Re: [Ksummit-discuss] [TECH TOPIC] Kernel lockdown and secure boot

[Justin Forbes <jmforbes@linuxtx.org>]

On Wed, Sep 5, 2018 at 2:33 PM, Jiri Kosina <jikos@kernel.org> wrote:
> On Wed, 5 Sep 2018, David Howells wrote:
>
>> I would like to suggest having a kernel summit session on how to
>> progress the secure boot and kernel lockdown patches.  AIUI, various
>> distributions are actually including them in their kernels.
>
> FWIW, it's one of the rare exceptions where we are carrying non-upstream
> patchset in our tree, yes.
>
> I have to admit I already forgot what exactly was actually blocking the
> upstream merge ... ?
>
It seems to vary by merge attempt, but last time, there was some very
good discussion about lockdown being separated from secure boot. I
personally don't see a problem with that, it is a decent idea.
Lockdown is a config option on it's own, just also add a separate
config option option to enable lockdown on UEFI secure boot.  That way
people who want lockdown independent of secure boot can have it, and
distros who want to keep the current behavior can also do that.
There are also some more recent issues with BPF, the current lockdown
solution of "disable it" is a large hammer, and causes problems with
IPAddressAllow/IPAddressDeny.

Justin