lkml.org 
[lkml]   [2017]   [Apr]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 20/24] bpf: Restrict kernel image access functions when the kernel is locked down
    Date
    Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:

    > this will obviously break the program.

    Yeah. But if it allows one to twiddle the kernel image or gain access to
    crypto material...

    > How about disabling loading tracing programs during the lockdown completely?

    Interesting thought. I'm not sure how much would actually need locking down
    here. Turning on tracepoints in the kernel and reading out of the trace
    buffer, for example, ought to be okay, though if there are any tracepoints
    that leak crypto information, they may need locking down also.

    Basically, I think it boils down to: if it can be used to modify the kernel
    image or read arbitrary data from the kernel image then should probably be
    forbidden. There have to be exceptions, though, such as loading authenticated
    kernel modules.

    David

    \
     
     \ /
      Last update: 2017-04-13 10:46    [W:4.547 / U:0.508 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site