Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1529652

Re: [PATCH 5/7] efi: Get the secure boot status [ver #3]

Show all headers | View raw

On Wed, 2016-11-23 at 12:54 +0000, David Howells wrote:
> Get the firmware's secure-boot status in the kernel boot wrapper and 
> stash it somewhere that the main kernel image can find.
> 
> The efi_get_secureboot() function is extracted from the arm stub and 
> (a) generalised so that it can be called from x86 and (b) made to use
> efi_call_runtime() so that it can be run in mixed-mode.
> 
> Suggested-by: Lukas Wunner <lukas@wunner.de>
> Signed-off-by: David Howells <dhowells@redhat.com>

Since you seem to be using this to mean "is the platform locked down?",
this looks to be no longer complete in the UEFI 2.6 world.  If
DeployedMode == 0, even if SecureBoot == 1 and SetupMode == 0, you can
remove the platform key by writing 1 to AuditMode and gain control of
the secure variables.  The lock down state becomes DeployedMode == 1,
SecureBoot == 1 and SetupMode == 0

See the diagram on page 1817

http://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf

James

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/7] efi: Pass secure boot mode to kernel [ver #3] David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
  [PATCH 2/7] x86/efi: Allow invocation of arbitrary runtime services  [ver #3] David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
  [PATCH 4/7] efi: Add SHIM and image security database GUID  definitions [ver #3] David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
  [PATCH 7/7] efi: Add EFI_SECURE_BOOT bit [ver #3] David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
  [PATCH 1/7] efi: use typed function pointers for runtime services  table [ver #3] David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
  [PATCH 6/7] efi: Disable secure boot if shim is in insecure mode  [ver #3] David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
  [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
    Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-11-24 20:50 +0100
      Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-25 10:50 +0100
        Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-25 11:00 +0100
          Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-25 13:10 +0100
            Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-25 13:30 +0100
              Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-25 13:50 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-25 13:50 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-25 14:10 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-25 14:30 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-25 14:10 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-25 15:00 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-25 17:00 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-25 18:00 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] David Howells <dhowells@redhat.com> - 2016-11-25 18:00 +0100
                Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-25 18:00 +0100
  [PATCH 3/7] arm/efi: Allow invocation of arbitrary runtime services  [ver #3] David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100

csiph-web