Re: [Xen-devel] Booting signed xen.efi through shim

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 22.09.17 at 00:46, <tamas@xxxxxxxxxxxxx> wrote:
> One piece that I see still missing is the Xen command line parameters
> not being verified. It would be ideal to have the option to get that
> set during compile time as well, similar to Linux's CONFIG_CMDLINE
> option, to avoid for example getting iommu or XSM being turned off by
> someone with physical access.

We do have CMDLINE and CMDLINE_OVERRIDE. But for someone
with physical access it would likely also be possible to avoid secure
boot altogether?

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel