You may want to check subject. If it does something, it is not dummy. > --- a/Documentation/kernel-parameters.txt > +++ b/Documentation/kernel-parameters.txt > @@ -2784,6 +2784,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. > Note: increases power consumption, thus should only be > enabled if running jitter sensitive (HPC/RT) workloads. > > + secureboot_enable= > + [KNL] Enables an emulated UEFI Secure Boot mode. This > + locks down various aspects of the kernel guarded by the > + CAP_COMPROMISE_KERNEL capability. This includes things > + like /dev/mem, IO port access, and other areas. It can > + be used on non-UEFI machines for testing purposes. > + > security= [SECURITY] Choose a security module to enable at boot. > If this boot parameter is not specified, only the first > security module asking for security registration will be > diff --git a/kernel/cred.c b/kernel/cred.c > index e0573a4..c3f4e3e 100644 > --- a/kernel/cred.c > +++ b/kernel/cred.c > @@ -565,6 +565,23 @@ void __init cred_init(void) > 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL); > } > > +void __init secureboot_enable() > +{ > + pr_info("Secure boot enabled\n"); > + cap_lower((&init_cred)->cap_bset, CAP_COMPROMISE_KERNEL); > + cap_lower((&init_cred)->cap_permitted, CAP_COMPROMISE_KERNEL); > +} OTOH you don't implement CAP_COMPROMISE_KERNEL, so it is dummy after all. But CAP_COMPROMISE_KERNEL is infeasible to implement, right? Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html