Messages in this thread | | | Date | Wed, 18 Mar 2015 11:34:29 +0000 | From | Simon McVittie <> | Subject | Re: Trusted kernel patchset |
| |
On 17/03/15 20:42, Matthew Garrett wrote: > On Tue, 2015-03-17 at 20:22 +0000, Simon McVittie wrote: >> Is the intention instead that it will make privileged bits of userland >> more careful to avoid breaking the trust chain in ways that would "fail >> safe" by refusing to boot? > > Not really. It's intended to avoid the situation where privileged > userspace is able to modify the running kernel to an extent that's > broadly equivalent to booting an arbitrary kernel.
Sorry, I was imprecise about what I meant by "it". I understand that the intention of the patchset as a whole is to prevent privileged userspace from subverting the kernel; I was asking about the intention of the ability to read from /sys/kernel/security/trusted_kernel.
-- Simon McVittie Collabora Ltd. <http://www.collabora.com/>
| |