| Server IP : 39.108.156.168 / Your IP : 216.73.216.104 Web Server : nginx/1.24.0 System : Linux e2.ksyuki.com 6.11.0-25-generic #25~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 17:20:50 UTC 2 x86_64 User : root ( 0) PHP Version : 8.3.6 Disable Function : NONE MySQL : OFF | cURL : OFF | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /var/lib/fwupd/ |
Upload File : |
SQLite format 3 @ = � = .v�
�
�
s
p,� �Q�ytablehistoryhistoryCREATE TABLE history (device_id TEXT,update_state INTEGER DEFAULT 0,update_error TEXT,filename TEXT,display_name TEXT,plugin TEXT,device_created INTEGER DEFAULT 0,device_modified INTEGER DEFAULT 0,checksum TEXT DEFAULT NULL,flags INTEGER DEFAULT 0,metadata TEXT DEFAULT NULL,guid_default TEXT DEFAULT NULL,version_old TEXT,version_new TEXT,checksum_device TEXT DEFAULT NULL,protocol TEXT DEFAULT NULL, release_id TEXT DEFAULT NULL, appstream_id TEXT DEFAULT NULL, version_format INTEGER DEFAULT 0, install_duration INTEGER DEFAULT 0, release_flags INTEGER DEFAULT 0)�%##�tablehsi_historyhsi_historyCREATE TABLE hsi_history (timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP,hsi_details TEXT DEFAULT NULL,hsi_score TEXT DEFAULT NULL)Y--gtableblocked_firmwareblocked_firmwareCREATE TABLE blocked_firmware (checksum TEXT)\//itableapproved_firmwareapproved_firmwareCREATE TABLE approved_firmware (checksum TEXT) � f''� indexidx_device_idemulation_tag �CREATE UNIQUE INDEX idx_device_id ON emulation_tag (device_id)R''ctableemulation_tagemulation_tag �CREATE TABLE emulation_tag (device_id TEXT)~�WtableschemaschemaCREATE TABLE schema (created timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP,version INTEGER DEFAULT 0)
� � 32023-11-01 11:54:31
� ���������������� �/ �* r" Q D @ < 8
4 0 ,
$
.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"Name" : "SPI write",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.Pk",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "UEFI platform key",
"Plugin" : "uefi_pk",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.Pk",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"Name" : "SPI BIOS region",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"Name" : "SPI lock",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"Name" : "TPM v2.0",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"Name" : "IOMMU",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"Name" : "Suspend-to-ram",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"Name" : "Intel CET Enabled",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.AcpiDmar",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"Name" : "Pre-boot DMA protection",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.AcpiDmar"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"Name" : "Suspend-to-idle",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"Name" : "Intel SMAP",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"Name" : "Encrypted RAM",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI-INVALID:chassis[0x01] .Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"Name" : "SPI write",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.Pk",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "UEFI platform key",
"Plugin" : "uefi_pk",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.Pk",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"Name" : "SPI BIOS region",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"Name" : "SPI lock",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"Name" : "TPM v2.0",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"Name" : "IOMMU",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"Name" : "Suspend-to-ram",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"Name" : "Intel CET Enabled",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.AcpiDmar",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"Name" : "Pre-boot DMA protection",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.AcpiDmar"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"Name" : "Suspend-to-idle",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"Name" : "Intel SMAP",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"Name" : "Encrypted RAM",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI-INVALID:chassis[0x01]
.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "en abled",
"Name" : "BIOS Firmware updates",
"Summary" : "BIOS Firmware updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its inf ormation accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Intel CET Enabled",
"Summary" : "Intel CET",
"Description" : "Intel Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Intel SMAP",
"Summary" : "Intel SMAP",
"Description" : "Intel Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.6)
� \� �3�/?2023-11-04 05:37:11{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "Linux swap",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"Name" : "fwupd plugins",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "tainted",
"Name" : "Linux kernel",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "Linux kernel lockdown",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 0,
"HsiResult" : "not-found",
"Name" : "UEFI secure boot",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi �3�]?2023-11-01 11:54:31{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"Name" : "Linux kernel",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "Linux swap",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"Name" : "fwupd plugins",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"Name" : "Linux kernel lockdown",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 0,
"HsiResult" : "not-found",
"Name" : "UEFI secure boot",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi
H ��H ��%3��aQ2023-11-06 10:59:03{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, ��*3��kQ2023-11-06 09:03:04{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent th ��!3��YQ2023-11-06 08:26:36{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd is security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "en abled",
"Name" : "BIOS Firmware updates",
