lkml.org 
[lkml]   [2019]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH V33 01/30] security: Support early LSMs
    On Thu, Jun 20, 2019 at 6:22 PM Matthew Garrett
    <matthewgarrett@google.com> wrote:
    >
    > The lockdown module is intended to allow for kernels to be locked down
    > early in boot - sufficiently early that we don't have the ability to
    > kmalloc() yet. Add support for early initialisation of some LSMs, and
    > then add them to the list of names when we do full initialisation later.

    I'm confused. What does it even mean to lock down the kernel before
    we're ready to run userspace code? We can't possibly be attacked by
    user code before there is any to attack us.

    Am I missing something here?

    --Andy

    \
     
     \ /
      Last update: 2019-06-21 07:25    [W:4.365 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site