Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode | Date | Tue, 06 Jun 2017 10:34:51 +0100 |
| |
Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:
> and print a subsequent line for every lockdown feature that is enabled, e.g., > > lockdown: disabling MSRs > lockdown: disabling hibernate support
There's another problem with this idea: the lockdown facility is passive - it doesn't go looking for things to lock down; rather, things that can be locked down inquire as to whether lockdown is in effect at the point someone tries to use them.
Now, I could reserve a variable for each thing we lock down to make sure that we don't emit the message more than once, but I'm loathe to waste memory this way.
I can't so easily switch the facility to being active either, since a lot of the lockdownables are in modules.
David
| |