[opensuse-kernel] Re: [PATCH 10/18] efi: Enable secure boot lockdown automatically when enabled in firmware

On Thu, 22 Aug, at 07:01:49PM, Lee, Chun-Yi wrote:

From: Matthew Garrett

The firmware has a set of flags that indicate whether secure boot is enabled and enforcing. Use them to indicate whether the kernel should lock itself down. We also indicate the machine is in secure boot mode by adding the EFI_SECURE_BOOT bit for use with efi_enabled.

Signed-off-by: Matthew Garrett Signed-off-by: Josh Boyer Acked-by: Lee, Chun-Yi Signed-off-by: Lee, Chun-Yi --- Documentation/x86/zero-page.txt | 2 ++ arch/x86/boot/compressed/eboot.c | 32 ++++++++++++++++++++++++++++++++ arch/x86/include/asm/bootparam_utils.h | 8 ++++++-- arch/x86/include/uapi/asm/bootparam.h | 3 ++- arch/x86/kernel/setup.c | 7 +++++++ include/linux/cred.h | 2 ++ include/linux/efi.h | 1 + 7 files changed, 52 insertions(+), 3 deletions(-)

[...]

+static int get_secure_boot(efi_system_table_t *_table) +{ + u8 sb, setup; + unsigned long datasize = sizeof(sb); + efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID; + efi_status_t status; + + status = efi_call_phys5(sys_table->runtime->get_variable, + L"SecureBoot", &var_guid, NULL, &datasize, &sb); +

The _table argument isn't needed because it's never used. [...]

io_delay_init();

+ if (boot_params.secure_boot) { +#ifdef CONFIG_EFI + set_bit(EFI_SECURE_BOOT, &x86_efi_facility); +#endif + secureboot_enable(); + } +

efi_enabled(EFI_BOOT) should be checked also, instead of assuming that secure_boot contains a sensible value. -- Matt Fleming, Intel Open Source Technology Center -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-kernel+owner@opensuse.org