From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932309AbdJZSWg (ORCPT ); Thu, 26 Oct 2017 14:22:36 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:51200 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932326AbdJZSWc (ORCPT ); Thu, 26 Oct 2017 14:22:32 -0400 Subject: Re: [GIT PULL] Kernel lockdown for secure boot From: Mimi Zohar To: David Howells , jmorris@namei.org Cc: gnomes@lxorguk.ukuu.org.uk, linux-efi@vger.kernel.org, mjg59@google.com, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, jforbes@redhat.com, linux-man@vger.kernel.org, jlee@suse.com, linux-security-module@vger.kernel.org Date: Thu, 26 Oct 2017 14:22:22 -0400 In-Reply-To: <29447.1509035858@warthog.procyon.org.uk> References: <29447.1509035858@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 x-cbid: 17102618-0012-0000-0000-000005864FCD X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17102618-0013-0000-0000-00001900CD2B Message-Id: <1509042142.5886.61.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-10-26_07:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=3 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1710260235 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 2017-10-26 at 17:37 +0100, David Howells wrote: > Hi James, > > Can you pull this patchset into security/next please? > > It adds kernel lockdown support for EFI secure boot. Note that it doesn't yet > cover: > > bpf - No agreement as to how > ftrace - Recently suggested, query sent to maintainer > perf - Not looked at yet. > > and there are some changes recently proposed that make it work with IMA that > I'll pass on as a follow up when we've fully worked them out. There's a major difference between leaving out support and preventing properly signed code from working properly.  We're already at -rc6. I'm just not sure how there will be time to include the patches, test, and send James a subsequent pull request before the next open window? Mimi