| Date | Fri, 20 Oct 2017 19:09:39 +0100 | From | Alan Cox <> | Subject | Re: [PATCH 12/27] x86/msr: Restrict MSR access when the kernel is locked down |
| |
On Thu, 19 Oct 2017 15:52:04 +0100 David Howells <dhowells@redhat.com> wrote:
> From: Matthew Garrett <matthew.garrett@nebula.com> > > Writing to MSRs should not be allowed if the kernel is locked down, since > it could lead to execution of arbitrary code in kernel mode. Based on a > patch by Kees Cook.
There are a load of standard tools that use this so I think you are going to need a whitelist. Can you at least log *which* MSR in the failing case so a whitelist can be built over time ?
Alan
|