From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754383Ab2LFBNx (ORCPT ); Wed, 5 Dec 2012 20:13:53 -0500 Received: from cavan.codon.org.uk ([93.93.128.6]:44064 "EHLO cavan.codon.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751963Ab2LFBNv convert rfc822-to-8bit (ORCPT ); Wed, 5 Dec 2012 20:13:51 -0500 User-Agent: K-9 Mail for Android In-Reply-To: <50BFEF09.9000408@zytor.com> References: <1345739803-21017-1-git-send-email-mjg@redhat.com> <20121203200241.GG5906@thinkpad-t410> <20121206001819.GA30527@srcf.ucam.org> <50BFE50C.8030008@zytor.com> <50BFE890.5070109@zytor.com> <50BFEF09.9000408@zytor.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8BIT Content-Type: text/plain; charset=UTF-8 Subject: Re: Use PCI ROMs from EFI boot services From: Matthew Garrett Date: Wed, 05 Dec 2012 20:13:29 -0500 To: "H. Peter Anvin" CC: Yinghai Lu , Bjorn Helgaas , linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, linux-efi@vger.kernel.org, mfleming@intel.com, dwmw2@infradead.org, "Eric W. Biederman" Message-ID: X-cavan-blacklisted-at: zen.spamhaus.org X-SA-Do-Not-Run: Yes X-SA-Exim-Connect-IP: 208.54.37.202 X-SA-Exim-Mail-From: mjg59@srcf.ucam.org X-SA-Exim-Scanned: No (on cavan.codon.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org "H. Peter Anvin" wrote: >And that presumably would be something that cannot be exposed to root? >If so we may want to use one of the bits in the setup_data type field >as >a security flag, perhaps... Yeah, it needs to be hidden from root - but ideally we'd be passing it to the second kernel if we kexec. Alternative would be for it to be capability bounded to a trusted signed kexec binary if we implement Vivek's IMA-based approach. -- Matthew Garrett | mjg59@srcf.ucam.org