Messages in this thread | | | From | Matthew Garrett <> | Subject | Re: Trusted kernel patchset for Secure Boot lockdown | Date | Thu, 13 Mar 2014 21:31:55 +0000 |
| |
On Thu, 2014-03-13 at 21:26 +0000, One Thousand Gnomes wrote: > > On the other hand, disabling CAP_SYS_RAWIO *definitely* breaks expected > > functionality - firmware loading and the fibmap ioctl are probably the > > most obvious. And changing the use of CAP_SYS_RAWIO potentially breaks > > userspace expectations, so we're kind of stuck there. > > Actually I know how to describe the problem better. > > Whitelist v Blacklist. > > Going around adding extra cases for CAP_SYS_RAWIO is a fails insecure > model. Going around adding CAP_SYS_RAWIO || CAP_SYS_RAWIO_SEC is a 'fails > secure' case.
We've already been through this. We can't add new capabilities. It breaks existing userspace.
-- Matthew Garrett <matthew.garrett@nebula.com>
| |