Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1623822 > unrolled thread
| Started by | Thomas Gleixner <tglx@linutronix.de> |
|---|---|
| First post | 2017-04-14 20:10 +0200 |
| Last post | 2017-04-16 22:50 +0200 |
| Articles | 4 — 4 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [PATCH 06/24] Add a sysrq option to exit secure boot mode Thomas Gleixner <tglx@linutronix.de> - 2017-04-14 20:10 +0200
Re: [PATCH 06/24] Add a sysrq option to exit secure boot mode Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-04-14 20:20 +0200
Re: [PATCH 06/24] Add a sysrq option to exit secure boot mode David Howells <dhowells@redhat.com> - 2017-04-15 01:20 +0200
Re: [PATCH 06/24] Add a sysrq option to exit secure boot mode Matt Fleming <matt@codeblueprint.co.uk> - 2017-04-16 22:50 +0200
| From | Thomas Gleixner <tglx@linutronix.de> |
|---|---|
| Date | 2017-04-14 20:10 +0200 |
| Subject | Re: [PATCH 06/24] Add a sysrq option to exit secure boot mode |
| Message-ID | <twdPr-4ma-7@gated-at.bofh.it> |
On Wed, 5 Apr 2017, David Howells wrote: > From: Kyle McMartin <kyle@redhat.com> > > Make sysrq+x exit secure boot mode on x86_64, thereby allowing the running > kernel image to be modified. This lifts the lockdown. > > Signed-off-by: Kyle McMartin <kyle@redhat.com> > Signed-off-by: David Howells <dhowells@redhat.com> > cc: x86@kernel.org Matt, Ard? Any opinions on this? Thanks, tglx
[toc] | [next] | [standalone]
| From | Ard Biesheuvel <ard.biesheuvel@linaro.org> |
|---|---|
| Date | 2017-04-14 20:20 +0200 |
| Message-ID | <twdZ7-4pP-11@gated-at.bofh.it> |
| In reply to | #1623822 |
On 14 April 2017 at 19:05, Thomas Gleixner <tglx@linutronix.de> wrote: > On Wed, 5 Apr 2017, David Howells wrote: > >> From: Kyle McMartin <kyle@redhat.com> >> >> Make sysrq+x exit secure boot mode on x86_64, thereby allowing the running >> kernel image to be modified. This lifts the lockdown. >> >> Signed-off-by: Kyle McMartin <kyle@redhat.com> >> Signed-off-by: David Howells <dhowells@redhat.com> >> cc: x86@kernel.org > > Matt, Ard? > > Any opinions on this? > From an EFI point of view, there is not a lot to see here. I think having a SysRq to lift lockdown makes sense, although I think we should avoid 'secure boot' when referring to lockdown because they are really two different things. As someone else pointed out, you may have other ways of trusting your kernel, in which case you should be able to lock it down as well. That does bring me to another EFI related point: many of these patches are x86 specific for no good reason. We have been working really hard over the past couple of years to move EFI plumbing into drivers/firmware/efi, and things are not intimately related to an architecture should ideally be implemented there. Looking at the diffstat of this patch, I don't see why this should be a x86 only feature. In general, though, I think this should be two patches, one that introduces the functionality to restrict some SysRq keys to console only, and one that adds the 'x' for lockdown lift. I haven't gotten around to responding to David's general email regarding the point of all of this. I will do so asap, but it will need to wait until Tuesday at least. -- Ard. On 14 April 2017 at 19:05, Thomas Gleixner <tglx@linutronix.de> wrote: > On Wed, 5 Apr 2017, David Howells wrote: > >> From: Kyle McMartin <kyle@redhat.com> >> >> Make sysrq+x exit secure boot mode on x86_64, thereby allowing the running >> kernel image to be modified. This lifts the lockdown. >> >> Signed-off-by: Kyle McMartin <kyle@redhat.com> >> Signed-off-by: David Howells <dhowells@redhat.com> >> cc: x86@kernel.org > > Matt, Ard? > > Any opinions on this? > > Thanks, > > tglx
[toc] | [prev] | [next] | [standalone]
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Date | 2017-04-15 01:20 +0200 |
| Message-ID | <twiFr-7nN-1@gated-at.bofh.it> |
| In reply to | #1623826 |
Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote: > That does bring me to another EFI related point: many of these patches > are x86 specific for no good reason. Note that the sysrq one is awkward since the key chosen *is* arch-specific. SysRq+x can't be arbitrarily assigned to this since some other arches have their own use for it. Anyway, the ones that are x86-specific are: efi: Add EFI_SECURE_BOOT bit efi: Lock down the kernel if booted in secure boot mode Add a sysrq option to exit secure boot mode Copy secure_boot flag in boot params across kexec reboot x86: Lock down IO port access when the kernel is locked down x86: Restrict MSR access when the kernel is locked down asus-wmi: Restrict debugfs interface when the kernel is locked down The first three are dealt with in the five patches I posted later, including making the choice of sysrq key an arch override. The bits that can be moved out to the efi firmware driver have been. The 4th looks to be x86 bootloader protocol specific. The remainder look very x86 specific, apart from one piece in the 5th patch where /dev/port is locked down. David
[toc] | [prev] | [next] | [standalone]
| From | Matt Fleming <matt@codeblueprint.co.uk> |
|---|---|
| Date | 2017-04-16 22:50 +0200 |
| Message-ID | <twZhn-8eD-3@gated-at.bofh.it> |
| In reply to | #1623822 |
On Fri, 14 Apr, at 08:05:07PM, Thomas Gleixner wrote: > On Wed, 5 Apr 2017, David Howells wrote: > > > From: Kyle McMartin <kyle@redhat.com> > > > > Make sysrq+x exit secure boot mode on x86_64, thereby allowing the running > > kernel image to be modified. This lifts the lockdown. > > > > Signed-off-by: Kyle McMartin <kyle@redhat.com> > > Signed-off-by: David Howells <dhowells@redhat.com> > > cc: x86@kernel.org > > Matt, Ard? > > Any opinions on this? Looks OK to me.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web