Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Subject: Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
From: Matthew Garrett <mjg59@xxxxxxxxxxxxx>
Date: Sat, 12 Feb 2022 19:42:40 +0000
Cc: Ard Biesheuvel <ardb@xxxxxxxxxx>, Jeremy Kerr <jk@xxxxxxxxxx>, "joeyli.kernel@xxxxxxxxx" <joeyli.kernel@xxxxxxxxx>, "zohar@xxxxxxxxxxxxx" <zohar@xxxxxxxxxxxxx>, "jmorris@xxxxxxxxx" <jmorris@xxxxxxxxx>, "eric.snowberg@xxxxxxxxxx" <eric.snowberg@xxxxxxxxxx>, "dhowells@xxxxxxxxxx" <dhowells@xxxxxxxxxx>, "jlee@xxxxxxxx" <jlee@xxxxxxxx>, "James.Bottomley@xxxxxxxxxxxxxxxxxxxxx" <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>, "jarkko@xxxxxxxxxx" <jarkko@xxxxxxxxxx>, "mic@xxxxxxxxxxx" <mic@xxxxxxxxxxx>, "dmitry.kasatkin@xxxxxxxxx" <dmitry.kasatkin@xxxxxxxxx>, Linux Kernel Mailing List <linux-kernel@xxxxxxxxxxxxxxx>, "linux-efi@xxxxxxxxxxxxxxx" <linux-efi@xxxxxxxxxxxxxxx>, "linux-security-module@xxxxxxxxxxxxxxx" <linux-security-module@xxxxxxxxxxxxxxx>, "stable@xxxxxxxxxxxxxxx" <stable@xxxxxxxxxxxxxxx>, "keyrings@xxxxxxxxxxxxxxx" <keyrings@xxxxxxxxxxxxxxx>, "linux-integrity@xxxxxxxxxxxxxxx" <linux-integrity@xxxxxxxxxxxxxxx>, Orlando Chamberlain <redecorating@xxxxxxxxxxxxxx>, Aun-Ali Zaidi <admin@xxxxxxxxxx>
In-reply-to: <F078BEBE-3DED-4EE3-A2B8-2C5744B5454C@live.com>
User-agent: Mutt/1.10.1 (2018-07-13)

On Sat, Feb 12, 2022 at 05:53:47AM +0000, Aditya Garg wrote:

> Feb 12 11:01:52 MacBook kernel: Reading EFI variable db-d719b2cb-3d3a-4596-a3bc-dad00e67656f

Ok. With CONFIG_LOAD_UEFI_KEYS=n, can you run:

cat /sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f

and see whether it generates the same failure? If so then my (handwavy) 
guess is that something's going wrong with a firmware codepath for the 
d719b2cb-3d3a-4596-a3bc-dad00e67656f GUID. Someone could potentially 
then figure out whether the same happens under Windows, but the easiest 
thing is probably to just return a failure on Apple hardware when 
someone tries to access anything with that GUID.

Follow-Ups:
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Aditya Garg

References:
- [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Aditya Garg
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Matthew Garrett
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Aditya Garg
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Matthew Garrett
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Matthew Garrett
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Aditya Garg
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Matthew Garrett
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Aditya Garg
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Matthew Garrett
- Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
  - From: Aditya Garg

Prev by Date: [PATCH v3 01/25] bus: mhi: Fix pm_state conversion to string
Next by Date: [PATCH 4.9] bpf: Add kconfig knob for disabling unpriv bpf by default
Previous by thread: Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
Next by thread: Re: [PATCH] efi: Do not import certificates from UEFI Secure Boot for T2 Macs
Index(es):
- Date
- Thread

[Index of Archives] [Linux Kernel] [Kernel Development Newbies] [Linux USB Devel] [Video for Linux] [Linux Audio Users] [Yosemite Hiking] [Linux Kernel] [Linux SCSI]