From: "H. Peter Anvin" <hpa-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>
To: Matthew Garrett <mjg59-1xO5oi07KQx4cg9Nei1l7Q@public.gmane.org>
Cc: Yinghai Lu <yinghai-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>,
Bjorn Helgaas <bhelgaas-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linux-pci-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
mfleming-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org,
dwmw2-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org,
"Eric W. Biederman"
<ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
Subject: Re: Use PCI ROMs from EFI boot services
Date: Wed, 05 Dec 2012 17:21:44 -0800 [thread overview]
Message-ID: <50BFF328.5030406@zytor.com> (raw)
In-Reply-To: <cd3b2e67-92af-494d-ba2d-4179ead6e06b-2ueSQiBKiTY7tOexoI0I+QC/G2K4zDHf@public.gmane.org>
On 12/05/2012 05:13 PM, Matthew Garrett wrote:
>
>
> "H. Peter Anvin" <hpa-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org> wrote:
>
>> And that presumably would be something that cannot be exposed to root?
>> If so we may want to use one of the bits in the setup_data type field
>> as
>> a security flag, perhaps...
>
> Yeah, it needs to be hidden from root - but ideally we'd be passing it to the second kernel if we kexec. Alternative would be for it to be capability bounded to a trusted signed kexec binary if we implement Vivek's IMA-based approach.
>
Either way a security flag in the type field makes sense.
-hpa
--
H. Peter Anvin, Intel Open Source Technology Center
I work for Intel. I don't speak on their behalf.
next prev parent reply other threads:[~2012-12-06 1:21 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1345739803-21017-1-git-send-email-mjg@redhat.com>
[not found] ` <1345739803-21017-1-git-send-email-mjg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2012-10-25 17:35 ` Use PCI ROMs from EFI boot services Bjorn Helgaas
2012-12-03 20:02 ` Seth Forshee
2012-12-05 20:09 ` Bjorn Helgaas
[not found] ` <CAErSpo7S2+Vt+9bkGLx_=AY9aSGCvAnkHfqu01gTj=eKs7btNw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-05 20:22 ` Matthew Garrett
[not found] ` <20121205202254.GA25398-1xO5oi07KQx4cg9Nei1l7Q@public.gmane.org>
2012-12-05 22:21 ` Bjorn Helgaas
2012-12-05 21:06 ` David Woodhouse
2012-12-06 0:15 ` Yinghai Lu
[not found] ` <CAE9FiQVdpmmExrPrLf7HYVuo0cTY9Xjn6bWzObbuSSeQ-e1PbA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-06 0:18 ` Matthew Garrett
2012-12-06 0:21 ` H. Peter Anvin
[not found] ` <50BFE50C.8030008-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>
2012-12-06 0:30 ` Yinghai Lu
2012-12-06 0:36 ` H. Peter Anvin
[not found] ` <50BFE890.5070109-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>
2012-12-06 0:57 ` Matthew Garrett
2012-12-06 1:04 ` H. Peter Anvin
2012-12-06 1:13 ` Matthew Garrett
[not found] ` <cd3b2e67-92af-494d-ba2d-4179ead6e06b-2ueSQiBKiTY7tOexoI0I+QC/G2K4zDHf@public.gmane.org>
2012-12-06 1:21 ` H. Peter Anvin [this message]
[not found] ` <50BFF328.5030406-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>
2012-12-06 6:19 ` Matthew Garrett
2012-12-06 1:00 ` Matthew Garrett
2012-12-06 0:22 ` Yinghai Lu
[not found] ` <20121206001819.GA30527-1xO5oi07KQx4cg9Nei1l7Q@public.gmane.org>
2012-12-06 0:23 ` Eric W. Biederman
2012-12-06 0:36 ` H. Peter Anvin
2012-12-06 0:51 ` Yinghai Lu
[not found] ` <CAE9FiQXwZAAMkWYT8EjsewpuZ-OWqoaFscyzGS_pSuO9C3bf9A-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2012-12-06 0:52 ` Yinghai Lu
2012-12-06 18:19 ` Bjorn Helgaas
2012-12-06 18:26 ` H. Peter Anvin
[not found] ` <50C0E339.4030607-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>
2012-12-06 18:54 ` Matthew Garrett
2012-12-06 18:57 ` Yinghai Lu
2012-12-06 21:44 ` Bjorn Helgaas
2012-12-06 0:56 ` H. Peter Anvin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50BFF328.5030406@zytor.com \
--to=hpa-ymnouzjc4hwavxtiumwx3w@public.gmane.org \
--cc=bhelgaas-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org \
--cc=dwmw2-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org \
--cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \
--cc=linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-pci-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=mfleming-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org \
--cc=mjg59-1xO5oi07KQx4cg9Nei1l7Q@public.gmane.org \
--cc=yinghai-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).