Messages in this thread |  | | From | Linus Torvalds <> | Date | Tue, 3 Apr 2018 17:08:30 -0700 | Subject | Re: [GIT PULL] Kernel lockdown for secure boot |
| |
On Tue, Apr 3, 2018 at 5:04 PM, Matthew Garrett <mjg59@google.com> wrote: > > How? When there are random DMA-capable PCI devices that are driven by > userland tools that are mmap()ing the BARs out of sysfs, how do we > simultaneously avoid breaking those devices while also preventing the > majority of users from being vulnerable to an attacker just DMAing over the > kernel?
.. if that ends up being a real problem, then you print a warning and tell people to use the kernel command line to disable things.
And if it's a big and common problem, then the answer may be that lockdown has to be entirely OFF by default, and you instead just tell people to enable it manually with a kernel command line option.
Still better than telling them to disable/enable secure boot, which they may or may not even be able to to.
Linus
|  |