linux-kernel - Re: [PATCH 01/24] efi: Add EFI_SECURE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15226.1491468497@warthog.procyon.org.uk>
Date:   Thu, 06 Apr 2017 09:48:17 +0100
From:   David Howells <dhowells@...hat.com>
To:     Ard Biesheuvel <ard.biesheuvel@...aro.org>
Cc:     dhowells@...hat.com,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
        "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
        Matthew Garrett <matthew.garrett@...ula.com>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        linux-security-module <linux-security-module@...r.kernel.org>,
        keyrings@...r.kernel.org, Josh Boyer <jwboyer@...oraproject.org>
Subject: Re: [PATCH 01/24] efi: Add EFI_SECURE_BOOT bit

Ard Biesheuvel <ard.biesheuvel@...aro.org> wrote:

> > @@ -1184,6 +1184,7 @@ void __init setup_arch(char **cmdline_p)
> >                         pr_info("Secure boot disabled\n");
> >                         break;
> >                 case efi_secureboot_mode_enabled:
> > +                       set_bit(EFI_SECURE_BOOT, &efi.flags);
> >                         pr_info("Secure boot enabled\n");
> >                         break;
> >                 default:
> 
> Like I asked when this patch was sent round the last time: is there
> any reason for this not to live in generic code?

It's interpreting the x86 boot_params at this point.  I suppose I could move
the following piece:

	if (efi_enabled(EFI_BOOT)) {
		switch (boot_params.secure_boot) {
		case efi_secureboot_mode_disabled:
			pr_info("Secure boot disabled\n");
			break;
		case efi_secureboot_mode_enabled:
			pr_info("Secure boot enabled\n");
			break;
		default:
			pr_info("Secure boot could not be determined\n");
			break;
		}
	}

into generic code and pass in boot_params.secure_boot as an argument (since
that's x86-specific I believe.  Any suggestions as to where?  The same file as
efi_get_secureboot() would seem to be the wrong place since that gets linked
into the bootwrapper.  I could put it into drivers/firmware/efi/secure_boot.c
and make that conditional in the Makefile.

David