Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode

From	David Howells <dhowells@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode
Date	2017-06-06 11:40 +0200
Message-ID	<tPj7X-6SP-1@gated-at.bofh.it> (permalink)
References	<tNa8N-48w-1@gated-at.bofh.it> <tKFLQ-3z2-5@gated-at.bofh.it> <tMUx3-2xi-7@gated-at.bofh.it> <tN870-2UY-19@gated-at.bofh.it> <tNa8N-48w-1@gated-at.bofh.it>
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw

Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:

> and print a subsequent line for every lockdown feature that is enabled, e.g.,
> 
> lockdown: disabling MSRs
> lockdown: disabling hibernate support

There's another problem with this idea: the lockdown facility is passive - it
doesn't go looking for things to lock down; rather, things that can be locked
down inquire as to whether lockdown is in effect at the point someone tries to
use them.

Now, I could reserve a variable for each thing we lock down to make sure that
we don't emit the message more than once, but I'm loathe to waste memory this
way.

I can't so easily switch the facility to being active either, since a lot of
the lockdownables are in modules.

David

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-05-30 21:00 +0200
  Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode David Howells <dhowells@redhat.com> - 2017-05-31 11:30 +0200
    Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-05-31 13:40 +0200
      Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode David Howells <dhowells@redhat.com> - 2017-05-31 15:40 +0200
        Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-05-31 16:10 +0200
      Re: [PATCH 0/5] security, efi: Set lockdown if in secure boot mode David Howells <dhowells@redhat.com> - 2017-06-06 11:40 +0200

csiph-web