Re: [PATCH] x86: Lock down MSR writing in secure boot

From: Matthew Garrett
Date: Wed Feb 13 2013 - 12:56:31 EST

On Wed, 2013-02-13 at 09:51 -0800, Casey Schaufler wrote:
> On 2/13/2013 9:26 AM, Matthew Garrett wrote:
> > Admit that CAP_SYS_RAWIO is fucked up beyond rescue. Add a new
> > capability with well-defined semantics.
> You can't add a new capability where there is an existing capability
> that can be remotely argued to be appropriate.

CAP_SYS_RAWIO can't be argued to be appropriate. It covers a range of
functionality that doesn't permit the running kernel to be modified and
which is required to provide a functional Linux system. Using it would
require redefining its existing usage, which would break existing

Matthew Garrett | mjg59@xxxxxxxxxxxxx
¢éì®&Þ~º&¶¬–+-±éÝ¥Šw®žË±Êâmébžìdz¹Þ)í…æèw*jg¬±¨¶‰šŽŠÝj/êäz¹ÞŠà2ŠÞ¨è­Ú&¢)ß«a¶Úþø®G«éh®æj:+v‰¨Šwè†Ù>Wš±êÞiÛaxPjØm¶Ÿÿà -»+ƒùdš_