Re: [RFC] Second attempt at kernel secure boot support

[Eric W. Biederman]

Matthew Garrett <mjg@xxxxxxxxxx> writes:

> This is pretty much identical to the first patchset, but with the capability
> renamed (CAP_COMPROMISE_KERNEL) and the kexec patch dropped. If anyone wants
> to deploy these then they should disable kexec until support for signed
> kexec payloads has been merged.

A couple of thoughts.

1) I don't see anything disabling kdb or kgdb.  If ever there
   was a way to poke into the kernel and change things...

2) You almost certainly want to disable module removal.  It is all to
   easy to have races where that are not properly handled in the module
   removal path.  I know I saw a bundle of those in debugfs the other
   day.

3) And half seriously you probably want to disable mounting of
   filesystems.  I believe I have heard it said the kernel has not been
   vetted against a hostile root user mounting deliberately corrupted
   filesystem images.

As it is designed I don't believe your patchset can successfully achieve
the goal of keeping a determined root user from injecting code into the
kernel without disabling so many kernel features the kernel is
uninteresting for most people to run.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/