Disable demand for Intel CET in fwupdmgr security
#4960
Labels
Comments
|
Is CET marked as disabled, enabled, or active? We're testing the cpuid flags directly, not asking the kernel. The output of 'fwupdmgr security --json' would be helpful. |
|
@hughsie is marked as non-supported. at least the data sheet for the processor says it should be supported. I found in the Linux kernel support for IBT, but not for Shadow Stack. Both are part of CET. {
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "Linux swap",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"Name" : "fwupd plugins",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "tainted",
"Name" : "Linux kernel",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "Linux kernel lockdown",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "UEFI secure boot",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot",
"Flags" : [
"runtime-issue",
"action-config-fw"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "locked",
"Name" : "CSME manufacturing mode",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode",
"Flags" : [
"success"
],
"kind" : "CSME"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "locked",
"Name" : "CSME override",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap",
"Flags" : [
"success"
],
"kind" : "CSME"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "CSME v0:15.0.41.2158",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"success"
],
"kind" : "CSME",
"version" : "0:15.0.41.2158"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"Name" : "Platform Debugging",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "locked",
"Name" : "SPI BIOS region",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "enabled",
"Name" : "SPI lock",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"Name" : "SPI write",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.EmptyPcr",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "TPM empty PCRs",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.EmptyPcr",
"Flags" : [
"success"
],
"Guid" : [
"ff71992e-52f7-5eea-94ef-883e56e034c6",
"34801700-3a50-5b05-820c-fe14580e4c2d",
"00d06c7f-2244-5a35-aa98-5d60704b3f5d",
"03f304f4-223e-54f4-b2c1-c3cf3b5817c6",
"9c3106c7-42ca-5099-9363-96ef5c22cbf7"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "found",
"Name" : "TPM v2.0",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20",
"Flags" : [
"success"
],
"Guid" : [
"ff71992e-52f7-5eea-94ef-883e56e034c6",
"34801700-3a50-5b05-820c-fe14580e4c2d",
"00d06c7f-2244-5a35-aa98-5d60704b3f5d",
"03f304f4-223e-54f4-b2c1-c3cf3b5817c6",
"9c3106c7-42ca-5099-9363-96ef5c22cbf7"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.Pk",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "UEFI platform key",
"Plugin" : "uefi_pk",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.Pk",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "enabled",
"Name" : "IOMMU",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "enabled",
"Name" : "Intel BootGuard",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "valid",
"Name" : "Intel BootGuard verified boot",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "locked",
"Name" : "Platform Debugging",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.ReconstructionPcr0",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "valid",
"Name" : "TPM PCR0 reconstruction",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.ReconstructionPcr0",
"Flags" : [
"success"
],
"Guid" : [
"ff71992e-52f7-5eea-94ef-883e56e034c6",
"34801700-3a50-5b05-820c-fe14580e4c2d",
"00d06c7f-2244-5a35-aa98-5d60704b3f5d",
"03f304f4-223e-54f4-b2c1-c3cf3b5817c6",
"9c3106c7-42ca-5099-9363-96ef5c22cbf7"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "valid",
"Name" : "Intel BootGuard error policy",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "enabled",
"Name" : "Pre-boot DMA protection",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "enabled",
"Name" : "Suspend-to-idle",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"Name" : "Suspend-to-ram",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"Name" : "Intel CET Enabled",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"Created" : 1661703827,
"HsiLevel" : 4,
"HsiResult" : "enabled",
"Name" : "Intel SMAP",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"Created" : 1661703827,
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"Name" : "Encrypted RAM",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
}
],
"SecurityEvents" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "Linux swap",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"Name" : "fwupd plugins",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "tainted",
