Messages in this thread | | | Subject | Re: LockDown that allows read of /dev/mem ? | From | "Enrico Weigelt, metux IT consult" <> | Date | Mon, 21 Jun 2021 12:27:41 +0200 |
| |
On 20.06.21 01:55, David F. wrote:
> I'm finding that LockDown Integrity prevents blocks things like mdadm, > Xvesa, and a couple of my specialized tools. There should be an > option to allow /dev/mem read access. Is there? There are no secrets > to the boot disk booted environment it's all root.
Looks like conflict of goals. lockdown is used in scenarios where one really doesn't take any chance that code running w/ root privileges can do such things (there's a lot of security critical information one can learn from reading the raw memory).
I wonder what your actual use case is.
* why are you using lockdown and also running everything as root ? * why are you still using the old Xvesa instead of using KMS or framebuffer device ? * why does mdadm want to access /dev/mem ?
--mtx
-- --- Hinweis: unverschlüsselte E-Mails können leicht abgehört und manipuliert werden ! Für eine vertrauliche Kommunikation senden Sie bitte ihren GPG/PGP-Schlüssel zu. --- Enrico Weigelt, metux IT consult Free software and Linux embedded engineering info@metux.net -- +49-151-27565287
| |