linux-kernel - Re: [PATCH v3] efi: Do not import certificates from UEFI Secure Boot for T2 Macs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 13 Feb 2022 08:36:37 +0000
From:   Aditya Garg <gargaditya08@...e.com>
To:     Lukas Wunner <lukas@...ner.de>
CC:     David Laight <David.Laight@...LAB.COM>,
        Ard Biesheuvel <ardb@...nel.org>,
        Matthew Garrett <mjg59@...f.ucam.org>,
        Jeremy Kerr <jk@...abs.org>,
        "joeyli.kernel@...il.com" <joeyli.kernel@...il.com>,
        "zohar@...ux.ibm.com" <zohar@...ux.ibm.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "eric.snowberg@...cle.com" <eric.snowberg@...cle.com>,
        "dhowells@...hat.com" <dhowells@...hat.com>,
        "jlee@...e.com" <jlee@...e.com>,
        "James.Bottomley@...senpartnership.com" 
        <James.Bottomley@...senPartnership.com>,
        "jarkko@...nel.org" <jarkko@...nel.org>,
        "mic@...ikod.net" <mic@...ikod.net>,
        "dmitry.kasatkin@...il.com" <dmitry.kasatkin@...il.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        Orlando Chamberlain <redecorating@...tonmail.com>,
        Aun-Ali Zaidi <admin@...eit.net>
Subject: Re: [PATCH v3] efi: Do not import certificates from UEFI Secure Boot
 for T2 Macs


> 
> The T2 is represented by a PCI device with ID 106B:1802.  I think it
> would be more elegant to sense presence of that device instead of
> hardcoding a long dmi list, i.e.:
> 
> static bool apple_t2_present(void)
> {
> 	struct pci_dev *pdev;
> 
> 	if (!x86_apple_machine)
> 		return false;
> 
> 	pdev = pci_get_device(PCI_VENDOR_ID_APPLE, 0x1802, NULL);
> 	if (pdev) {
> 		pci_put_dev(pdev);
> 		return true;
> 	}
> 
> 	return false;
> }

I’d rather prefer DMI cause :-
1. There are chances that some non T2 Macs may require this quirk as well. (After all we are talking about Apple)
2. There are slight chances that some non Apple Machines may require this as well

I also am not used to pci based quirks, making it a bit difficult for me to make a patch based on that :(.
The code length is anyways short now.