[GIT PULL] Kernel lockdown for secure boot
torvalds at linux-foundation.org
Wed Apr 4 00:08:30 UTC 2018
On Tue, Apr 3, 2018 at 5:04 PM, Matthew Garrett <mjg59 at google.com> wrote:
> How? When there are random DMA-capable PCI devices that are driven by
> userland tools that are mmap()ing the BARs out of sysfs, how do we
> simultaneously avoid breaking those devices while also preventing the
> majority of users from being vulnerable to an attacker just DMAing over the
.. if that ends up being a real problem, then you print a warning and
tell people to use the kernel command line to disable things.
And if it's a big and common problem, then the answer may be that
lockdown has to be entirely OFF by default, and you instead just tell
people to enable it manually with a kernel command line option.
Still better than telling them to disable/enable secure boot, which
they may or may not even be able to to.
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
More information about the Linux-security-module-archive