lkml.org 
[lkml]   [2015]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 12/12] Add option to automatically set trusted_kernel when in Secure Boot mode
    On Fri, Mar 13, 2015 at 11:38:28AM -1000, Matthew Garrett wrote:
    > UEFI Secure Boot provides a mechanism for ensuring that the firmware will
    > only load signed bootloaders and kernels. Certain use cases may also
    > require that the kernel prevent userspace from inserting untrusted kernel
    > code at runtime. Add a configuration option that enforces this automatically
    > when enabled.
    >
    > Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
    > ---
    > Documentation/x86/zero-page.txt | 2 ++
    > arch/x86/Kconfig | 13 +++++++++++++
    > arch/x86/boot/compressed/eboot.c | 33 +++++++++++++++++++++++++++++++++
    > arch/x86/include/uapi/asm/bootparam.h | 3 ++-
    > arch/x86/kernel/setup.c | 6 ++++++
    > 5 files changed, 56 insertions(+), 1 deletion(-)
    >
    > diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt
    > index 82fbdbc..a811210 100644
    > --- a/Documentation/x86/zero-page.txt
    > +++ b/Documentation/x86/zero-page.txt
    > @@ -30,6 +30,8 @@ Offset Proto Name Meaning
    > 1E9/001 ALL eddbuf_entries Number of entries in eddbuf (below)
    > 1EA/001 ALL edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer
    > (below)
    > +1EB/001 ALL kbd_status Numlock is enabled

    This line looks like it was included by mistake?

    > +1EC/001 ALL secure_boot Secure boot is enabled in the firmware

    regards,
    dan carpenter



    \
     
     \ /
      Last update: 2015-04-22 14:21    [W:4.138 / U:0.244 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site