Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: LockDown that allows read of /dev/mem ?
To:     "David F." <df7729@gmail.com>
Cc:     linux-kernel <linux-kernel@vger.kernel.org>
References: <CAGRSmLvaZ7av7ne-XKfZGrij1x9i5v1aH=t0ufL=Ad1193G0vA@mail.gmail.com>
 <99e0ef5a-156f-c8e5-cfc3-7c50e5e15a98@metux.net>
 <CAGRSmLuoP79dkE5_NgF+wiuotsYc6sV=fk=qzBVcEsjq0by5CQ@mail.gmail.com>
From:   "Enrico Weigelt, metux IT consult" <lkml@metux.net>
Message-ID: <d4c9740c-61ef-764a-b56e-7957cd26e12a@metux.net>
Date:   Fri, 2 Jul 2021 09:42:31 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.11.0
MIME-Version: 1.0
In-Reply-To: <CAGRSmLuoP79dkE5_NgF+wiuotsYc6sV=fk=qzBVcEsjq0by5CQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: tl
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 21.06.21 17:29, David F. wrote:

Hi,

> Lockdown required by secure boot and shim signing (prevent acpi
> patching), root because it's main use is a utility boot disk.   If
> lockdown could be forced when secure boot active but not when not
> active, that be best, but I'm not seeing that option.  The other
> option maybe to modify open_port on mem.c to do the secure boot check.
> However searching EFI_SECURE_BOOT doesn't exist in 5.10.x as in
> efi_enabled(EFI_SECURE_BOOT) - It appears that is some other patch
> that is not applied to the base, I do see struct boot_params has a
> secure_boot field set, but can I access that from mem.c?  If not, is
> efi_get_secureboot() function available when /drivers/char/mem.c may
> be used?

I'd rather try not using /dev/mem at all.

What exactly do you really need it for, in that specific case ?


--mtx

-- 
---
Hinweis: unverschlüsselte E-Mails können leicht abgehört und manipuliert
werden ! Für eine vertrauliche Kommunikation senden Sie bitte ihren
GPG/PGP-Schlüssel zu.
---
Enrico Weigelt, metux IT consult
Free software and Linux embedded engineering
info@metux.net -- +49-151-27565287