On Fri, Jun 13, 2014 at 04:00:28PM +0800, WANG Chao wrote: > On 06/13/14 at 09:50am, Borislav Petkov wrote: > > On Mon, Jun 09, 2014 at 11:41:37AM -0400, Vivek Goyal wrote: > > > IIUC, COMMAND_LINE_SIZE gives max limits of running kernel and it does > > > not tell us anything about command line size supported by kernel being > > > loaded. > > > > Whatever you do, you do need a sane default because even querying the > > boot protocol is not reliable as the to-be-loaded kernel's boot protocol > > might be manipulated too, before signing (who knows what people do > > in the wild). > > Make sense. > > > > > So having a sane, unconditional fallback COMMAND_LINE_SIZE from the > > first kernel is a must, methinks. > > By greping for COMMAND_LINE_SIZE for different arch, I think 8K being > the fallback, in general, is good for now and the future: How do you know we will never cross 8K. Also what kind of protection you have against kernel file size and initrd file size? If we don't have any protection there, why command line size is so special (Which is much smaller than kernel and initrd). Thanks Vivek
