Re: [PATCH 00/12] One more attempt at useful kernel lockdown

[Matthew Garrett]

On Mon, 2013-09-09 at 13:18 -0400, Valdis.Kletnieks@xxxxxx wrote:

> You may as well bite the bullet on this one, and tie it together.  Without
> Secure Boot, by the time your code runs it's already too late.  That's the
> whole point of Secure Boot, after all.

It's already been made clear that nobody's interested in merging a
solution that's specific to Secure Boot. I can add a command line option
to set a default, and then anyone using an attesting bootloader
(TPM/TXT) can verify the state.

-- 
Matthew Garrett <matthew.garrett@xxxxxxxxxx>
èº{.nÇ+‰·Ÿ®‰­†+%ŠËlzwm…ébëæìr¸›zX§»®w¥Š{ayºÊÚë,j­¢f£¢·hš‹àz¹®w¥¢¸¢·¦j:+v‰¨ŠwèjØm¶Ÿÿ¾«‘êçzZ+ƒùšŽŠÝj"ú!¶iO•æ¬z·švØ^¶m§ÿðÃnÆàþY&—