"Name" : "Linux kernel",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "Linux kernel lockdown",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"Created" : 1661703827,
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "UEFI secure boot",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot",
"Flags" : [
"runtime-issue",
"action-config-fw"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "locked",
"Name" : "CSME manufacturing mode",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode",
"Flags" : [
"success"
],
"kind" : "CSME"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "locked",
"Name" : "CSME override",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap",
"Flags" : [
"success"
],
"kind" : "CSME"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "CSME v0:15.0.41.2158",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"success"
],
"kind" : "CSME",
"version" : "0:15.0.41.2158"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"Name" : "Platform Debugging",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "locked",
"Name" : "SPI BIOS region",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "enabled",
"Name" : "SPI lock",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"Name" : "SPI write",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.EmptyPcr",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "TPM empty PCRs",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.EmptyPcr",
"Flags" : [
"success"
],
"Guid" : [
"ff71992e-52f7-5eea-94ef-883e56e034c6",
"34801700-3a50-5b05-820c-fe14580e4c2d",
"00d06c7f-2244-5a35-aa98-5d60704b3f5d",
"03f304f4-223e-54f4-b2c1-c3cf3b5817c6",
"9c3106c7-42ca-5099-9363-96ef5c22cbf7"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "found",
"Name" : "TPM v2.0",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20",
"Flags" : [
"success"
],
"Guid" : [
"ff71992e-52f7-5eea-94ef-883e56e034c6",
"34801700-3a50-5b05-820c-fe14580e4c2d",
"00d06c7f-2244-5a35-aa98-5d60704b3f5d",
"03f304f4-223e-54f4-b2c1-c3cf3b5817c6",
"9c3106c7-42ca-5099-9363-96ef5c22cbf7"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.Pk",
"Created" : 1661703827,
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "UEFI platform key",
"Plugin" : "uefi_pk",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.Pk",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "enabled",
"Name" : "IOMMU",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "enabled",
"Name" : "Intel BootGuard",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "valid",
"Name" : "Intel BootGuard verified boot",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "locked",
"Name" : "Platform Debugging",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.ReconstructionPcr0",
"Created" : 1661703827,
"HsiLevel" : 2,
"HsiResult" : "valid",
"Name" : "TPM PCR0 reconstruction",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.ReconstructionPcr0",
"Flags" : [
"success"
],
"Guid" : [
"ff71992e-52f7-5eea-94ef-883e56e034c6",
"34801700-3a50-5b05-820c-fe14580e4c2d",
"00d06c7f-2244-5a35-aa98-5d60704b3f5d",
"03f304f4-223e-54f4-b2c1-c3cf3b5817c6",
"9c3106c7-42ca-5099-9363-96ef5c22cbf7"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "valid",
"Name" : "Intel BootGuard error policy",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "enabled",
"Name" : "Pre-boot DMA protection",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "enabled",
"Name" : "Suspend-to-idle",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"Name" : "Suspend-to-ram",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"Created" : 1661703827,
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"Name" : "Intel CET Enabled",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"Created" : 1661703827,
"HsiLevel" : 4,
"HsiResult" : "enabled",
"Name" : "Intel SMAP",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"Created" : 1661703827,
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"Name" : "Encrypted RAM",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"a6bd4ca5-75a6-5796-b564-66b5cab1b11b",
"d9dd5e77-df17-5bab-b5ec-22827598bfed"
]
}
]
} |
|
From here processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 141
model name : 11th Gen Intel(R) Core(TM) i7-11800H @ 2.30GHz
stepping : 1
microcode : 0x40
cpu MHz : 2031.374
cache size : 24576 KB
physical id : 0
siblings : 16
core id : 0
cpu cores : 8
apicid : 0
initial apicid : 0
fpu : yes
fpu_exception : yes
cpuid level : 27
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l2 invpcid_single cdp_l2 ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdt_a avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb intel_pt avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves split_lock_detect dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq rdpid movdiri movdir64b fsrm avx512_vp2intersect md_clear ibt flush_l1d arch_capabilities
