<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div dir="ltr" > </div>
<div dir="ltr" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt" ><div class="socmaildefaultfont" dir="ltr" style="font-family:Arial;font-size:10.5pt" ><div dir="ltr" ><div><font size="2" face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" >---</font></div>
<div><font size="2" face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" >Claudio Carvalho</font></div>
<div><font size="2" face="Default Sans Serif,Verdana,Arial,Helvetica,sans-serif" >Linux Security Development - IBM LTC</font></div></div></div></div></div></div></div></div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<blockquote data-history-content-modified="1" data-history-expanded="1" dir="ltr" style="border-left:solid #aaaaaa 2px; margin-left:5px; padding-left:5px; direction:ltr; margin-right:0px" >----- Original message -----<br>From: ppaidipe <ppaidipe@linux.vnet.ibm.com><br>To: Nayna Jain <nayna@linux.vnet.ibm.com><br>Cc: skiboot@lists.ozlabs.org, George Wilson <gcwilson@us.ibm.com>, Claudio Carvalho/Brazil/IBM@IBMBR, hellerda@us.ibm.com, erichte@us.ibm.com, sarahw@us.ibm.com<br>Subject: Re: [Skiboot] [PATCH] libstb/secureboot: Disable secureboot in OPAL by nvram<br>Date: Fri, May 11, 2018 9:04 AM<br>
<div><font size="2" face="Default Monospace,Courier New,Courier,monospace" >On 2018-05-11 16:52, Nayna Jain wrote:<br>> On 05/09/2018 02:40 PM, Pridhiviraj Paidipeddi wrote:<br>>> Currently custom debug petitboot kernels failed to boot on secureboot<br>>> enabled systems as the key verification fails results in enforcing the<br>>> boot. Due to which debugging any problems in petitboot kernel in<br>>> secure<br>>> boot enabled systems become hard.<br>>> This patch provides a way to disable secureboot in OPAL by using below<br>>> nvram command.<br>><br>> Petitboot verification should not be disabled if firmware secure boot<br>> is on. Its only Host OS kernel<br>> for which we can have the switch.<br>><br>> This patch can result in a loophole where someone as application user<br>> can disable<br>> verification of petitboot kernel using nvram utility.<br><br>Yeah, agree, but this is really a debug hack, without that there are<br>bugs related to keys<br>in upstream vs vendor released firmware, due to which verification fails<br>and boot enforce<br>happening on secureboot enabled systems,</font></div>
<div> </div>
<div> </div></blockquote>
<div dir="ltr" > </div>
<div dir="ltr" >I'm not sure if I know what bug you are talking about here. Can you elaborate more on that?</div>
<div dir="ltr" > </div>
<div dir="ltr" >Thanks,</div>
<div dir="ltr" >Claudio</div>
<div dir="ltr" > </div>
<blockquote class="history-quote-1526040784418" data-history-content-modified="1" data-history-expanded="1" dir="ltr" style="border-left:solid #aaaaaa 2px; margin-left:5px; padding-left:5px; direction:ltr; margin-right:0px" ><div><font size="2" face="Default Monospace,Courier New,Courier,monospace" >so we need a way to force<br>disable it, like the way<br>we have for enabling it via nvram. Otherwise debugging petitboot kernels<br>on such systems<br>became really hard.<br><br>Thanks<br>Pridhiviraj<br><br>><br>> Thanks & Regards,<br>> - Nayna<br>><br>>> nvram -p ibm,skiboot --update-config force-secure-mode=false<br>>><br>>> Signed-off-by: Pridhiviraj Paidipeddi <ppaidipe@linux.vnet.ibm.com><br>>> ---<br>>> libstb/secureboot.c | 3 +++<br>>> 1 file changed, 3 insertions(+)<br>>><br>>> diff --git a/libstb/secureboot.c b/libstb/secureboot.c<br>>> index 348acf5..8c8a9d6 100644<br>>> --- a/libstb/secureboot.c<br>>> +++ b/libstb/secureboot.c<br>>> @@ -107,6 +107,9 @@ void secureboot_init(void)<br>>> if (nvram_query_eq("force-secure-mode", "always")) {<br>>> secure_mode = true;<br>>> prlog(PR_NOTICE, "secure mode on (FORCED by nvram)\n");<br>>> + } else if (nvram_query_eq("force-secure-mode", "false")) {<br>>> + secure_mode = false;<br>>> + prlog(PR_NOTICE, "secure mode off (FORCED by nvram)\n");<br>>> } else {<br>>> secure_mode = dt_has_node_property(node, "secure-enabled", NULL);<br>>> prlog(PR_NOTICE, "secure mode %s\n",</font></div></blockquote>
<div dir="ltr" > </div></div><BR>