From 73ab25f419cb09b5cb8cefb6a7cfff7c83b4d1a1 Mon Sep 17 00:00:00 2001 From: Mikhail Zaslonko Date: Mon, 16 Feb 2026 13:51:00 +0100 Subject: [PATCH] zipl/boot: Add secure boot option to the dump programm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With SECURE_BOOT_DISABLED always set in add_dump_program() no signature entries for a dump kernel are written. This might lead to security violation error from the IPL Loader on the systems with secure boot support on the attempt to boot the dump kernel: MLOLOA6269321F A security violation error was encountered when loading from device MLOLOA62693212 Audit: No signed components found for program 0 loaded from device Propagate '--secure' zipl option to add_dump_program() in order to sign relevant components upon dump program installation and thus support secure boot execution for List-directed dump kernels. Signed-off-by: Mikhail Zaslonko Acked-by: Eduard Shishkin Reviewed-by: Stefan Haberland Reviewed-by: Alexander Egorenkov Tested-by: Alexander Egorenkov Signed-off-by: Jan Höppner --- zipl/src/bootmap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/zipl/src/bootmap.c b/zipl/src/bootmap.c index 7c25d2c3..7d75b608 100644 --- a/zipl/src/bootmap.c +++ b/zipl/src/bootmap.c @@ -1062,7 +1062,7 @@ static int add_segment_program(struct install_set *bis, static int add_dump_program(struct install_set *bis, const struct job_dump_data *dump, disk_blockptr_t *program, int verbose, - component_header_type type, + component_header_type type, int is_secure, int program_table_id) { struct job_ipl_data ipl; @@ -1072,7 +1072,7 @@ static int add_dump_program(struct install_set *bis, ipl.common = dump->common; return add_ipl_program(bis, false, NULL, &ipl, program, - verbose, 1, type, SECURE_BOOT_DISABLED, + verbose, 1, type, is_secure, 0 /* menu_idx */, 0 /* mirror id */, program_table_id); } @@ -1146,7 +1146,7 @@ static int build_program_table(struct job_data *job, struct install_set *bis, } rc = add_dump_program(bis, &job->data.dump, &table[0], verbose || job->command_line, - COMPONENT_HEADER_DUMP, + COMPONENT_HEADER_DUMP, job->is_secure, program_table_id); break; case job_menu: