#!/bin/bash## kola:## # qemu is the only platform where setting a 'secure-boot' tag will cause## # secureboot to get turned on for that instance.## platforms: qemu## # Mark as exclusive since we are requesting secureboot and that won't take effect when we're## # running non-exclusively.## exclusive: true## tags: secure-boot## architectures: x86_64## description: Verify that the lockdown LSM is set to integrity when booted using Secure Boot## See https://bugzilla.redhat.com/show_bug.cgi?id=2333706set -xeuo pipefail. $KOLA_EXT_DATA/commonlib.shlockdown_state="$(cat "/sys/kernel/security/lockdown")"if [[ "$(mokutil --sb)" != "SecureBoot enabled" ]]; thenfatal "system is not running with Secure Boot enabled"fiif [[ "${lockdown_state}" != "none [integrity] confidentiality" ]]; thenfatal "lockdown LSM not set to integrity on a Secure Boot system"fiok "lockdown LSM set to integrity on a Secure Boot system"