Messages in this thread | | | Date | Fri, 28 Jun 2019 04:14:30 +1000 (AEST) | From | James Morris <> | Subject | Re: [PATCH V34 09/29] kexec_file: Restrict at runtime if the kernel is locked down |
| |
On Thu, 27 Jun 2019, Matthew Garrett wrote:
> By that metric, on a secure boot system how do we determine that code > running in the firmware environment wasn't compromised before it > launched the initial signed kernel?
Remote attestation tied to a hardware root of trust, before allowing access to any further resources.
-- James Morris <jmorris@namei.org>
| |