Messages in this thread | | | Subject | Re: [PATCH 00/15] Secure boot policy support | From | Yves-Alexis Perez <> | Date | Sun, 17 Feb 2013 20:19:35 +0100 |
| |
On lun., 2013-01-28 at 11:42 -0500, Matthew Garrett wrote: > Secure boot makes it possible to ensure that the on-disk representation of > the kernel hasn't been modified. This can be sidestepped if the in-memory > representation can be trivially altered. We currently have a large number > of interfaces that permit root to perform effectively arbitrary > modifications to the kernel, so this patchset introduces a new capability > ("CAP_COMPROMISE_KERNEL") that controls whether or not these features are > available. The aim is for this to be useful in any other situations where > kernel integrity can be assured by some other mechanism rather than special > casing UEFI. > Wouldn't it make sense to prevent writing to MSRs too? Something like c903f0456bc69176912dee6dd25c6a66ee1aed00 with CAP_COMPROMISE_KERNEL?
Regards, -- Yves-Alexis [unhandled content-type:application/pgp-signature] | |