lkml.org 
[lkml]   [2018]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [GIT PULL] Kernel lockdown for secure boot
    On Tue, Apr 3, 2018 at 4:17 PM, Matthew Garrett <mjg59@google.com> wrote:
    >
    > 1) Secure Boot is intended to permit the construction of a boot chain that
    > only runs ring 0 code that the user considers trustworthy

    No.

    That may be *one* intention, for some people.

    It's not an a-priori one for the actual user.

    > 2) Allowing arbitrary user code to run in ring 0 without affirmative
    > consent on the part of the user is therefore incompatible with the goals of
    > Secure Boot

    Again, that has absolutely zero relevance.

    Those goals are not the *users* goals.

    Be honest now. It wasn't generally users who clamored for it.

    If the user actually wanted it, and is asking for it, he can enable
    it. Independently of secure boot, which the user generally has little
    control over.

    > 3) This patchset provides a mechanism to alter the behaviour of the kernel
    > such that it is significantly more difficult for arbitrary user code to run
    > in ring 0 without affirmative user consent

    That difficulty already exists, the new thing isn't somehow related to
    that at all.

    Look at our "uyou can only load modules if you're root" rules. Or the
    "you can only load modules if they are signed".

    See a pattern there? They don't magically enable themselves (or
    disable themselves) depending on whether you booted with secure boot
    or not.

    Yet they are a HELL OF A LOT MORE IMPORTANT than this new patch series.

    > 4) Providing a mechanism for automatically enabling this behaviour when
    > running in a context that is intended to restrict access to ring 0 is a
    > rational thing to do, because otherwise it is difficult to achieve the
    > objective in (1)

    No. See why it's *NOT* rational, as explained already several times.

    Magically changing kernel behavior depending on some subtle and often
    unintentional bootup behavior detail is completely idiotic.

    It would be idiotic if it was that "check kernel module signatures"
    check. This is no less idiotic.

    Seriously, listen to your own arguments. If they don't make sense for
    checking kernel module signatures, why the hell would they make sense
    for something like lockdown.

    THE TWO THINGS ARE ENTIRELY INDEPENDENT.

    I'm done with you. You're not listening, and you're repeating bogus
    arguments that make no sense.

    No way in hell will I merge anything like this.

    Linus

    \
     
     \ /
      Last update: 2018-04-04 01:27    [W:4.936 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site