lkml.org 
[lkml]   [2018]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [GIT PULL] Kernel lockdown for secure boot
    On Tue, Apr 3, 2018 at 5:04 PM, Matthew Garrett <mjg59@google.com> wrote:
    >
    > How? When there are random DMA-capable PCI devices that are driven by
    > userland tools that are mmap()ing the BARs out of sysfs, how do we
    > simultaneously avoid breaking those devices while also preventing the
    > majority of users from being vulnerable to an attacker just DMAing over the
    > kernel?

    .. if that ends up being a real problem, then you print a warning and
    tell people to use the kernel command line to disable things.

    And if it's a big and common problem, then the answer may be that
    lockdown has to be entirely OFF by default, and you instead just tell
    people to enable it manually with a kernel command line option.

    Still better than telling them to disable/enable secure boot, which
    they may or may not even be able to to.

    Linus

    \
     
     \ /
      Last update: 2018-04-04 02:08    [W:4.324 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site