Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755639AbdDNXQc (ORCPT ); Fri, 14 Apr 2017 19:16:32 -0400 Received: from mx1.redhat.com ([209.132.183.28]:58614 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754731AbdDNXQa (ORCPT ); Fri, 14 Apr 2017 19:16:30 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com E83A03DBC2 Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=dhowells@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com E83A03DBC2 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: References: <149142326734.5101.4596394505987813763.stgit@warthog.procyon.org.uk> <149142332458.5101.14654616837280513947.stgit@warthog.procyon.org.uk> To: Ard Biesheuvel Cc: dhowells@redhat.com, Thomas Gleixner , LKML , Kyle McMartin , "linux-efi@vger.kernel.org" , One Thousand Gnomes , "gregkh@linuxfoundation.org" , "x86@kernel.org" , linux-security-module , keyrings@vger.kernel.org, Matthew Garrett , Matt Fleming Subject: Re: [PATCH 06/24] Add a sysrq option to exit secure boot mode MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <12410.1492211784.1@warthog.procyon.org.uk> Date: Sat, 15 Apr 2017 00:16:24 +0100 Message-ID: <12411.1492211784@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Fri, 14 Apr 2017 23:16:30 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1129 Lines: 29 Ard Biesheuvel wrote: > That does bring me to another EFI related point: many of these patches > are x86 specific for no good reason. Note that the sysrq one is awkward since the key chosen *is* arch-specific. SysRq+x can't be arbitrarily assigned to this since some other arches have their own use for it. Anyway, the ones that are x86-specific are: efi: Add EFI_SECURE_BOOT bit efi: Lock down the kernel if booted in secure boot mode Add a sysrq option to exit secure boot mode Copy secure_boot flag in boot params across kexec reboot x86: Lock down IO port access when the kernel is locked down x86: Restrict MSR access when the kernel is locked down asus-wmi: Restrict debugfs interface when the kernel is locked down The first three are dealt with in the five patches I posted later, including making the choice of sysrq key an arch override. The bits that can be moved out to the efi firmware driver have been. The 4th looks to be x86 bootloader protocol specific. The remainder look very x86 specific, apart from one piece in the 5th patch where /dev/port is locked down. David