Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Kernel: T861: enable lockdown subsystem as UEFI secure boot dependency #875

Merged
merged 2 commits into from
Jan 3, 2025
Merged

Kernel: T861: enable lockdown subsystem as UEFI secure boot dependency #875

merged 2 commits into from
Jan 3, 2025

Conversation

c-po
Copy link
Member

@c-po c-po commented Jan 2, 2025 •
edited
Loading

Change summary

By its very design, SB may affect or limit some things that users want to do.

Using SB activates "lockdown" mode in the Linux kernel. This disables various features that can be used to modify the kernel:

https://wiki.debian.org/SecureBoot#Secure_Boot_limitations

image

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (formatting, renaming)
  • Refactoring (no functional changes)
  • Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
  • Other (please describe):

Related Task(s)

Related PR(s)

Checklist:

  • I have read the CONTRIBUTING document
  • I have linked this PR to one or more Phabricator Task(s)
  • My commit headlines contain a valid Task id
  • My change requires a change to the documentation
  • I have updated the documentation accordingly

@c-po c-po marked this pull request as ready for review January 2, 2025 10:47
@github-actions GitHub Actions
Copy link

github-actions bot commented Jan 2, 2025

❌
PR title does not match the required format

@github-actions github-actions bot added the current VyOS rolling release label Jan 2, 2025
@c-po c-po marked this pull request as draft January 2, 2025 18:48
@c-po c-po marked this pull request as ready for review January 3, 2025 18:04
dmbaturin
dmbaturin approved these changes Jan 3, 2025
View reviewed changes
Copy link
Member

@dmbaturin dmbaturin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if kernel update PRs should always be separate. I'm not against merging it, though.

@dmbaturin dmbaturin merged commit 91d67b0 into vyos:current Jan 3, 2025
8 of 9 checks passed
@c-po c-po deleted the secureboot-lockdown branch January 4, 2025 11:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dmbaturin dmbaturin dmbaturin approved these changes

@sever-sever sever-sever sever-sever approved these changes

@sarthurdev sarthurdev Awaiting requested review from sarthurdev sarthurdev is a code owner

@jestabro jestabro Awaiting requested review from jestabro jestabro is a code owner

@fett0 fett0 Awaiting requested review from fett0

@nicolas-fort nicolas-fort Awaiting requested review from nicolas-fort

@zdc zdc Awaiting requested review from zdc

Assignees

@c-po c-po

Labels
current VyOS rolling release
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@c-po @dmbaturin @sever-sever