lkml.org 
[lkml]   [2018]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [GIT PULL] Kernel lockdown for secure boot
    On Tue, Apr 3, 2018 at 4:47 PM, Matthew Garrett <mjg59@google.com> wrote:
    >> Another way of looking at this: if lockdown is a good idea to enable
    >> when you booted using secure boot, then why isn't it a good idea when
    >> you *didn't* boot using secure boot?
    >
    > Because it's then trivial to circumvent and the restrictions aren't worth
    > the benefit.

    Bullshit.

    If there those restrictions cause problems, they need to be fixed regardless.

    In fact, from a debuggability standpoint, you want to find the
    problems early, on those kernel development machines that had secure
    boot explicitly turned off because it's such a pain.

    And if they can't be fixed, then the user is going to disable lockdown
    regardless of how he booted the machine.

    In no situation is "depending on how you booted" a good choice.

    Either you can enable it or you can't. If you can, good. And if you
    can't, it has nothing to do with secure boot.

    Linus

    \
     
     \ /
      Last update: 2018-04-04 02:03    [W:4.176 / U:0.764 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site