From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966035AbcKXTlb (ORCPT ); Thu, 24 Nov 2016 14:41:31 -0500 Received: from bedivere.hansenpartnership.com ([66.63.167.143]:59828 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965378AbcKXTl3 (ORCPT ); Thu, 24 Nov 2016 14:41:29 -0500 Message-ID: <1480016487.2444.18.camel@HansenPartnership.com> Subject: Re: [PATCH 5/7] efi: Get the secure boot status [ver #3] From: James Bottomley To: David Howells , lukas@wunner.de Cc: linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-arm-kernel@lists.infradead.org Date: Thu, 24 Nov 2016 11:41:27 -0800 In-Reply-To: <147990565051.7576.9673287945782426886.stgit@warthog.procyon.org.uk> References: <147990561294.7576.6464430479448167484.stgit@warthog.procyon.org.uk> <147990565051.7576.9673287945782426886.stgit@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.16.5 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 2016-11-23 at 12:54 +0000, David Howells wrote: > Get the firmware's secure-boot status in the kernel boot wrapper and > stash it somewhere that the main kernel image can find. > > The efi_get_secureboot() function is extracted from the arm stub and > (a) generalised so that it can be called from x86 and (b) made to use > efi_call_runtime() so that it can be run in mixed-mode. > > Suggested-by: Lukas Wunner > Signed-off-by: David Howells Since you seem to be using this to mean "is the platform locked down?", this looks to be no longer complete in the UEFI 2.6 world. If DeployedMode == 0, even if SecureBoot == 1 and SetupMode == 0, you can remove the platform key by writing 1 to AuditMode and gain control of the secure variables. The lock down state becomes DeployedMode == 1, SecureBoot == 1 and SetupMode == 0 See the diagram on page 1817 http://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf James