From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754072AbaCMPyp (ORCPT ); Thu, 13 Mar 2014 11:54:45 -0400 Received: from terminus.zytor.com ([198.137.202.10]:39183 "EHLO mail.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753238AbaCMPym (ORCPT ); Thu, 13 Mar 2014 11:54:42 -0400 Message-ID: <5321D49E.30705@zytor.com> Date: Thu, 13 Mar 2014 08:54:06 -0700 From: "H. Peter Anvin" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: One Thousand Gnomes , James Morris CC: Kees Cook , Andrew Morton , "jwboyer@fedoraproject.org" , "linux-kernel@vger.kernel.org" , "linux-efi@vger.kernel.org" , "gregkh@linuxfoundation.org" , "linux-security-module@vger.kernel.org" , Matthew Garrett Subject: Re: Trusted kernel patchset for Secure Boot lockdown References: <1393445473-15068-1-git-send-email-matthew.garrett@nebula.com> <1394686919.25122.2.camel@x230> <20140313101235.753c3ec0@alan.etchedpixels.co.uk> In-Reply-To: <20140313101235.753c3ec0@alan.etchedpixels.co.uk> X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/13/2014 03:12 AM, One Thousand Gnomes wrote: > > I would prefer it did the revocation of CAP_SYS_RAWIO or at least > documented the absolute requirement. > Seconded. This has been my opinion, raised over and over and over again. -hpa From mboxrd@z Thu Jan 1 00:00:00 1970 From: "H. Peter Anvin" Subject: Re: Trusted kernel patchset for Secure Boot lockdown Date: Thu, 13 Mar 2014 08:54:06 -0700 Message-ID: <5321D49E.30705@zytor.com> References: <1393445473-15068-1-git-send-email-matthew.garrett@nebula.com> <1394686919.25122.2.camel@x230> <20140313101235.753c3ec0@alan.etchedpixels.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20140313101235.753c3ec0-mUKnrFFms3BCCTY1wZZT65JpZx93mCW/@public.gmane.org> Sender: linux-efi-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: One Thousand Gnomes , James Morris Cc: Kees Cook , Andrew Morton , "jwboyer-rxtnV0ftBwyoClj4AeEUq9i2O/JbrIOy@public.gmane.org" , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "linux-efi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , "gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org" , "linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , Matthew Garrett List-Id: linux-efi@vger.kernel.org On 03/13/2014 03:12 AM, One Thousand Gnomes wrote: > > I would prefer it did the revocation of CAP_SYS_RAWIO or at least > documented the absolute requirement. > Seconded. This has been my opinion, raised over and over and over again. -hpa