lkml.org 
[lkml]   [2013]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH] x86: Lock down MSR writing in secure boot
    Date
    On Sat, 2013-02-09 at 00:06 +0100, Borislav Petkov wrote:
    > On Fri, Feb 08, 2013 at 02:30:52PM -0800, H. Peter Anvin wrote:
    > > Also, keep in mind that there is a very simple way to deny MSR access
    > > completely, which is to not include the driver in your kernel (and not
    > > allow module loading, but if you can load modules you can just load a
    > > module to muck with whatever MSR you want.)
    >
    > I was contemplating that too. What is the use case of having
    > msr.ko in a secure boot environment? Isn't that an all-no-tools,
    > you-can't-do-sh*t-except-what-you're-explicitly-allowed-to environment which
    > simply doesn't need to write MSRs in the first place?

    Well, sure, distributions could build every kernel twice. That seems a
    little excessive, though.
    \
     
     \ /
      Last update: 2013-02-09 01:02    [W:4.293 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site