Re: [PATCH] x86: Lock down MSR writing in secure boot

From: H. Peter Anvin
Date: Wed Feb 13 2013 - 13:46:07 EST


On 02/13/2013 09:56 AM, Matthew Garrett wrote:
On Wed, 2013-02-13 at 09:51 -0800, Casey Schaufler wrote:
On 2/13/2013 9:26 AM, Matthew Garrett wrote:
Admit that CAP_SYS_RAWIO is fucked up beyond rescue. Add a new
capability with well-defined semantics.

You can't add a new capability where there is an existing capability
that can be remotely argued to be appropriate.

CAP_SYS_RAWIO can't be argued to be appropriate. It covers a range of
functionality that doesn't permit the running kernel to be modified and
which is required to provide a functional Linux system. Using it would
require redefining its existing usage, which would break existing
userspace.


So people have piggybacked complete inappropriate junk onto CAP_SYS_RAWIO. Great. What the hell do we do now? We can't break apart CAP_SYS_RAWIO because we don't have hierarchical capabilities.

We thus have a bunch of unpalatable choices, **all of which are wrong**.

This, incidentally, is *exactly* the reason I object to CAP_COMPROMISE_KERNEL as well... it describes a usage model, not a resource.

-hpa

--
H. Peter Anvin, Intel Open Source Technology Center
I work for Intel. I don't speak on their behalf.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/