[lkml]   [2013]   [Feb]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 00/15] Secure boot policy support
On lun., 2013-01-28 at 11:42 -0500, Matthew Garrett wrote:
> Secure boot makes it possible to ensure that the on-disk representation of
> the kernel hasn't been modified. This can be sidestepped if the in-memory
> representation can be trivially altered. We currently have a large number
> of interfaces that permit root to perform effectively arbitrary
> modifications to the kernel, so this patchset introduces a new capability
> ("CAP_COMPROMISE_KERNEL") that controls whether or not these features are
> available. The aim is for this to be useful in any other situations where
> kernel integrity can be assured by some other mechanism rather than special
> casing UEFI.
Wouldn't it make sense to prevent writing to MSRs too? Something like
c903f0456bc69176912dee6dd25c6a66ee1aed00 with CAP_COMPROMISE_KERNEL?

[unhandled content-type:application/pgp-signature]
 \ /
  Last update: 2013-02-17 21:01    [W:0.078 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site