summary refs log tree commit diff
path: root/samples/ftrace
diff options
context:
space:
mode:
authorArd Biesheuvel <ardb@kernel.org>2022-09-20 17:08:23 +0200
committerArd Biesheuvel <ardb@kernel.org>2022-09-22 10:15:44 +0200
commit5f56a74cc0a6d9b9f8ba89cea29cd7c4774cb2b1 (patch)
tree171357207c8cdf2984ab9e9d0e319021cb6846c5 /samples/ftrace
parent63bf28ceb3ebbe76048c3fb2987996ca1ae64f83 (diff)
downloadlinux-5f56a74cc0a6d9b9f8ba89cea29cd7c4774cb2b1.tar.gz
efi: libstub: check Shim mode using MokSBStateRT
We currently check the MokSBState variable to decide whether we should
treat UEFI secure boot as being disabled, even if the firmware thinks
otherwise. This is used by shim to indicate that it is not checking
signatures on boot images. In the kernel, we use this to relax lockdown
policies.

However, in cases where shim is not even being used, we don't want this
variable to interfere with lockdown, given that the variable may be
non-volatile and therefore persist across a reboot. This means setting
it once will persistently disable lockdown checks on a given system.

So switch to the mirrored version of this variable, called MokSBStateRT,
which is supposed to be volatile, and this is something we can check.

Cc: <stable@vger.kernel.org> # v4.19+
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Peter Jones <pjones@redhat.com>
Diffstat (limited to 'samples/ftrace')
0 files changed, 0 insertions, 0 deletions