lib/bootloader-zipl: Check for Secure Boot before zipl #3080
Conversation
|
Hi @nikita-dubrovskii. Thanks for your PR. I'm waiting for a ostreedev member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
nikita-dubrovskii
force-pushed
the
s390x_secure_boot
branch
from
78e1fbd to
305ee04
Compare
nikita-dubrovskii
changed the title
|
Here is a how-to: coreos/enhancements#10 |
nikita-dubrovskii
force-pushed
the
s390x_secure_boot
branch
from
305ee04 to
18dd377
Compare
| return glnx_prefix_error (error, "spawning dmesg"); | ||
| if (!g_spawn_check_exit_status (status, error)) | ||
| return glnx_prefix_error (error, "`dmesg` failed"); | ||
| *out_enabled = (output != NULL && strstr (output, "Secure-IPL enabled") != NULL); |
There was a problem hiding this comment.
Feels weird to be grepping for strings in logs for something like Secure Boot. I think --kernel prevents a simple e.g. echo Secure-IPL enabled > /dev/kmsg from throwing this off, but my vote would be to stick with the sysfs flag and open a issue against RHEL 9 to have it backported.
There was a problem hiding this comment.
Dropped dmesg and now read kmsg directly. I don't know when kernel fix comes, so it'd be better to have this workaround until former happens.
nikita-dubrovskii
force-pushed
the
s390x_secure_boot
branch
from
18dd377 to
274eb2c
Compare
|
/ok-to-test |
nikita-dubrovskii
force-pushed
the
s390x_secure_boot
branch
from
274eb2c to
c3a9a64
Compare
|
One thing I don't quite understand btw...isn't zipl in the position to check for secure boot itself? Would it make more sense for the code here to always run |
New versions are able to detect it (when |
|
Followup fixes in #3119 - can you review? |
Starting with z/VM Version 7 Release 3.0, service level 2301 we can run Linux with Secure Boot enabled