From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.3 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A675EC07E99 for ; Sat, 3 Jul 2021 19:02:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 78A0B615FF for ; Sat, 3 Jul 2021 19:02:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229823AbhGCTEX (ORCPT ); Sat, 3 Jul 2021 15:04:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47576 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229781AbhGCTEV (ORCPT ); Sat, 3 Jul 2021 15:04:21 -0400 Received: from mail-wm1-x32f.google.com (mail-wm1-x32f.google.com [IPv6:2a00:1450:4864:20::32f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 80FC4C061765 for ; Sat, 3 Jul 2021 12:01:47 -0700 (PDT) Received: by mail-wm1-x32f.google.com with SMTP id j39-20020a05600c1c27b029020028e48b8fso2882651wms.0 for ; Sat, 03 Jul 2021 12:01:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=JEpecsenF7iAJjgXAMFTkwJ9cBqVkoo+kUXfejr1pKk=; b=QbeoomPd6EjJRFoTq1BvZhgrd6h99OOxxAGqC4Z3TSuIr6HRO2xyZsOnCb7yiSBeTk dR88b5n6U0frdC/yfPSjVMviFd/oFe3Ej3c4mzE135VMOxddOjJGgwmrifuucGPiUn1h YHjtkr+tnA64VNd5Nq3SrGX0duEdvo/z9W82ibQnhHv7GqAyuGrlxjKAQr+BvKR3q/tp L3cebByB5jTBEi/iribuscFzC4E8jf8DAVTtX9XrMIR1lXPHqhItcRFVYmGSEBF4c3Pi QnwkrYgV2OP2RQo36v5tcyvHW2+S5CHLPcmth9lX2rLMkAiCw98pkmFFxDVFXYyJKtu7 YWEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=JEpecsenF7iAJjgXAMFTkwJ9cBqVkoo+kUXfejr1pKk=; b=a5sv5bFh3DbLsBkilhGwNrIA/zsaZplROpBfvbrEydJhSs9u9ErLy0GA/8lANfp5cZ obRyU/ZLZTg3D02cLKoaFrCBYPOCpbhmCQzmLtOEZ/+JvsmzMKQTIfRIm/IrszHeOir5 rUIy/wSxjronI2rsInsd991rhTu0FEegXUuTtBxvVIrrSyQJbsDvnYqXpfK6p5r+rjGo iAReeB+I4oas/aJR2P+H/PRXm8FSnKQWzW1gzKhQ2fRZwAkzdRGs0Exg35b8MLlKuikp hzzg9VctEzeuR82SxvyIgv1LUmhaf57zN43dVzBrH3cNeyimUQEdUSgngMzZL/JUIyyD oh4A== X-Gm-Message-State: AOAM532TRSgPwpYTwXBDnvDaNtb4UQuJJVetSVLiPp2YaDHf9XeSeHoq l2/fV6jFpKngLrr4o1RhN7g= X-Google-Smtp-Source: ABdhPJxO9XGrSF0iCQmGMMgulp1wMRQChDmxihWbODFm8XYP888myiUJlTeaLwavnVYmLaUqEIB7Lg== X-Received: by 2002:a05:600c:1552:: with SMTP id f18mr5967521wmg.184.1625338906074; Sat, 03 Jul 2021 12:01:46 -0700 (PDT) Received: from [192.168.0.160] ([170.253.36.171]) by smtp.gmail.com with ESMTPSA id l2sm6775765wms.20.2021.07.03.12.01.45 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 03 Jul 2021 12:01:45 -0700 (PDT) Subject: Re: [Bug 213577] New: kernel_lockdown.7 seems to be incorrect about automatically enabling lockdown mode in secure boot mode To: bugzilla-daemon@bugzilla.kernel.org, David Howells , Heinrich Schuchardt , Michael Kerrisk References: Cc: Pedro Principeza , "linux-kernel@vger.kernel.org" , dann frazier From: "Alejandro Colomar (man-pages)" Message-ID: <0fd0f9af-65e8-b9fa-6487-ef28deb7e502@gmail.com> Date: Sat, 3 Jul 2021 21:01:44 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Added a few CCs. On 6/25/21 8:58 AM, bugzilla-daemon@bugzilla.kernel.org wrote: > https://bugzilla.kernel.org/show_bug.cgi?id=213577 > > Bug ID: 213577 > Summary: kernel_lockdown.7 seems to be incorrect about > automatically enabling lockdown mode in secure boot > mode > Product: Documentation > Version: unspecified > Hardware: All > OS: Linux > Status: NEW > Severity: normal > Priority: P1 > Component: man-pages > Assignee: documentation_man-pages@kernel-bugs.osdl.org > Reporter: peter@typeblog.net > Regression: No > > As of the time of posting, the kernel_lockdown.7 manpage [1] contains a > description about how lockdown mode is enabled by default when using EFI secure > boot: > >> On an EFI-enabled x86 or arm64 machine, lockdown will be automatically >> enabled > if the system boots in EFI Secure Boot mode. > > I have not followed lockdown development upstream recently, but it seems that > as of today the feature described above is still a downstream patch shipped by > some distributions like Fedora [2][3]. If this is the case, then including this > statement in the man page would be inappropriate, since it would not apply to > other distributions such as Arch Linux which do not include said patches. > > [1]: > https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man7/kernel_lockdown.7#n31 > [2]: > https://src.fedoraproject.org/rpms/kernel/blob/rawhide/f/Patchlist.changelog#_205 > [3]: > https://gitlab.com/cki-project/kernel-ark/-/commit/5850c93175b9d2e1081873f4bbe08dead202cb08 > -- Alejandro Colomar Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/ http://www.alejandro-colomar.es/