Messages in this thread | | | Date | Wed, 13 Feb 2013 10:44:31 -0800 | From | "H. Peter Anvin" <> | Subject | Re: [PATCH] x86: Lock down MSR writing in secure boot |
| |
On 02/13/2013 09:56 AM, Matthew Garrett wrote: > On Wed, 2013-02-13 at 09:51 -0800, Casey Schaufler wrote: >> On 2/13/2013 9:26 AM, Matthew Garrett wrote: >>> Admit that CAP_SYS_RAWIO is fucked up beyond rescue. Add a new >>> capability with well-defined semantics. >> >> You can't add a new capability where there is an existing capability >> that can be remotely argued to be appropriate. > > CAP_SYS_RAWIO can't be argued to be appropriate. It covers a range of > functionality that doesn't permit the running kernel to be modified and > which is required to provide a functional Linux system. Using it would > require redefining its existing usage, which would break existing > userspace. >
So people have piggybacked complete inappropriate junk onto CAP_SYS_RAWIO. Great. What the hell do we do now? We can't break apart CAP_SYS_RAWIO because we don't have hierarchical capabilities.
We thus have a bunch of unpalatable choices, **all of which are wrong**.
This, incidentally, is *exactly* the reason I object to CAP_COMPROMISE_KERNEL as well... it describes a usage model, not a resource.
-hpa
-- H. Peter Anvin, Intel Open Source Technology Center I work for Intel. I don't speak on their behalf.
| |