Messages in this thread | | | From | Ard Biesheuvel <> | Date | Fri, 25 Nov 2016 12:43:52 +0000 | Subject | Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] |
| |
On 25 November 2016 at 12:35, David Howells <dhowells@redhat.com> wrote: > Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote: > >> Yes. In pre-2.6, DeployedMode is not a reserved name, and so it may be >> possible for someone to slip in a DeployedMode=0 on a secure boot >> enabled system to trick the kernel into thinking lockdown should be >> disabled. > > How does one get the version number? Unfortunately, searching the document > for 'version' doesn't help as every page has that in the footer:-/ >
There is a 'revision' field in the header ('hdr') of the EFI system table, so something like
(sys_table_arg->hdr.revision >> 16) > 2 || ((sys_table_arg->hdr.revision >> 16) == 2 && (sys_table_arg->hdr.revision & 0xffff) >= 6)
should do the trick I think
>> > + if (val == 1) >> > + return 0; >> >> I think the logic is the wrong way around here. Secure Boot is enabled >> if SecureBoot=1 and SetupMode=0, unless DeployedMode=0. So you should >> return 0 here if val == 0, but only when running on 2.6 or later. > > Good point. > > David
| |