linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Pavel Machek <pavel@ucw.cz>
To: David Howells <dhowells@redhat.com>
Cc: keyrings@vger.kernel.org, matthew.garrett@nebula.com,
	linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 01/16] Add the ability to lock down access to the running kernel image
Date: Sun, 25 Dec 2016 22:20:24 +0100	[thread overview]
Message-ID: <20161225212023.GB26891@amd> (raw)
In-Reply-To: <147933284407.19316.17886320817060158597.stgit@warthog.procyon.org.uk>

[-- Attachment #1: Type: text/plain, Size: 1133 bytes --]

Hi!

> allow the running kernel image to be changed including the loading of
> modules that aren't validly signed with a key we recognise, fiddling with
> MSR registers and disallowing hibernation,

"." at EOL.

> @@ -158,6 +158,21 @@ config HARDENED_USERCOPY_PAGESPAN
>  	  been removed. This config is intended to be used only while
>  	  trying to find such users.
>  
> +config LOCK_DOWN_KERNEL
> +	bool "Allow the kernel to be 'locked down'"

Locked down, or 'locked down' ? :-).

> +	help
> +	  Allow the kernel to be locked down under certain circumstances, for
> +	  instance if UEFI secure boot is enabled.  Locking down the kernel
> +	  turns off various features that might otherwise allow access to the
> +	  kernel image (eg. setting MSR registers).

I'd add something that clarifies it is "running" kernel image.

> +config ALLOW_LOCKDOWN_LIFT
> +	bool

Don't you need to add 'bool "something"' so that user can actually
select this?
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

  parent reply	other threads:[~2016-12-25 21:20 UTC|newest]

Thread overview: 76+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-11-16 21:47 [PATCH 00/16] Kernel lockdown David Howells
2016-11-16 21:47 ` [PATCH 01/16] Add the ability to lock down access to the running kernel image David Howells
2016-11-16 22:20   ` Borislav Petkov
2016-11-16 22:40   ` David Howells
2016-12-25 21:20   ` Pavel Machek [this message]
2016-12-25 21:44   ` David Howells
2016-11-16 21:47 ` [PATCH 02/16] efi: Get the secure boot status David Howells
2016-11-17 12:37   ` Lukas Wunner
2016-11-22  0:31     ` [PATCH 1/6] x86/efi: Allow invocation of arbitrary runtime services David Howells
2016-11-22 10:20       ` Lukas Wunner
2016-11-22 14:17       ` David Howells
2016-11-22 14:58         ` Joe Perches
2016-11-22 15:52         ` David Howells
2016-11-22 16:25           ` Joe Perches
2016-11-22 16:40           ` David Howells
2016-11-22 16:51             ` Joe Perches
2016-11-22  0:31     ` [PATCH 2/6] arm/efi: " David Howells
2016-11-22  0:31     ` [PATCH 3/6] efi: Add SHIM and image security database GUID definitions David Howells
2016-11-22  0:32     ` [PATCH 4/6] efi: Get the secure boot status David Howells
2016-11-22 10:44       ` Lukas Wunner
2016-11-22 10:49         ` Ard Biesheuvel
2016-11-22 14:47       ` David Howells
2016-11-22 20:30         ` Lukas Wunner
2016-11-23  0:02         ` David Howells
2016-11-22 14:52       ` David Howells
2016-11-22 20:36         ` Lukas Wunner
2016-11-22 14:57       ` David Howells
2016-11-22  0:32     ` [PATCH 5/6] efi: Disable secure boot if shim is in insecure mode David Howells
2016-11-22 13:03       ` Lukas Wunner
2016-11-22  0:32     ` [PATCH 6/6] efi: Add EFI_SECURE_BOOT bit David Howells
2016-11-22 13:04       ` Lukas Wunner
2016-11-21 11:42   ` [PATCH 02/16] efi: Get the secure boot status David Howells
2016-11-21 11:52     ` Ard Biesheuvel
2016-11-21 12:41     ` David Howells
2016-11-21 13:14       ` Ard Biesheuvel
2016-11-21 15:17         ` Lukas Wunner
2016-11-21 15:25           ` Ard Biesheuvel
2016-11-21 11:46   ` David Howells
2016-11-21 19:58     ` Lukas Wunner
2016-11-16 21:47 ` [PATCH 03/16] efi: Disable secure boot if shim is in insecure mode David Howells
2016-11-16 21:47 ` [PATCH 04/16] efi: Lock down the kernel if booted in secure boot mode David Howells
2016-11-16 21:47 ` [PATCH 05/16] efi: Add EFI_SECURE_BOOT bit David Howells
2016-11-17 21:58   ` Ard Biesheuvel
2016-11-18 11:58     ` Josh Boyer
2016-11-18 12:10       ` Ard Biesheuvel
2016-11-18 17:28   ` David Howells
2016-11-16 21:48 ` [PATCH 06/16] Add a sysrq option to exit secure boot mode David Howells
2016-11-16 21:48 ` [PATCH 07/16] kexec: Disable at runtime if the kernel is locked down David Howells
2016-11-16 21:48 ` [PATCH 08/16] Copy secure_boot flag in boot params across kexec reboot David Howells
2016-11-16 21:48 ` [PATCH 09/16] hibernate: Disable when the kernel is locked down David Howells
2016-11-16 21:48 ` [PATCH 10/16] PCI: Lock down BAR access " David Howells
2016-11-16 21:48 ` [PATCH 11/16] x86: Lock down IO port " David Howells
2016-11-16 21:48 ` [PATCH 12/16] ACPI: Limit access to custom_method " David Howells
2016-11-16 21:48 ` [PATCH 13/16] asus-wmi: Restrict debugfs interface " David Howells
2016-11-16 21:48 ` [PATCH 14/16] Restrict /dev/mem and /dev/kmem " David Howells
2016-11-16 21:49 ` [PATCH 15/16] acpi: Ignore acpi_rsdp kernel param when the kernel has been " David Howells
2016-11-16 21:49 ` [PATCH 16/16] x86: Restrict MSR access when the kernel is " David Howells
2016-11-16 22:27 ` [PATCH 00/16] Kernel lockdown One Thousand Gnomes
2016-11-21 19:53   ` Ard Biesheuvel
2016-11-30 14:27     ` One Thousand Gnomes
2016-11-16 22:28 ` Justin Forbes
2016-11-21 23:10 ` [PATCH] Lock down drivers that can have io ports, io mem, irqs and dma changed David Howells
2016-11-22  6:12   ` Dominik Brodowski
2016-11-23 12:58   ` David Howells
2016-11-23 19:21     ` Dominik Brodowski
2016-11-24 17:34     ` David Howells
2016-11-24 20:19       ` Dominik Brodowski
2016-11-25 14:49       ` David Howells
2016-11-28 22:32   ` Corey Minyard
2016-11-29  0:11   ` David Howells
2016-11-29  0:23     ` Corey Minyard
2016-11-29 14:03     ` David Howells
2016-11-29 14:35       ` Corey Minyard
2016-11-30 14:41       ` One Thousand Gnomes
2016-11-30 16:25       ` David Howells
2016-11-29 10:40   ` David Howells

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20161225212023.GB26891@amd \
    --to=pavel@ucw.cz \
    --cc=dhowells@redhat.com \
    --cc=keyrings@vger.kernel.org \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=matthew.garrett@nebula.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).