From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23B0FC001DF for ; Fri, 21 Jul 2023 15:27:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231851AbjGUP1L (ORCPT ); Fri, 21 Jul 2023 11:27:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33592 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231723AbjGUP1I (ORCPT ); Fri, 21 Jul 2023 11:27:08 -0400 Received: from bedivere.hansenpartnership.com (bedivere.hansenpartnership.com [IPv6:2607:fcd0:100:8a00::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3845A12F; Fri, 21 Jul 2023 08:27:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=hansenpartnership.com; s=20151216; t=1689953227; bh=FngqbpUI4Rw9Bf1aCJcQKawbuMpbfY3PSkF8qrGHcrk=; h=Message-ID:Subject:From:To:Date:In-Reply-To:References:From; b=ZvbvMKkP0V4OCTmLGyuzoGeaYYl86jH2pvT2cIPwnRxKyrHItK1YV8BPIoh+jnEmF p7vfGpcjnW5ZLLCevQtulovzEhrSkWUY3EKW6dTizCgvC6GQIVdXnYQqq89Hja4mLG uyrjQCOywnUKtkJ2uWVX5b7cQW/OBBW+JQ5qTxiY= Received: from localhost (localhost [127.0.0.1]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id 56F111285F09; Fri, 21 Jul 2023 11:27:07 -0400 (EDT) Received: from bedivere.hansenpartnership.com ([127.0.0.1]) by localhost (bedivere.hansenpartnership.com [127.0.0.1]) (amavis, port 10024) with ESMTP id nkCt7AA_vId3; Fri, 21 Jul 2023 11:27:07 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=hansenpartnership.com; s=20151216; t=1689953227; bh=FngqbpUI4Rw9Bf1aCJcQKawbuMpbfY3PSkF8qrGHcrk=; h=Message-ID:Subject:From:To:Date:In-Reply-To:References:From; b=ZvbvMKkP0V4OCTmLGyuzoGeaYYl86jH2pvT2cIPwnRxKyrHItK1YV8BPIoh+jnEmF p7vfGpcjnW5ZLLCevQtulovzEhrSkWUY3EKW6dTizCgvC6GQIVdXnYQqq89Hja4mLG uyrjQCOywnUKtkJ2uWVX5b7cQW/OBBW+JQ5qTxiY= Received: from lingrow.int.hansenpartnership.com (unknown [IPv6:2601:5c4:4302:c21::c14]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (2048 bits) server-digest SHA256) (Client did not present a certificate) by bedivere.hansenpartnership.com (Postfix) with ESMTPSA id 7B9F51285CE5; Fri, 21 Jul 2023 11:27:05 -0400 (EDT) Message-ID: <58a3914d2c147d926a09ca833550031828098b31.camel@HansenPartnership.com> Subject: Re: [RFC PATCH v2] x86/boot: add .sbat section to the bzImage From: James Bottomley To: Luca Boccassi Cc: Eric Snowberg , Ard Biesheuvel , "Daniel P." =?ISO-8859-1?Q?Berrang=E9?= , Emanuele Giuseppe Esposito , "x86@kernel.org" , Thomas Gleixner , "lennart@poettering.net" , Ingo Molnar , Borislav Petkov , Dave Hansen , "H. Peter Anvin" , Andrew Morton , Masahiro Yamada , Alexander Potapenko , Nick Desaulniers , Vitaly Kuznetsov , open list , "linux-efi@vger.kernel.org" , "keyrings@vger.kernel.org" , Jarkko Sakkinen Date: Fri, 21 Jul 2023 11:27:03 -0400 In-Reply-To: References: <20230711154449.1378385-1-eesposit@redhat.com> <0aa647f719103e8620d7209cbde40f04a7334749.camel@HansenPartnership.com> <635B383C-38A5-479E-80A6-358D5F90988B@oracle.com> <137ddc2957d43576afd37afb0bedab3ceea1f8d7.camel@HansenPartnership.com> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.42.4 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2023-07-21 at 16:22 +0100, Luca Boccassi wrote: > On Fri, 21 Jul 2023 at 16:14, Luca Boccassi wrote: [...] > > Anyway, I wasn't aware that SUSE doesn't embed their cert in Shim, > > we'll have to take that in consideration for sure. > > Actually, a dev from SUSE's security just confirmed they embed their > CA in Shim like every other distribution. Nobody seems to be aware of > any example where a distribution relies exclusively on MoK - and > that's understandable, as that would mean failing to boot by default > on a new machine. Do you have any example/cases where that's actually > happening? Outside development/local signing/etc. It happened last year for an openSUSE Leap update that changed the kernel signing certificate. I got asked to confirm acceptance of the new key and it got put in my MokList, which now has three certificates: two suse ones and my own. James