Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933025AbbDVLh3 (ORCPT ); Wed, 22 Apr 2015 07:37:29 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:17752 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932616AbbDVLhY (ORCPT ); Wed, 22 Apr 2015 07:37:24 -0400 Date: Wed, 22 Apr 2015 14:36:54 +0300 From: Dan Carpenter To: Matthew Garrett Cc: linux-security-module@vger.kernel.org, james.l.morris@oracle.com, serge@hallyn.com, linux-kernel@vger.kernel.org, keescook@chromium.org, hpa@zytor.com, gnomes@lxorguk.ukuu.org.uk Subject: Re: [PATCH 12/12] Add option to automatically set trusted_kernel when in Secure Boot mode Message-ID: <20150422113654.GA12986@mwanda> References: <1426282708-21485-1-git-send-email-matthew.garrett@nebula.com> <1426282708-21485-13-git-send-email-matthew.garrett@nebula.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1426282708-21485-13-git-send-email-matthew.garrett@nebula.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1646 Lines: 38 On Fri, Mar 13, 2015 at 11:38:28AM -1000, Matthew Garrett wrote: > UEFI Secure Boot provides a mechanism for ensuring that the firmware will > only load signed bootloaders and kernels. Certain use cases may also > require that the kernel prevent userspace from inserting untrusted kernel > code at runtime. Add a configuration option that enforces this automatically > when enabled. > > Signed-off-by: Matthew Garrett > --- > Documentation/x86/zero-page.txt | 2 ++ > arch/x86/Kconfig | 13 +++++++++++++ > arch/x86/boot/compressed/eboot.c | 33 +++++++++++++++++++++++++++++++++ > arch/x86/include/uapi/asm/bootparam.h | 3 ++- > arch/x86/kernel/setup.c | 6 ++++++ > 5 files changed, 56 insertions(+), 1 deletion(-) > > diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt > index 82fbdbc..a811210 100644 > --- a/Documentation/x86/zero-page.txt > +++ b/Documentation/x86/zero-page.txt > @@ -30,6 +30,8 @@ Offset Proto Name Meaning > 1E9/001 ALL eddbuf_entries Number of entries in eddbuf (below) > 1EA/001 ALL edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer > (below) > +1EB/001 ALL kbd_status Numlock is enabled This line looks like it was included by mistake? > +1EC/001 ALL secure_boot Secure boot is enabled in the firmware regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/