Messages in this thread |  | | Date | Fri, 8 Feb 2013 22:45:35 -0800 | Subject | Re: [PATCH] x86: Lock down MSR writing in secure boot | From | Kees Cook <> |
| |
On Fri, Feb 8, 2013 at 5:29 PM, Matthew Garrett <matthew.garrett@nebula.com> wrote: > On Fri, 2013-02-08 at 17:22 -0800, H. Peter Anvin wrote: > >> You don't have to build the kernel twice to exclude a loadable module. > > I guess you could just strip the signatures off any modules you don't > want to support under Secure Boot, but that breaks some other use cases.
Also, _reading_ MSRs from userspace arguably has utility that doesn't compromise ring-0. So excluding the driver entirely seems like overkill.
-Kees
-- Kees Cook Chrome OS Security
|  |