| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 4 Sep 2012 10:44:59 -0600 From: Shuah Khan <shuahkhan@...il.com> To: Matthew Garrett <mjg@...hat.com> Cc: linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org, linux-efi@...r.kernel.org, Josh Boyer <jwboyer@...hat.com> Subject: Re: [PATCH 10/11] acpi: Ignore acpi_rsdp kernel parameter in a secure boot environment On Tue, Sep 4, 2012 at 10:38 AM, Matthew Garrett <mjg@...hat.com> wrote: > On Tue, Sep 04, 2012 at 10:30:46AM -0600, Shuah Khan wrote: >> On Tue, Sep 4, 2012 at 9:55 AM, Matthew Garrett <mjg@...hat.com> wrote: >> > From: Josh Boyer <jwboyer@...hat.com> >> > >> > This option allows userspace to pass the RSDP address to the kernel. This >> > could potentially be used to circumvent the secure boot trust model. >> > We ignore the setting if we don't have the CAP_SECURE_FIRMWARE capability. >> >> Does this mean, acpi_rsdp is disabled on all current platforms that >> don't support CAP_SECURE_FIRMWARE? > > No, if you're not using secure boot then you'll have > CAP_SECURE_FIRMWARE. Gotta say this capability name is confusing. Naming is CAP_PRE_SECURE_BOOT or something along the lines might be a better choice. When I just look at this name, I sure thought this CAP_SECURE_FIRMWARE true means it is a secure boot capable firmware. -- Shuah -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists