[lkml]   [2013]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject[PATCH 0/10] Add additional security checks when module loading is restricted
    We have two in-kernel mechanisms for restricting module loading - disabling
    it entirely, or limiting it to the loading of modules signed with a trusted
    key. These can both be configured in such a way that even root is unable to
    relax the restrictions.

    However, right now, there's several other straightforward ways for root to
    modify running kernel code. At the most basic level these allow root to
    reset the configuration such that modules can be loaded again, rendering
    the existing restrictions useless.

    This patchset adds additional restrictions to various kernel entry points
    that would otherwise make it straightforward for root to disable enforcement
    of module loading restrictions. It also provides a patch that allows the
    kernel to be configured such that module signing will be automatically
    enabled when the system is booting via UEFI Secure Boot, allowing a stronger
    guarantee of kernel integrity.

     \ /
      Last update: 2013-08-19 20:01    [W:0.028 / U:14.660 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site