Messages in this thread | | | Date | Wed, 05 Dec 2012 17:21:44 -0800 | From | "H. Peter Anvin" <> | Subject | Re: Use PCI ROMs from EFI boot services |
| |
On 12/05/2012 05:13 PM, Matthew Garrett wrote: > > > "H. Peter Anvin" <hpa@zytor.com> wrote: > >> And that presumably would be something that cannot be exposed to root? >> If so we may want to use one of the bits in the setup_data type field >> as >> a security flag, perhaps... > > Yeah, it needs to be hidden from root - but ideally we'd be passing it to the second kernel if we kexec. Alternative would be for it to be capability bounded to a trusted signed kexec binary if we implement Vivek's IMA-based approach. >
Either way a security flag in the type field makes sense.
-hpa
-- H. Peter Anvin, Intel Open Source Technology Center I work for Intel. I don't speak on their behalf.
| |