From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pavel Machek Subject: Re: [GIT PULL] Kernel lockdown for secure boot Date: Sun, 8 Apr 2018 10:10:50 +0200 Message-ID: <20180408081050.GA4965@amd> References: <4136.1522452584@warthog.procyon.org.uk> <186aeb7e-1225-4bb8-3ff5-863a1cde86de@kernel.org> <30459.1522739219@warthog.procyon.org.uk> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="17pEHd4RhPHOinZp" Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Matthew Garrett Cc: Linus Torvalds , luto@kernel.org, David Howells , Ard Biesheuvel , jmorris@namei.org, Alan Cox , Greg Kroah-Hartman , Linux Kernel Mailing List , jforbes@redhat.com, linux-man@vger.kernel.org, jlee@suse.com, LSM List , linux-api@vger.kernel.org, Kees Cook , linux-efi List-Id: linux-api@vger.kernel.org --17pEHd4RhPHOinZp Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue 2018-04-03 21:08:54, Matthew Garrett wrote: > On Tue, Apr 3, 2018 at 2:01 PM Linus Torvalds > > wrote: >=20 > > On Tue, Apr 3, 2018 at 1:54 PM, Matthew Garrett wrot= e: > > > > > >> .. maybe you don't *want* secure boot, but it's been pushed in your > > >> face by people with an agenda? > > > > > > Then turn it off, or build a self-signed kernel that doesn't do this? >=20 > > Umm. So you asked a question, and then when you got an answer you said > > "don't do that then". >=20 > > The fact is, some hardware pushes secure boot pretty hard. That has > > *nothing* to do with some "lockdown" mode. >=20 > Secure Boot ensures that the firmware will only load signed bootloaders. = If > a signed bootloader loads a kernel that's effectively an unsigned > bootloader, there's no point in using Secure Boot - you should just turn = it > off instead, because it's not giving you any meaningful > security. Andy's Not true. I have kernel with printk() enabled. Yes, once userland is started, you can boot another kernel, maybe. Maybe my kernel is locked down with exception of kexec, and it does printk(KERN_CRIT "kexecing") followed by mdelay(5000). That's pretty good security. Pavel --=20 (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blo= g.html --17pEHd4RhPHOinZp Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlrJzooACgkQMOfwapXb+vJyawCgucLLA8QbmX8zLUT7nIWXw5P+ p/sAoI5s8z1MIYAXdUMjuXLq63vVHR7v =llcn -----END PGP SIGNATURE----- --17pEHd4RhPHOinZp--