vmx flags : vnmi preemption_timer posted_intr invvpid ept_x_only ept_ad ept_1gb flexpriority apicv tsc_offset vtpr mtf vapic ept vpid unrestricted_guest vapic_reg vid ple pml ept_mode_based_exec tsc_scaling
bugs : spectre_v1 spectre_v2 spec_store_bypass swapgs eibrs_pbrsb
bogomips : 4608.00
clflush size : 64
cache_alignment : 64
address sizes : 39 bits physical, 48 bits virtual
power management:I don't know if the flags are getting directly from CPU or is being filtered by the kernel. |
|
I'm seeing the same on a CPU that's definitely Intel CET capable. I have not tested any actual ROP gadget to verify it's working but my userspace is built with -fcf-protection=full (unless the particular package has it filtered out at distro level). |
|
For the fwupd test to pass we need SHSTK and IBT; I don't see the former from your CPU output. For SHSTK we're checking CPUID 0x7 and then |
|
The return code is 1 which I guess in this context means a good result rather than error code 1? I also see that I now realized that the issue author also has ss reported as a CPU flag. Is this not the right flag? |
|
I thought CET was |
My googling efforts only found ss but, yeah, that flag has probably been around for far to long to be related to CET. |
|
|
fwupd doesn't read /proc/cpuinfo and just asks the CPU directly. I wonder if it's being turned off by the mainboard or even as an option in the system firmware settings? Maybe we need to ask Intel why shstk isn't being returned? |
|
I used the |
|
That is the feature enumeration. I don't know how to check this using cpuid in raw mode. Any tips? |
|
This is what we're doing: fwupd-detect-cet is written to actually crash -- it was originally written by an Intel engineer. :/ |
|
@hughsie Do you have any clue why |
|
No, but I'd certainly appreciate some debugging |
|
I just can't go further. I don't know about cpuid and C enough to troubleshoot this problem. Can we contact the original author or other Intel engineer? |
Does fwupd-detect-cet work correctly using gcc/clang -- i.e. the other one to what you're using now? |
|
Also, can you provide: |
|
Not sure why without digging into the build system but, when built with Clang 14.0.6, there is no /usr/libexec/fwupd/fwupd-detect-cet binary installed (and presumably neither built). |
|
I hope the raw output can be useful to find out if the CET feature is being detected correctly. |
I built using gcc, but just to get symbols to try to execute using gdb (that's not work well as I expected). I'm using Ubuntu Kinetic with fwupd installed using apt. |
|
@mhalano can you compile the wip/hughsie/cpuid-cet branch and then grab the output of |
|
plugin-cpu.txt |
hughsie
added a commit
that referenced
this issue
Aug 29, 2022
According to Intel, EDX[bit 20] corresponds to IBT feature, *not* ECX. Fixes half of #4960
|
Aha! We're checking ECX for the IBT check, and intel specified EDX. Can you try #4963 please? |
|
This is the result of command |
|
Did you |
|
I just did. I will reupload the log. My mistake. |
|
|
hughsie
added a commit
that referenced
this issue
Aug 29, 2022
According to Intel, EDX[bit 20] corresponds to IBT feature, *not* ECX. Fixes half of #4960
|
@hughsie I will wait the next release (that I think will include the fix) to close the ticket. That is ok for you? |
|
Lets close now; I'm tagging a new release tomorrow morning. |
|
Just one final question: do we have any tests about the execution in an older processor, where Intel CET is naturally unavailable? |
|
I used KVM to boot a Ubuntu 22.04.1 machine and configured to use an old processor (IvyBridge). I got what I was expecting. |
|
FWIW, the patch solved this for me, too. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
mhalano commentedAug 28, 2022
Describe the bug
Intel CET isn't implemented in Linux kernel yet, so even you have a compatible processor it will be marked as non-supported and you will never achieve level 3 of security.
Steps to Reproduce
Have a processor with Intel CET support (mine is Intel i7-11800H) and execute
fwupdmgr securitycommand.Expected behavior
A clear and concise description of what you expected to happen.
Not be considered since there is no kernel support yet.
fwupd version information
Please provide the version of the daemon and client.
Native installation on Ubuntu Kinetic Kudu
fwupd device information
Please provide the output of the fwupd devices recognized in your system.
Additional questions
The text was updated successfully, but these errors were encountered: