some security unrelated
setup when in lockdown), ${security.policy} or the active_policy
variable can be used instead.

Cheers,
Ahmad

> 
> 
> Thanks,
> Ahmad
> 
>>
>> Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
>> ---
>>  include/security/policy.h | 1 +
>>  security/policy.c         | 8 ++++++++
>>  2 files changed, 9 insertions(+)
>>
>> diff --git a/include/security/policy.h b/include/security/policy.h
>> index c41220ef3b..3eedf6e5ac 100644
>> --- a/include/security/policy.h
>> +++ b/include/security/policy.h
>> @@ -32,6 +32,7 @@ const struct security_policy *security_policy_get(const char *name);
>>  int security_policy_activate(const struct security_policy *policy);
>>  int security_policy_select(const char *name);
>>  void security_policy_list(void);
>> +bool security_policy_is_active(const char *name);
>>  
>>  #ifdef CONFIG_SECURITY_POLICY
>>  int __security_policy_register(const struct security_policy policy[]);
>> diff --git a/security/policy.c b/security/policy.c
>> index 85333d9e6f..abb956014d 100644
>> --- a/security/policy.c
>> +++ b/security/policy.c
>> @@ -225,6 +225,14 @@ static int security_policy_get_name(struct param_d *param, void *priv)
>>  	return 0;
>>  }
>>  
>> +bool security_policy_is_active(const char *name)
>> +{
>> +	if (!active_policy)
>> +		return false;
>> +
>> +	return !strcmp(name, active_policy->name);
>> +}
>> +
>>  static int security_init(void)
>>  {
>>  	register_device(&security_device);
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |