Re: EFI mode after running kexec

2013-08-29 Thread James Bottomley
On Thu, 2013-08-29 at 08:18 -0400, Josh Boyer wrote: On Wed, Aug 28, 2013 at 10:26 PM, Greg KH gre...@linuxfoundation.org wrote: Hi all, I've been messing with UEFI booting a kernel and then later on, using kexec to boot another kernel, and noticed that the kexec'ed kernel is not really

Re: [PATCH V2 01/10] Add secure_modules() call

2013-08-29 Thread Josh Boyer
On Mon, Aug 19, 2013 at 01:26:02PM -0400, Matthew Garrett wrote: Provide a single call to allow kernel code to determine whether the system has been configured to either disable module loading entirely or to load only modules signed with a trusted key. Signed-off-by: Matthew Garrett

Re: [PATCH V2 08/10] kexec: Disable at runtime if the kernel enforces module loading restrictions

2013-08-29 Thread Lenny Szubowicz
- Original Message - From: Matthew Garrett matthew.garr...@nebula.com To: linux-ker...@vger.kernel.org Cc: linux-efi@vger.kernel.org, jwbo...@redhat.com, keesc...@chromium.org, Matthew Garrett matthew.garr...@nebula.com Sent: Monday, August 19, 2013 1:26:09 PM Subject: [PATCH V2

Re: [PATCH V2 08/10] kexec: Disable at runtime if the kernel enforces module loading restrictions

2013-08-29 Thread Lenny Szubowicz
- Original Message - From: Lenny Szubowicz lszub...@redhat.com To: Matthew Garrett matthew.garr...@nebula.com, linux-ker...@vger.kernel.org Cc: linux-efi@vger.kernel.org, jwbo...@redhat.com, keesc...@chromium.org Sent: Thursday, August 29, 2013 11:57:36 AM Subject: Re: [PATCH V2

Re: [PATCH 05/10] asus-wmi: Restrict debugfs interface when module loading is restricted

2013-08-29 Thread Matthew Garrett
On Thu, 2013-08-29 at 11:22 -0700, H. Peter Anvin wrote: On 08/19/2013 09:10 AM, Matthew Garrett wrote: + if (!capable(CAP_COMPROMISE_KERNEL)) + return -EPERM; + Stale bits? Yeah. Did I manage to send out the old copy of that again? I'm sorry, spending a few months

Re: [PATCH 05/10] asus-wmi: Restrict debugfs interface when module loading is restricted

2013-08-29 Thread H. Peter Anvin
On 08/29/2013 11:35 AM, Matthew Garrett wrote: On Thu, 2013-08-29 at 11:22 -0700, H. Peter Anvin wrote: On 08/19/2013 09:10 AM, Matthew Garrett wrote: + if (!capable(CAP_COMPROMISE_KERNEL)) + return -EPERM; + Stale bits? Yeah. Did I manage to send out the old copy of that

Re: [PATCH 05/10] asus-wmi: Restrict debugfs interface when module loading is restricted

2013-08-29 Thread Matthew Garrett
On Thu, 2013-08-29 at 11:46 -0700, H. Peter Anvin wrote: On 08/29/2013 11:35 AM, Matthew Garrett wrote: On Thu, 2013-08-29 at 11:22 -0700, H. Peter Anvin wrote: On 08/19/2013 09:10 AM, Matthew Garrett wrote: + if (!capable(CAP_COMPROMISE_KERNEL)) + return -EPERM; + Stale

Re: [PATCH 05/10] asus-wmi: Restrict debugfs interface when module loading is restricted

2013-08-29 Thread H. Peter Anvin
On 08/29/2013 11:49 AM, Matthew Garrett wrote: No, you mixed and matched in a single patch... Right, but I'd fixed that in V2 (which I see I *did* send correctly, and you're just replying to the old one :)) Well, I'm responding to the one that was sent 31 minutes ago. -hpa --

Re: [PATCH 05/10] asus-wmi: Restrict debugfs interface when module loading is restricted

2013-08-29 Thread Matthew Garrett
On Thu, 2013-08-29 at 12:05 -0700, H. Peter Anvin wrote: On 08/29/2013 11:49 AM, Matthew Garrett wrote: No, you mixed and matched in a single patch... Right, but I'd fixed that in V2 (which I see I *did* send correctly, and you're just replying to the old one :)) Well, I'm

Re: EFI mode after running kexec

2013-08-29 Thread Greg KH
On Thu, Aug 29, 2013 at 08:18:39AM -0400, Josh Boyer wrote: On Wed, Aug 28, 2013 at 10:26 PM, Greg KH gre...@linuxfoundation.org wrote: Hi all, I've been messing with UEFI booting a kernel and then later on, using kexec to boot another kernel, and noticed that the kexec'ed kernel is not

Re: EFI mode after running kexec

2013-08-29 Thread Greg KH
On Thu, Aug 29, 2013 at 04:35:23PM +0400, James Bottomley wrote: On Thu, 2013-08-29 at 08:18 -0400, Josh Boyer wrote: On Wed, Aug 28, 2013 at 10:26 PM, Greg KH gre...@linuxfoundation.org wrote: Hi all, I've been messing with UEFI booting a kernel and then later on, using kexec to

Re: [PATCH 05/10] asus-wmi: Restrict debugfs interface when module loading is restricted

2013-08-29 Thread Josh Boyer
On Thu, Aug 29, 2013 at 12:05:47PM -0700, H. Peter Anvin wrote: On 08/29/2013 11:49 AM, Matthew Garrett wrote: No, you mixed and matched in a single patch... Right, but I'd fixed that in V2 (which I see I *did* send correctly, and you're just replying to the old one :)) Well, I'm

Re: [RFC PATCH 00/18 v3] Signature verification of hibernate snapshot

2013-08-29 Thread joeyli
於 四,2013-08-29 於 23:32 +0200,Pavel Machek 提到: Hi! - Bootloader store the public key to EFI boottime variable by itself - Bootloader put The private key to S4SignKey EFI variable for forward to kernel. Is the UEFI NVRAM really suited for such regular updates?