lkml.org 
[lkml]   [2013]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 00/12] One more attempt at useful kernel lockdown
    On Mon, 9 Sep 2013, Valdis.Kletnieks@vt.edu wrote:

    > On Mon, 09 Sep 2013 11:49:34 -0400, Matthew Garrett said:
    >
    >> So, this is my final attempt at providing the functionality I'm interested
    >> in without inherently tying it to Secure Boot. There's strong parallels
    >> between the functionality that I'm interested in and the BSD securelevel
    >> interface, so here's a trivial implementation.
    >
    > Although all the individual patches look like sane and reasonable things
    > to do, I'm not at all convinced that sticking them all under control of one
    > flag is really the right way to do it. In particular, there probably needs
    > to be some re-thinking of the kexec, signed-module, and secure-boot stuff,
    > as it's still a moving target.

    Given that we know that people want signed binaries without blocking kexec, you
    should have '1' just enforce module signing and '2' (or higher) implement a full
    lockdown including kexec.

    Or, eliminate the -1 permanently insecure option and make this a bitmask, if
    someone wants to enable every possible lockdown, have them set it to "all 1's",
    define the bits only as you need them.

    right now
    1 lock down modules
    2 lock down kexec

    etc

    you may also want to have a 'disable module loading after this point' in the
    future.

    David Lang


    \
     
     \ /
      Last update: 2013-09-09 20:41    [W:4.258 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site