"Summary" : "BIOS Firmware updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its inf ormation accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Intel CET Enabled",
"Summary" : "Intel CET",
"Description" : "Intel Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Intel SMAP",
"Summary" : "Intel SMAP",
"Description" : "Intel Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.6) it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "en abled",
"Name" : "BIOS Firmware updates",
"Summary" : "BIOS Firmware updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its inf ormation accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Intel CET Enabled",
"Summary" : "Intel CET",
"Description" : "Intel Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Intel SMAP",
"Summary" : "Intel SMAP",
"Description" : "Intel Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.6) tical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"Appstre amId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"obsoleted",
"missing-data",
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html #org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Intel CET Enabled",
"Summary" : "Intel CET",
"Description" : "Intel Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Flags" : [
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Intel SMAP",
"Summary" : "Intel SMAP",
"Description" : "Intel Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success",
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Flags" : [
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.7)
� Y� ��3��5Q2023-11-15 03:51:01{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing cri ��3��5Q2023-11-15 03:50:58{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing cri tical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"Appstre amId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"obsoleted",
"missing-data",
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html #org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Intel CET Enabled",
"Summary" : "Intel CET",
"Description" : "Intel Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Flags" : [
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Intel SMAP",
"Summary" : "Intel SMAP",
"Description" : "Intel Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success",
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Flags" : [
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.7) !tical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"Appstre "amId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"obsoleted",
"missing-data",
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : # [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html #org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Intel CET Enabled",
"Summary" : "Intel CET",
"Description" : "Intel Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Flags" : [
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Intel SMAP",
"Summary" : "Intel SMAP",
"Description" : "Intel Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success",
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Flags" : [
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.7)
� Y� �� 3��5Q2023-11-16 05:28:58{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing cri %��3��5Q2023-11-15 04:36:47{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing cri &tical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"Appstre 'amId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"obsoleted",
"missing-data",
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : ( [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html #org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Intel CET Enabled",
"Summary" : "Intel CET",
"Description" : "Intel Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Flags" : [
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Intel SMAP",
"Summary" : "Intel SMAP",
"Description" : "Intel Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success",
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Flags" : [
"obsoleted"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.7) *ebugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
+ "HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.8)
B B �+
3��mQ2023-11-16 16:50:04{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform D ) .ebugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
/ "HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.8)
B B �+ 3��mQ2023-11-17 05:37:25{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform D - 2ebugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
3 "HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.8)
B B �+ 3��mQ2023-11-18 06:20:42{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform D 1 6ebugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
7 "HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.8)
B B �+
3��mQ2023-11-20 05:08:56{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform D 5 :ebugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
; "HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.8)
B B �+3��mQ2023-11-21 06:50:48{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform D 9 >ebugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
? "HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.8)
B B �+3��mQ2023-11-22 06:46:47{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform D = Bebugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
C "HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"b9a2dd81-159e-5537-a7db-e7101d164d3f",
"30249f37-d140-5d3e-9319-186b1bd5cac3",
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.8)
` BQ` ��W3��CS2024-01-05 16:05:23{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", I��H3��%S2023-12-08 16:16:43{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", E�+3��mQ2023-11-23 07:09:17{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform D A F
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
G "Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
H"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Intel CET Enabled",
"Summary" : "Intel CET",
