Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] | Date | Fri, 25 Nov 2016 09:30:20 +0000 |
| |
James Bottomley <James.Bottomley@HansenPartnership.com> wrote:
> Since you seem to be using this to mean "is the platform locked down?", > this looks to be no longer complete in the UEFI 2.6 world. If > DeployedMode == 0, even if SecureBoot == 1 and SetupMode == 0, you can > remove the platform key by writing 1 to AuditMode and gain control of > the secure variables. The lock down state becomes DeployedMode == 1, > SecureBoot == 1 and SetupMode == 0 > > See the diagram on page 1817 > > http://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf
How many pages?!
Does the DeployedMode variable not exist in older versions of the UEFI spec?
David
| |