mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
650e2da843
The actual secure boot state ensures that a Linux instance has loaded only trusted, signed software. During boot component signatures are verified. If secure boot is enabled, unsigned or unverifiable components prevent booting. Since Secure Boot on IBM Z is always triggered by the hypervisor, its state is merely observable by the active system. Secure boot: 1 - Linux booted secure (only trusted sources) Secure boot: 0 - Booted from any source without verification $ dmesg -t | grep Secure-IPL setup: Linux is running with Secure-IPL enabled $ cat /sys/kernel/security/lockdown none [integrity] confidentiality $ lsreipl Re-IPL type: fcp WWPN: 0x500507630710572c LUN: 0x4022409600000000 Device: 0.0.1908 bootprog: 0 br_lba: 0 Loadparm: "" Bootparms: "" Secure boot: 1 References: * https://www.ibm.com/docs/en/linux-on-systems?topic=using-verifying-secure-boot * https://www.ibm.com/docs/en/linux-on-systems?topic=introduction-requirements Signed-off-by: Jan Polensky <japo@linux.ibm.com> Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>