"Description" : "Intel Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Intel SMAP",
"Summary" : "Intel SMAP",
"Description" : "Intel Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.10) J
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P Klugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe Lvel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) N
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P Olugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe Pvel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11)
x
-<KZi x ��W3��CS2024-01-12 13:51:07{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", j��W3��CS2024-01-11 13:17:17{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", f��W3��CS2024-01-10 12:23:17{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", b��W3��CS2024-01-09 12:10:09{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ^��W3��CS2024-01-08 11:49:17{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", Z��W3��CS2024-01-07 13:25:12{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", V��W3��CS2024-01-07 10:12:42{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", R��W3��CS2024-01-06 09:04:22{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", M S
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P Tlugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe Uvel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) W
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P Xlugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe Yvel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) [
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P \lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe ]vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) _
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P `lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe avel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) c
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P dlugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe evel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) g
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P hlugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe ivel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) k
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P llugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe mvel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) o
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe qvel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11)
x
-<KZi x ��W"3��CS2024-01-19 10:20:55{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W!3��CS2024-01-19 08:11:21{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W 3��CS2024-01-18 07:39:01{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W 3��CS2024-01-17 06:10:57{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ��W 3��CS2024-01-16 06:43:17{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", {��W 3��CS2024-01-15 09:42:17{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", w��W 3��CS2024-01-15 05:57:07{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", s��W3��CS2024-01-13 14:22:39{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", n t
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P ulugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe vvel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) x
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P ylugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe zvel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) |
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P }lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe ~vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11)
x
-<KZi x ��W*3��CS2024-01-25 20:41:54{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W)3��CS2024-01-24 19:22:04{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W(3��CS2024-01-24 07:02:54{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W'3��CS2024-01-23 18:59:54{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W&3��CS2024-01-23 13:31:04{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W%3��CS2024-01-22 18:49:25{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W$3��CS2024-01-21 17:17:54{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W#3��CS2024-01-20 09:13:04{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", � �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"missing-data",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"P �lugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLe �vel" : 2,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to qu ickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.11)
�
-<� �1/3��wS2024-12-18 08:45:48{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" ���H.3��%S2024-11-01 16:54:35{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���M-3��/S2024-10-31 05:58:13{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���H,3��%S2024-02-24 16:06:06{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", ���W+3��CS2024-01-26 21:39:25{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap", � �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule �",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiRe �sult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sle ep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.13) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_ca �psule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
" �HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go t o sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.24) �
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiLevel" : 0,
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule �",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.ManufacturingMode",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI manufacturing mode",
"Summary" : "Intel Management Engine Manufacturing Mode",
"Description" : "Manufacturing Mode is used when the device is manufactured and security features are not yet enabled.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.ManufacturingMode"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.OverrideStrap",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "locked",
