From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S938708AbcKWONg convert rfc822-to-8bit (ORCPT ); Wed, 23 Nov 2016 09:13:36 -0500 Received: from mx1.redhat.com ([209.132.183.28]:40650 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935052AbcKWONc (ORCPT ); Wed, 23 Nov 2016 09:13:32 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20161123134219.GH24624@leverpostej> References: <20161123134219.GH24624@leverpostej> <20161123104757.GE24624@leverpostej> <147986054870.13790.8640536414645705863.stgit@warthog.procyon.org.uk> <147986057768.13790.3027173260868896792.stgit@warthog.procyon.org.uk> <18007.1479900357@warthog.procyon.org.uk> To: Mark Rutland Cc: dhowells@redhat.com, lukas@wunner.de, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 4/6] efi: Get the secure boot status [ver #2] MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <31973.1479910408.1@warthog.procyon.org.uk> Content-Transfer-Encoding: 8BIT Date: Wed, 23 Nov 2016 14:13:28 +0000 Message-ID: <31974.1479910408@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Wed, 23 Nov 2016 14:13:31 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Mark Rutland wrote: > > > if (secure_boot < 0) > > > pr_efi_err(sys_table, > > > "could not determine UEFI Secure Boot status.\n"); > > > > In which case, should this be moved into efi_get_secureboot() and it return a > > bool? > > That would make sense to me, provided we're only likely to call that > once (and only log once). > > I guess it would also make sense to change the latter case to soemthing > like: > > Could not determine UEFI Secure Boot status. Assuming enabled. > > ... so as to make it clear what the effect is. Actually, the two arches have a different interpretation on how to deal with an error. Matthew Garrett's original x86 patch assumes that if we get an error when trying to read SecureBoot and SetupMode that we're *not* in secure mode, but ARM assumes the opposite. David