From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.71) id 1ad2UJ-0005cn-Vt for mharc-grub-devel@gnu.org; Mon, 07 Mar 2016 16:14:47 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52597) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ad2UH-0005c8-19 for grub-devel@gnu.org; Mon, 07 Mar 2016 16:14:46 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ad2UC-00009H-6k for grub-devel@gnu.org; Mon, 07 Mar 2016 16:14:44 -0500 Received: from mx1.redhat.com ([209.132.183.28]:55997) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ad2UB-00009B-VJ for grub-devel@gnu.org; Mon, 07 Mar 2016 16:14:40 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (Postfix) with ESMTPS id 8C6BF8F4E7; Mon, 7 Mar 2016 21:14:39 +0000 (UTC) Received: from redhat.com (ovpn-112-81.phx2.redhat.com [10.3.112.81]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u27LEW3R032017 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 7 Mar 2016 16:14:37 -0500 Date: Mon, 7 Mar 2016 16:14:32 -0500 From: Peter Jones To: "Vladimir 'phcoder' Serbinenko" Subject: Re: Bugs and tasks for 2.02[~rc1] Message-ID: <20160307211431.GE13163@redhat.com> References: <20160304200641.GC27106@redhat.com> <56DA9AE8.3010006@gmail.com> <20160307190016.GA13163@redhat.com> <56DDE5B0.6080002@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Andrei Borzenkov , The development of GRUB 2 , Colin Watson X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: The development of GNU GRUB List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Mar 2016 21:14:46 -0000 On Mon, Mar 07, 2016 at 08:40:58PM +0000, Vladimir 'phcoder' Serbinenko w= rote: > Le lun. 7 mars 2016 21:33, Andrei Borzenkov a =C3= =A9crit : >=20 > > 07.03.2016 22:57, Vladimir 'phcoder' Serbinenko =D0=BF=D0=B8=D1=88=D0= =B5=D1=82: > > >> > > >>>>> I would also appreciate if distros would tell which patches the= y > > would > > >>>>> carry if 2.02 was released as it is now. If some patches are in= more > > >> than 1 > > >>>>> distro we probably need to look into including them. > > >>>> > > >>>> Well, I have a bunch of patches that need to be clean up (or eve= n > > >>>> re-examined), and I've also got the secure-boot branch here: > > >>>> > > >>>> https://github.com/vathpela/grub2-fedora/tree/sb > > >>>> > > >>>> Which is all the patches distros should be carrying to work with > > Secure > > >>>> Boot correctly. This branch is also recently rebased against ma= ster, > > >>>> though I'm not sure what the current thinking is regarding their= path > > >>>> upstream. > > >>>> > > >>> > > >>> Personally I'd rather include support for it. I'm tired of linux = vs. > > >>> linuxefi nightmare, and patches have been in the wild long enough= . > > >> > > >> So what's the path forward, then? Just make all efi use linuxefi,= like > > >> linux vs linux16? That's pretty close to what I've got already, e= xcept > > >> on arm where it's just "linux" in EFI mode as well. But we could = make > > >> those aliases for the same thing on that platform easily enough. = Or do > > >> you have something else in mind? > > > > > > RedHat/Fedora config is too platform-dependent and platform is dete= cted > > at > > > mkconfig time rather than at runtime. This is a problem as runtime = and > > > mkconfig can be different. Case that I see often is coreboot failin= g due > > to > > > use of Linux16 (which is a valid protocol for coreboot and is used = for > > > memtest but Linux crashes with it) but other cases exist, like enab= ling > > or > > > disabling of SCM or moving disk to another computer. Can we fix thi= s by > > > introducing some helper to detect it on runtime? It can either be a > > > function or a real command > > > > > > > Yes, of course, that was what I actually mean - get rid of special > > linuxefi and just fold processing into standard linux command. We can > > simply always call shim protocol if available on EFI; it should retur= n > > success if secure boot is disabled so should be transparent. > > > Can you point to some patch to estimate code size of this change? What = if > shim is not available? How big part of it is related to secure boot? Ju= st > changing Linux boot protocol doesn't need FSF involvement. Accepting se= cure > boot might. I'd rather make verification framework and make secure boot > just one client, so module for it can be easily carried by whoever choo= ses > to implement it. But this is probably 2.03 material John Sullivan has, in the past, expressed that grub calling out to shim for secure boot validation is a reasonable method; I'm not sure why we'd need more involvement, but if you feel we must, okay. I'd rather see support for the only strong validation system we have in the real world, than arbitrary frameworks. But I agree, we're probably talking about something after 2.02. --=20 Peter