lkml.org 
[lkml]   [2018]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [GIT PULL] Kernel lockdown for secure boot
    On Tue, Apr 3, 2018 at 3:53 PM Andy Lutomirski <luto@kernel.org> wrote:
    > On Tue, Apr 3, 2018 at 3:51 PM, Matthew Garrett <mjg59@google.com> wrote:
    > > Lockdown is clearly useful without Secure Boot (and I intend to deploy
    it
    > > that way for various things), but I still don't understand why you feel
    > > that the common case of booting a kernel from a boot chain that's widely
    > > trusted derives no benefit from it being harder to subvert that kernel
    into
    > > subverting that boot chain. For cases where you're self-signing and feel
    > > happy about that, you just set CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT to n
    and
    > > everyone's happy?

    > I would like to see distros that want Secure Boot to annoy users by
    > enabling Lockdown be honest about the fact that it's an annoyance and
    > adds very little value by having to carry a patch that was rejected by
    > the upstream kernel.

    I disagree with the assertion that it adds very little value, but if you
    want to reject a technically useful patch for political reasons then I'm
    well beyond the point of caring.

    \
     
     \ /
      Last update: 2018-04-04 01:10    [W:6.571 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site