Messages in this thread | | | From | Linus Torvalds <> | Date | Tue, 3 Apr 2018 17:02:46 -0700 | Subject | Re: [GIT PULL] Kernel lockdown for secure boot |
| |
On Tue, Apr 3, 2018 at 4:47 PM, Matthew Garrett <mjg59@google.com> wrote: >> Another way of looking at this: if lockdown is a good idea to enable >> when you booted using secure boot, then why isn't it a good idea when >> you *didn't* boot using secure boot? > > Because it's then trivial to circumvent and the restrictions aren't worth > the benefit.
Bullshit.
If there those restrictions cause problems, they need to be fixed regardless.
In fact, from a debuggability standpoint, you want to find the problems early, on those kernel development machines that had secure boot explicitly turned off because it's such a pain.
And if they can't be fixed, then the user is going to disable lockdown regardless of how he booted the machine.
In no situation is "depending on how you booted" a good choice.
Either you can enable it or you can't. If you can, good. And if you can't, it has nothing to do with secure boot.
Linus
| |