Messages in this thread | | | From | Matthew Garrett <> | Subject | [PATCH 00/15] Secure boot policy support | Date | Mon, 28 Jan 2013 11:42:24 -0500 |
| |
Secure boot makes it possible to ensure that the on-disk representation of the kernel hasn't been modified. This can be sidestepped if the in-memory representation can be trivially altered. We currently have a large number of interfaces that permit root to perform effectively arbitrary modifications to the kernel, so this patchset introduces a new capability ("CAP_COMPROMISE_KERNEL") that controls whether or not these features are available. The aim is for this to be useful in any other situations where kernel integrity can be assured by some other mechanism rather than special casing UEFI.
| |