From fab0eeb72bb5e1fdf3304cc6e01ebf5d7677c124 Mon Sep 17 00:00:00 2001 From: Emanuele Giuseppe Esposito Date: Thu, 10 Aug 2023 09:21:41 -0400 Subject: [PATCH] systemd-stub: ignore EFI shell unauthenticated kernel command line if we are in confidential vms --- src/boot/efi/stub.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/boot/efi/stub.c b/src/boot/efi/stub.c index 8fac41258e..183106b91f 100644 --- a/src/boot/efi/stub.c +++ b/src/boot/efi/stub.c @@ -147,8 +147,9 @@ static bool use_load_options( assert(ret); /* We only allow custom command lines if we aren't in secure boot or if no cmdline was baked into - * the stub image. */ - if (secure_boot_enabled() && have_cmdline) + * the stub image. + * We also don't allow it if we are in confidential vms and secureboot is on. */ + if (secure_boot_enabled() && (have_cmdline || is_confidential_vm())) return false; /* We also do a superficial check whether first character of passed command line