lkml.org 
[lkml]   [2013]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 00/12] One more attempt at useful kernel lockdown
    On Mon, 9 Sep 2013, Matthew Garrett wrote:

    > On Mon, 2013-09-09 at 12:59 -0700, David Lang wrote:
    >
    >> At least you should be able to unify the implementation, even if you don't unify
    >> the user visible knob
    >
    > Well sure, I could take this integer and merge another integer into it,
    > but now you have the same value being modified by two different
    > user-visible interfaces which aren't guaranteed to have the same
    > semantics.

    It's not that you merge integers, it's that the knob that currently sets the
    signed module only loading but not anything else would have it's implementation
    changed so that instead of doing whatever it currently does, it would instead
    make an internal call to set the "require signed modules" bit, and that one
    place would implement the lockdown.

    David Lang


    \
     
     \ /
      Last update: 2013-09-09 22:41    [W:3.489 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site