linux-kernel - Re: [PATCH 5/7] efi: Get the secure boot status [ver #3]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1480016487.2444.18.camel@HansenPartnership.com>
Date:   Thu, 24 Nov 2016 11:41:27 -0800
From:   James Bottomley <James.Bottomley@...senPartnership.com>
To:     David Howells <dhowells@...hat.com>, lukas@...ner.de
Cc:     linux-efi@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org, keyrings@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH 5/7] efi: Get the secure boot status [ver #3]

On Wed, 2016-11-23 at 12:54 +0000, David Howells wrote:
> Get the firmware's secure-boot status in the kernel boot wrapper and 
> stash it somewhere that the main kernel image can find.
> 
> The efi_get_secureboot() function is extracted from the arm stub and 
> (a) generalised so that it can be called from x86 and (b) made to use
> efi_call_runtime() so that it can be run in mixed-mode.
> 
> Suggested-by: Lukas Wunner <lukas@...ner.de>
> Signed-off-by: David Howells <dhowells@...hat.com>

Since you seem to be using this to mean "is the platform locked down?",
this looks to be no longer complete in the UEFI 2.6 world.  If
DeployedMode == 0, even if SecureBoot == 1 and SetupMode == 0, you can
remove the platform key by writing 1 to AuditMode and gain control of
the secure variables.  The lock down state becomes DeployedMode == 1,
SecureBoot == 1 and SetupMode == 0

See the diagram on page 1817

http://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf

James