Messages in this thread | | | Subject | Re: Use PCI ROMs from EFI boot services | From | Matthew Garrett <> | Date | Wed, 05 Dec 2012 20:13:29 -0500 |
| |
"H. Peter Anvin" <hpa@zytor.com> wrote:
>And that presumably would be something that cannot be exposed to root? >If so we may want to use one of the bits in the setup_data type field >as >a security flag, perhaps...
Yeah, it needs to be hidden from root - but ideally we'd be passing it to the second kernel if we kexec. Alternative would be for it to be capability bounded to a trusted signed kexec binary if we implement Vivek's IMA-based approach.
-- Matthew Garrett | mjg59@srcf.ucam.org
| |