"Name" : "MEI override",
"Summary" : "Intel Management Engine Override",
"Description" : "Intel Management Engine Override disables checks for device software tampering.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.OverrideStrap"
},
{
"AppstreamId" : "org.fwupd.hsi.Mei.Version",
"HsiLevel" : 1,
"HsiResultSuccess" : "valid",
"Name" : "MEI version",
"Summary" : "Intel Management Engine Version",
"Description" : "The Intel Management Engine controls device components and needs to have a recent version to avoid security issues.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Mei.Version",
"Flags" : [
"missing-data"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiRe �sult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Acm",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard ACM protected",
"Summary" : "Intel BootGuard ACM Protected",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Acm"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Otp",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard OTP fuse",
"Summary" : "Intel BootGuard Fuse",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Otp"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Verified",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard verified boot",
"Summary" : "Intel BootGuard Verified Boot",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Verified"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sle ep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Policy",
"HsiLevel" : 3,
"HsiResult" : "not-found",
"HsiResultSuccess" : "valid",
"Name" : "Intel BootGuard error policy",
"Summary" : "Intel BootGuard Error Policy",
"Description" : "Intel BootGuard Error Policy ensures the device does not continue to start if its device software has been tampered with.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Policy"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.24) �: "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiLevel" : 0,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmw �are updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"S ummary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "iommu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelCet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelCet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelSmap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelSmap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[0x01] (v1.9.27)
� },
{
"AppstreamId" : "org.fwupd.hsi.Fwupd.Plugins",
"HsiResult" : "tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "fwupd plugins",
"Summary" : "Firmware Updater Verification",
"Description" : "Firmware Updater Verification checks that software used for updating has not been tampered with.",
"Plugin" : "core",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Fwupd.Plugins",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Lockdown",
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Linux kernel lockdown",
"Summary" : "Linux Kernel Lockdown",
"Description" : "Linux Kernel Lockdown mode prevents administrator (root) accounts from accessing and changing critical parts of system software.",
"Plugin" : "linux_lockdown",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Lockdown",
"Flags" : [
"runtime-issue",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.SecureBoot",
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "UEFI secure boot",
"Summary" : "UEFI Secure Boot",
"Description" : "UEFI Secure Boot prevents malicious software from being loaded when the device starts.",
"Plugin" : "uefi_capsule",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.SecureBoot",
"Flags" : [
"missing-data",
"runtime-issue",
"action-config-fw"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugEnabled",
"HsiLevel" : 1,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "not-enabled",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugEnabled",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Bioswe",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "SPI write",
"Summary" : "Firmware Write Protection",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Bioswe",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SupportedCpu",
"HsiLevel" : 1,
"HsiResult" : "valid",
"HsiResultSuccess" : "valid",
"Name" : "Supported CPU",
"Summary" : "Processor Security Checks",
"Description" : "Each system should have tests to ensure firmware security.",
"Plugin" : "core",
"Version" : "1.8.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SupportedCpu",
"Flags" : [
"success",
"action-contact-oem"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Uefi.BootserviceVars",
"HsiLevel" : 1,
"HsiResult" : "locked",
"HsiResultSuccess" : "locked",
"Name" : "UEFI bootservice variables",
"Summary" : "UEFI Bootservice Variables",
"Description" : "UEFI boot service variables should not be readable from runtime mode.",
"Plugin" : "uefi_capsule",
"Version" : "1.9.3",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Uefi.BootserviceVars",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Bios.CapsuleUpdates",
" �HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "BIOS firmware updates",
"Summary" : "BIOS Firmware Updates",
"Description" : "Enabling firmware updates for the BIOS allows fixing security issues.",
"Plugin" : "uefi_esrt",
"Version" : "1.9.6",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Bios.CapsuleUpdates"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.Ble",
"HsiLevel" : 1,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SPI lock",
"Summary" : "Firmware Write Protection Lock",
"Description" : "Firmware Write Protection protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.Ble"
},
{
"AppstreamId" : "org.fwupd.hsi.Spi.SmmBwp",
"HsiLevel" : 1,
"HsiResult" : "not-locked",
"HsiResultSuccess" : "locked",
"Name" : "SPI BIOS region",
"Summary" : "Firmware BIOS Region",
"Description" : "Firmware BIOS Region protects device firmware memory from being tampered with.",
