Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-05-19 Thread Bobby Eshleman
On Wed, Apr 29, 2020 at 05:51:08PM -0500, Bobby Eshleman wrote: > > # Option #1: PE/COFF and Shim > ... snip ... > > # Option #3: Lean on Grub2's LoadFile2() Verification > ... snip ... It's safe to say that the options boiled down to #1 and #3. Seeing as how we may not be able to start pl

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-05-06 Thread Ard Biesheuvel
On Tue, 5 May 2020 at 23:58, Bobby Eshleman wrote: > > On Thu, Apr 30, 2020 at 01:41:12PM +0200, Ard Biesheuvel wrote: > > On Thu, 30 Apr 2020 at 13:15, Daniel Kiper wrote: > > > Anyway, the advantage of this new protocol is that it uses UEFI API to > > > load and execute PE kernel and its module

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-05-05 Thread Bobby Eshleman
On Thu, Apr 30, 2020 at 01:41:12PM +0200, Ard Biesheuvel wrote: > On Thu, 30 Apr 2020 at 13:15, Daniel Kiper wrote: > > Anyway, the advantage of this new protocol is that it uses UEFI API to > > load and execute PE kernel and its modules. This means that it will be > > architecture independent. Ho

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-05-01 Thread Marek Marczykowski-Górecki
On Fri, May 01, 2020 at 01:59:59PM +0200, Daniel Kiper wrote: > On Fri, May 01, 2020 at 12:27:17AM +0200, Marek Marczykowski-Górecki wrote: > > On Wed, Apr 29, 2020 at 05:51:08PM -0500, Bobby Eshleman wrote: > > > # Option #3: Lean on Grub2's LoadFile2() Verification > > > > > > Grub2 will provide

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-05-01 Thread Daniel Kiper
On Fri, May 01, 2020 at 12:27:17AM +0200, Marek Marczykowski-Górecki wrote: > On Wed, Apr 29, 2020 at 05:51:08PM -0500, Bobby Eshleman wrote: > > # Option #3: Lean on Grub2's LoadFile2() Verification > > > > Grub2 will provide a LoadFile2() method to subsequent programs that supports > > signature

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-04-30 Thread Christopher Clark
On Thu, Apr 30, 2020 at 3:28 PM Marek Marczykowski-Górecki wrote: > > On Wed, Apr 29, 2020 at 05:51:08PM -0500, Bobby Eshleman wrote: > > # Option #3: Lean on Grub2's LoadFile2() Verification > > > > Grub2 will provide a LoadFile2() method to subsequent programs that supports > > signature verific

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-04-30 Thread Marek Marczykowski-Górecki
On Wed, Apr 29, 2020 at 05:51:08PM -0500, Bobby Eshleman wrote: > # Option #3: Lean on Grub2's LoadFile2() Verification > > Grub2 will provide a LoadFile2() method to subsequent programs that supports > signature verification of arbitrary files. Linux is moving in the > direction of using LoadFil

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-04-30 Thread Ard Biesheuvel
On Thu, 30 Apr 2020 at 13:15, Daniel Kiper wrote: > > Adding Ard... > > On Thu, Apr 30, 2020 at 09:01:45AM +0200, Jan Beulich wrote: > > On 30.04.2020 00:51, Bobby Eshleman wrote: > > > Hey all, > > > > > > We're looking to develop UEFI Secure Boot support for grub-loaded Xen and > > > ultimately

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-04-30 Thread Daniel Kiper
Adding Ard... On Thu, Apr 30, 2020 at 09:01:45AM +0200, Jan Beulich wrote: > On 30.04.2020 00:51, Bobby Eshleman wrote: > > Hey all, > > > > We're looking to develop UEFI Secure Boot support for grub-loaded Xen and > > ultimately for XCP-ng (I'm on the XCP-ng team at Vates). > > > > In addition to

Re: [RFC] UEFI Secure Boot on Xen Hosts

2020-04-30 Thread Jan Beulich
On 30.04.2020 00:51, Bobby Eshleman wrote: > Hey all, > > We're looking to develop UEFI Secure Boot support for grub-loaded Xen and > ultimately for XCP-ng (I'm on the XCP-ng team at Vates). > > In addition to carrying the chain-of-trust through the entire boot sequence > into dom0, we would also