lkml.org 
[lkml]   [2012]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 0/7] KDB: Kiosk (reduced capabilities) mode
From
On Fri, Jul 27, 2012 at 6:26 PM, Anton Vorontsov <cbouatmailru@gmail.com> wrote:
<snip long rant>

> But if you say that it wasn't the case, and no one thought about the
> reducing the debugger in the "evil" way, so be it, I trust you. But I
> still don't trust the phone vendors. They showed their bad attitude
> in many ways towards hackers, so I think we both have quite legitimate
> reasons to be a little bit paranoid. :-)

I've never seen a non-Nexus phone that used the FIQ debugger, and I
believe every Nexus device has supported rooting. We leave the FIQ
debugger enabled on the devices we personally carry because it allows
easy debugging without compromising our data, and we leave it enabled
on production devices (and leave the serial console muxed out the
headphone jack) because it's more useful to end users than a blank
serial console.

>> An alternate option would be to allow userspace to write a password
>> hash to a sysfs file, and require the password to be entered over the
>> serial console to unlock KGDB or enable unsafe KGDB commands.
>
> Yup, that's a very nice idea. This can be implemented by introducing
> "unlock" KDB command. Although, that also requires tight integration
> w/ user-space, i.e. on boot userland would need to supply hashing
> method, salt and root's password hash. The same has to be done on every
> password change. It is surely doable, but not sure if it is worth the
> efforts. Maybe, some day.
>
> Thanks,
>
> --
> Anton Vorontsov
> Email: cbouatmailru@gmail.com


\
 
 \ /
  Last update: 2012-07-28 04:41    [W:0.885 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site