Path: csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod
From: Matt Fleming <matt@codeblueprint.co.uk>
Newsgroups: linux.kernel
Subject: Re: What should the default lockdown mode be if the bootloader  sentinel triggers sanitization?
Date: Mon, 30 Jan 2017 15:00:02 +0100
Message-ID: <t5kEW-4Ed-43@gated-at.bofh.it>
References: <t4fnY-58H-3@gated-at.bofh.it> <t2Ulz-3fA-3@gated-at.bofh.it> <t0gVk-1Kl-15@gated-at.bofh.it> <sYsee-82P-29@gated-at.bofh.it> <sM69r-68W-3@gated-at.bofh.it> <sM69t-68W-67@gated-at.bofh.it> <sYtai-an-29@gated-at.bofh.it> <t0hy2-2jl-17@gated-at.bofh.it> <t2V7X-3R1-15@gated-at.bofh.it> <t5j6b-3SD-25@gated-at.bofh.it>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.24+41 (02bc14ed1569) (2015-08-30)
Sender: robomod@news.nic.it
Approved: robomod@news.nic.it
Lines: 12
Organization: linux.* mail to news gateway
Xref: csiph.com linux.kernel:1569756

On Mon, 30 Jan, at 12:10:29PM, David Howells wrote:
> 
> Matt argues, however, that boot_params->secure_boot should be propagated from
> the bootloader and if the bootloader wants to set it, then we should skip the
> check in efi_main() and go with the bootloader's opinion.  This is something
> we probably want to do with kexec() so that the lockdown state is propagated
> there.
 
Actually what I was arguing for was that if the boot loader wants to
set it and bypass the EFI boot stub, e.g. by going via the legacy
64-bit entry point, startup_64, then we should allow that as well as
setting the flag in the EFI boot stub.