lkml.org 
[lkml]   [2011]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v5 00/21] EVM
    On Thu 2011-05-26 14:11:54, David Safford wrote:
    > On Thu, 2011-05-26 at 09:34 -0700, Casey Schaufler wrote:
    > > On 5/25/2011 11:08 PM, Pavel Machek wrote:
    > > > ...
    > > > Fourthly, is it likely to find its way to the next cellphone I buy,
    > > > and will it prevent me from rooting it?
    > >
    > > That will of course depend on the phone vendor. You are certainly
    > > going to be able to vote with your checkbook (digital wallet?) but
    > > odds are pretty good that should EVM prove effective it will be
    > > ubiquitous within the next five years on embedded devices.

    Hmm. But maybe it is more effective to vote with NAKs, now? It does
    not seem to have any non-evil uses.

    Phone vendors will play nasty tricks on us, but... why make it easy
    for them?

    > um, not quite the right threat model...
    >
    > Rooting is normally done through an exploit of the loader
    > or the kernel, neither of which EVM can prevent. The phones

    Androids are often rooted by exploiting kernel or userspace
    security holes. G1 was rooted by shell that was left running on
    console...

    > Whether or not the phone is rooted, IMA-Appraisal, EVM, and
    > the Digital Signature Extensions help protect against remote
    > software attacks, and offline hardware attacks on individual
    > files, but not against rooting itself.

    As far as I can tell, file signatures only prevent "offline hardware
    attacks"; that is user trying to "attack" (== root) his own computer.

    Pavel

    --
    (english) http://www.livejournal.com/~pavelmachek
    (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


    \
     
     \ /
      Last update: 2011-05-26 20:41    [W:4.920 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site