Re: [PATCH 00/16] Kernel lockdown

From	One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
Newsgroups	linux.kernel
Subject	Re: [PATCH 00/16] Kernel lockdown
Date	2016-11-16 23:30 +0100
Message-ID	<sEgSm-rg-45@gated-at.bofh.it> (permalink)
References	<sEgfD-8mi-3@gated-at.bofh.it>
Organization	Intel Corporation

Show all headers | View raw

Whether it's a good idea aside

You need to filter or lock down kernel module options because a lot of
modules let you set the I/O port or similar (eg mmio) which means you can
hack the entire machine with say the 8250 driver just by using it with an
mmio of the right location to patch the secure state to zero just by
getting the ability to write to the modules conf file.

Without that at least fixed I don't see the point in merging this. Either
we don't do it (which given the level of security the current Linux
kernel provides, and also all the golden key messups from elsewhere might
be the honest approach), or at least try and do the job right.

Less security is better than fake security. If you've got less security
your take appropriate precautions. If you rely on fake security you don't.

The two other nasty cases you miss should be fine for x86 secure boot -
but maybe not for secure boot in general. That is firmware loading and
initial firewire state. Both should be fine on any 'secure' boot PC.


Alan

Thread

[PATCH 00/16] Kernel lockdown David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
  [PATCH 15/16] acpi: Ignore acpi_rsdp kernel param when the kernel  has been locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
  [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
    Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-17 23:00 +0100
      Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Josh Boyer <jwboyer@fedoraproject.org> - 2016-11-18 13:00 +0100
        Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-18 13:20 +0100
      Re: [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells <dhowells@redhat.com> - 2016-11-18 18:30 +0100
  [PATCH 07/16] kexec: Disable at runtime if the kernel is locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
  [PATCH 08/16] Copy secure_boot flag in boot params across kexec  reboot David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
  [PATCH 12/16] ACPI: Limit access to custom_method when the kernel  is locked down David Howells <dhowells@redhat.com> - 2016-11-16 22:50 +0100
  [PATCH 03/16] efi: Disable secure boot if shim is in insecure mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
  [PATCH 04/16] efi: Lock down the kernel if booted in secure boot  mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
  [PATCH 11/16] x86: Lock down IO port access when the kernel is  locked down David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
  [PATCH 06/16] Add a sysrq option to exit secure boot mode David Howells <dhowells@redhat.com> - 2016-11-16 23:00 +0100
  Re: [PATCH 00/16] Kernel lockdown One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-11-16 23:30 +0100
    Re: [PATCH 00/16] Kernel lockdown Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-11-21 21:00 +0100
  Re: [PATCH 00/16] Kernel lockdown Justin Forbes <jmforbes@linuxtx.org> - 2016-11-16 23:30 +0100
  Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs  and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-22 07:30 +0100
    Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-23 14:00 +0100
      Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs  and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-23 20:30 +0100
        Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells <dhowells@redhat.com> - 2016-11-24 18:40 +0100
          Re: [PATCH] Lock down drivers that can have io ports, io mem, irqs  and dma changed Dominik Brodowski <linux@dominikbrodowski.net> - 2016-11-24 21:30 +0100

csiph-web