"Plugin" : "pci_bcr",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Spi.SmmBwp"
},
{
"AppstreamId" : "org.fwupd.hsi.Tpm.Version20",
"HsiLevel" : 1,
"HsiResult" : "not-found",
"HsiResultSuccess" : "found",
"Name" : "TPM v2.0",
"Summary" : "TPM v2.0",
"Description" : "TPM (Trusted Platform Module) is a computer chip that detects when hardware components have been tampered with.",
"Plugin" : "tpm",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Tpm.Version20"
},
{
"AppstreamId" : "org.fwupd.hsi.PlatformDebugLocked",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "locked",
"Name" : "Platform debugging",
"Summary" : "Platform Debugging",
"Description" : "Platform Debugging allows device security features to be disabled. This should only be used by hardware manufacturers.",
"Plugin" : "msr",
"Version" : "1.8.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PlatformDebugLocked",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.IntelBootguard.Enabled",
"HsiLevel" : 2,
"HsiResult" : "not-supported",
"Name" : "Intel BootGuard",
"Summary" : "Intel BootGuard",
"Description" : "Intel BootGuard prevents unauthorized device software from operating when the device is started.",
"Plugin" : "pci_mei",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelBootguard.Enabled"
},
{
"AppstreamId" : "org.fwupd.hsi.IntelGds",
"HsiLevel" : 2,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Intel GDS mitigation",
"Summary" : "Intel GDS Mitigation",
"Description" : "CPU Microcode must be updated to mitigate against various information-disclosure security issues.",
"Plugin" : "msr",
"Version" : "1.9.4",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.IntelGds",
"Flags" : [
"action-contact-oem"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Iommu",
"HsiLevel" : 2,
"HsiResult" : "not-found",
"HsiResultSuccess" : "enabled",
"Name" : "IOMMU",
"Summary" : "IOMMU Protection",
"Description" : "IOMMU Protection prevents connected devices from accessing unauthorized parts of system memory.",
"Plugin" : "i ommu",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Iommu",
"Flags" : [
"action-contact-oem",
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToRam",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "not-enabled",
"Name" : "Suspend-to-ram",
"Summary" : "Suspend To RAM",
"Description" : "Suspend to RAM allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "linux_sleep",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToRam",
"Flags" : [
"success"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Cet.Enabled",
"HsiLevel" : 3,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "supported",
"Name" : "CET Platform",
"Summary" : "Control-flow Enforcement Technology",
"Description" : "Control-Flow Enforcement Technology detects and prevents certain methods for running malicious software on the device.",
"Plugin" : "cpu",
"Version" : "2.0.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Cet.Enabled",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.PrebootDma",
"HsiLevel" : 3,
"HsiResult" : "not-valid",
"HsiResultSuccess" : "enabled",
"Name" : "Pre-boot DMA protection",
"Summary" : "Pre-boot DMA Protection",
"Description" : "Pre-boot DMA protection prevents devices from accessing system memory after being connected to the computer.",
"Plugin" : "acpi_dmar",
"Version" : "1.8.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.PrebootDma"
},
{
"AppstreamId" : "org.fwupd.hsi.SuspendToIdle",
"HsiLevel" : 3,
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "enabled",
"Name" : "Suspend-to-idle",
"Summary" : "Suspend To Idle",
"Description" : "Suspend to Idle allows the device to quickly go to sleep in order to save power. While the device has been suspended, its memory could be physically removed and its information accessed.",
"Plugin" : "acpi_facp",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.SuspendToIdle",
"Flags" : [
"action-config-fw",
"action-config-os"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Smap",
"HsiLevel" : 4,
"HsiResult" : "enabled",
"HsiResultSuccess" : "enabled",
"Name" : "SMAP",
"Summary" : "Supervisor Mode Access Prevention",
"Description" : "Supervisor Mode Access Prevention ensures critical parts of device memory are not accessed by less secure programs.",
"Plugin" : "cpu",
"Version" : "2.0.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Smap",
"Flags" : [
"success"
],
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
},
{
"AppstreamId" : "org.fwupd.hsi.EncryptedRam",
"HsiLevel" : 4,
"HsiResult" : "not-supported",
"HsiResultSuccess" : "enabled",
"Name" : "Encrypted RAM",
"Summary" : "Encrypted RAM",
"Description" : "Encrypted RAM makes it impossible for information that is stored in device memory to be read if the memory chip is removed and accessed.",
"Plugin" : "cpu",
"Version" : "1.5.0",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.EncryptedRam",
"Guid" : [
"aeac0d3d-a127-52d8-9745-891104b2ec28",
"1c7713d4-3bd2-5032-b9cc-291671aba257"
]
}
]
}HSI:INVALID:chassis[other] (v2.0.20)
�
� �{03�� U2026-06-10 16:03:05{
"SecurityAttributes" : [
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Swap",
"HsiResult" : "not-enabled",
"HsiResultSuccess" : "encrypted",
"Name" : "Linux swap",
"Summary" : "Linux Swap",
"Description" : "Linux Kernel Swap temporarily saves information to disk as you work. If the information is not protected, it could be accessed by someone if they obtained the disk.",
"Plugin" : "linux_swap",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Swap",
"Flags" : [
"success",
"runtime-issue"
]
},
{
"AppstreamId" : "org.fwupd.hsi.Kernel.Tainted",
"HsiResult" : "not-tainted",
"HsiResultSuccess" : "not-tainted",
"Name" : "Linux kernel",
"Summary" : "Linux Kernel Verification",
"Description" : "Linux Kernel Verification makes sure that critical system software has not been tampered with. Using device drivers which are not provided with the system can prevent this security feature from working correctly.",
"Plugin" : "linux_tainted",
"Uri" : "https://fwupd.github.io/libfwupdplugin/hsi.html#org.fwupd.hsi.Kernel.Tainted",
"Flags" : [
"success",
"runtime-issue"
]
