lkml.org 
[lkml]   [2013]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH 00/12] One more attempt at useful kernel lockdown
    Date
    Some use cases require the ability to ensure that anything running in ring 0
    is trusted code. We have support for signing the kernel and kernel modules,
    but there's still a range of exported kernel interfaces that make it easy to
    modify the running kernel. Previous attempts to implement a generic interface
    to restrict this have included a new capability (breaks existing userspace)
    and tying it to a requirement for signed modules (breaks assumptions in
    certain situations where userspace is already running with restricted
    privileges).

    So, this is my final attempt at providing the functionality I'm interested
    in without inherently tying it to Secure Boot. There's strong parallels
    between the functionality that I'm interested in and the BSD securelevel
    interface, so here's a trivial implementation.



    \
     
     \ /
      Last update: 2013-09-10 01:21    [W:0.020 / U:1.220 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site